Normalize framing header names with pre-colon whitespace

headerscanner.go

@@ -53,6 +53,7 @@ func (s *headerScanner) next() bool {
 		s.err = fmt.Errorf("malformed MIME header line: %q", kv)
 		return false
 	}
+	k = trimTrailingSpace(k)
 	if !isValidHeaderKey(k) {
 		s.err = fmt.Errorf("malformed MIME header line: %q", kv)
 		return false
@@ -166,3 +167,14 @@ func trim(s []byte) []byte {
 	}
 	return s[i:n]
 }
+
+func trimTrailingSpace(s []byte) []byte {
+	for len(s) > 0 {
+		c := s[len(s)-1]
+		if c != ' ' && c != '\t' {
+			break
+		}
+		s = s[:len(s)-1]
+	}
+	return s
+}

http_test.go

@@ -1777,6 +1777,28 @@ func TestRequestReadLimitBody(t *testing.T) {
 	testRequestReadLimitBodySuccess(t, "GET /foo HTTP/1.0\r\n\r\n", 0)
 }
 
+func TestRequestReadLimitBodyWhitespaceBeforeColonFramingHeaders(t *testing.T) {
+	t.Parallel()
+
+	var req Request
+	r := bytes.NewBufferString("POST /foo HTTP/1.1\r\nHost: a.com\r\nContent-Length : 4\r\n\r\ntestNEXT")
+	br := bufio.NewReader(r)
+	if err := req.ReadLimitBody(br, 10); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got := string(req.Body()); got != "test" {
+		t.Fatalf("unexpected body %q", got)
+	}
+
+	rest, err := io.ReadAll(br)
+	if err != nil {
+		t.Fatalf("unexpected read error: %v", err)
+	}
+	if got := string(rest); got != "NEXT" {
+		t.Fatalf("unexpected buffered bytes %q", got)
+	}
+}
+
 func testResponseReadLimitBodyError(t *testing.T, s string, maxBodySize int, expectedErr error) {
 	var resp Response
 	r := bytes.NewBufferString(s)

streaming_test.go

@@ -133,7 +133,7 @@ func getChunkedTestEnv(t testing.TB) (*fasthttputil.InmemoryListener, []byte) {
 	}()
 
 	req := Request{}
-	req.SetHost("localhost")
+	req.Header.SetHost("localhost")
 	req.Header.SetMethod("POST")
 	req.Header.Set("transfer-encoding", "chunked")
 	req.Header.SetContentLength(-1)