+1 -1

CHANGELOG.md

Reviewed

··· 3 3 # Unreleased 4 4 5 5 - Remove all usage of `string.inspect` as it's a huge anti-pattern for logging. 6 6 - - Patch infinite loop on rejected trailer headers inside `handle_trailers`. 6 6 + - Patch infinite loops and adjust allowed entries for trailer headers. 7 7 8 8 # v3.0.4 - 13.03.2026 9 9

+2

dev/benchmark.gleam

Reviewed

··· 24 24 http.Post, ["user"] -> { 25 25 case ewe.read_body(req, 40_000_000) { 26 26 Ok(req) -> { 27 27 + echo req.headers 28 28 + 27 29 let content_type = 28 30 req 29 31 |> request.get_header("content-type")

+5 -15

src/ewe/internal/http1.gleam

Reviewed

··· 508 508 509 509 case field_name { 510 510 Ok(field_name) -> { 511 511 - case 512 512 - set.contains(set, field_name) && !is_forbidden_trailer(field_name) 513 513 - { 511 511 + case set.contains(set, field_name) && is_allowed_trailer(field_name) { 514 512 True -> { 515 513 case bit_array.to_string(value) { 516 514 Ok(value) -> { ··· 530 528 } 531 529 } 532 530 533 533 - /// Checks if a header field is forbidden in trailers. 534 534 - fn is_forbidden_trailer(field: String) -> Bool { 535 535 - case string.lowercase(field) { 536 536 - "transfer-encoding" 537 537 - | "content-length" 538 538 - | "host" 539 539 - | "cache-control" 540 540 - | "expect" 541 541 - | "max-forwards" 542 542 - | "pragma" 543 543 - | "range" 544 544 - | "te" -> True 531 531 + /// Checks if a trailer field is allowed. 532 532 + fn is_allowed_trailer(field: String) -> Bool { 533 533 + case field { 534 534 + "server-timing" | "content-digest" | "repr-digest" -> True 545 535 _ -> False 546 536 } 547 537 }