anomalies.yml

# This yaml file tracks the acceptable parsing anomalies in the servers.
aiohttp:
  allows-missing-host-header: true
apache:
  allows-http-0-9: true
  translates-chunked-to-cl: true
beast:
  allows-missing-host-header: true
cherrypy:
  requires-length-in-post: true
  header-name-translation: {'-': '_'}
daphne:
  allows-missing-host-header: true
deno:
  allows-missing-host-header: true
  doesnt-support-version: true
fasthttp:
  added-headers: [['content-length', '0']]
  allows-http-0-9: true
  allows-missing-host-header: true
gunicorn:
  header-name-translation: {"-": "_"}
  allows-missing-host-header: true
h2o:
  added-headers: [['host', '0.0.0.0']]
  allows-missing-host-header: true
  translates-chunked-to-cl: true
  header-name-translation: {"-": "_"}
hyper:
  allows-missing-host-header: true
jetty:
  allows-http-0-9: true
libevent:
  allows-missing-host-header: true
lighttpd:
  added-headers: [['content-length', '0']]
  translates-chunked-to-cl: true
  requires-length-in-post: true
mongoose:
  allows-missing-host-header: true
nginx:
  allows-http-0-9: true
nodejs:
  allows-http-0-9: true
ols:
  translates-chunked-to-cl: true
  allows-missing-host-header: true
passenger:
  allows-http-0-9: true
  allows-missing-host-header: true
  doesnt-support-version: true
  removed-headers: [["connection", "close"]]
  method-whitelist: ["DELETE", "GET", "HEAD", "POST", "PUT", "CONNECT", "OPTIONS", "TRACE", "COPY", "LOCK", "MKCOL", "MOVE", "PROPFIND", "PROPPATCH", "SEARCH", "UNLOCK", "BIND", "REBIND", "UNBIND", "ACL", "REPORT", "MKACTIVITY", "CHECKOUT", "MERGE", "M-SEARCH", "NOTIFY", "SUBSCRIBE", "UNSUBSCRIBE", "PATCH", "PURGE", "MKCALENDAR", "LINK", "UNLINK", "SOURCE"]  # From https://github.com/phusion/passenger/blob/fec188dca3cbd2545dee11e652b3e9c686aff768/src/cxx_supportlib/ServerKit/http_parser.h#L168
puma:
  allows-missing-host-header: true
  translates-chunked-to-cl: true
  header-name-translation: {'-': '_'}
tomcat:
  allows-http-0-9: true
tornado:
  allows-missing-host-header: true
  method-whitelist: ["GET", "HEAD", "POST", "DELETE", "PATCH", "PUT", "OPTIONS"]  # From https://github.com/tornadoweb/tornado/blob/65a9e48f8ce645f104e3e0aa772222e70b0376d9/tornado/web.py#L195
uhttpd:
  allows-missing-host-header: true
unicorn:
  allows-http-0-9: true
  allows-missing-host-header: true
  header-name-translation: {'-': '_'}
waitress:
  allows-http-0-9: true
  allows-missing-host-header: true
  translates-chunked-to-cl: true
  header-name-translation: {"-": "_"}
webrick:
  allows-http-0-9: true
  requires-length-in-post: true
  allows-missing-host-header: true
  header-name-translation: {'-': '_'}
  removed-headers: [["content-length", "0"]]
  doesnt-support-version: true
werkzeug:
  allows-http-0-9: true
  allows-missing-host-header: true
  doesnt-support-version: true