Prefer chunked Transfer-Encoding over Content-Length when parsing requests

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: kevinresol

src/tink/http/Request.hx

@@ -163,11 +163,17 @@ class IncomingRequest extends Message<IncomingRequestHeader, IncomingRequestBody
           parts.a,
           Plain(switch parts.a.getContentLength() {
             case Success(len):
-              parts.b.limit(len);
+              // RFC 7230 §3.3.3: a chunked Transfer-Encoding takes precedence over Content-Length
+              switch parts.a.byName(TRANSFER_ENCODING) {
+                case Success((_:String).toLowerCase().split(',').map(StringTools.trim) => encodings) if(encodings.indexOf('chunked') != -1):
+                  Chunked.decode(parts.b);
+                case _:
+                  parts.b.limit(len);
+              }
             case Failure(_):
               switch [parts.a.method, parts.a.byName(TRANSFER_ENCODING)] {
                 case [GET | OPTIONS, _]: Source.EMPTY;
-                case [_, Success((_:String).split(',').map(StringTools.trim) => encodings)] if(encodings.indexOf('chunked') != -1): Chunked.decode(parts.b);
+                case [_, Success((_:String).toLowerCase().split(',').map(StringTools.trim) => encodings)] if(encodings.indexOf('chunked') != -1): Chunked.decode(parts.b);
                 case _: return new Error(411, 'Content-Length header missing');
               }
           })

tests/TestHeader.hx

@@ -174,4 +174,18 @@ class TestHeader {
 	@:variant('foo', 'bar', 'Basic Zm9vOmJhcg==')
 	public function basicAuth(username:String, password:String, output:String)
 		return assert(HeaderValue.basicAuth(username, password) == output);
+
+	// a chunked Transfer-Encoding must be used even when Content-Length is present (RFC 7230 §3.3.3),
+	// and the token match must be case-insensitive
+	public function parseBodyPrefersTransferEncoding() {
+		var raw:IdealSource = 'POST / HTTP/1.1\r\nContent-Length: 999\r\nTransfer-Encoding: Chunked\r\n\r\n3\r\n123\r\n0\r\n\r\n';
+		IncomingRequest.parse('127.0.0.1', raw)
+			.next(function(req) return switch req.body {
+				case Plain(source): source.all();
+				case Parsed(_): new Error('unexpected parsed body');
+			})
+			.next(function(chunk) return asserts.assert(chunk.toString() == '123'))
+			.handle(asserts.handle);
+		return asserts;
+	}
 }