Patched code sample

import io

def fixed_parser_logic(request_stream: io.BytesIO):
    """
    Simulates the fixed parser logic that correctly processes HTTP trailer
    headers, which is the core of the fix for CVE-2025-53643.

    A vulnerable parser would incorrectly stop processing after the
    zero-length chunk, leaving the trailer headers and the subsequent
    smuggled request in the stream buffer to be misinterpreted by a
    downstream server.
    """
    headers = {}
    body = b""
    trailers = {}

    # Step 1: Parse headers (simplified for demonstration)
    while True:
        line = request_stream.readline()
        # The header section ends with an empty line
        if line in (b'\r\n', b'\n', b''):
            break
        # Ignore the request line for this example
        if b':' in line:
            key, value = line.decode().split(":", 1)
            headers[key.strip()] = value.strip()

    if headers.get("Transfer-Encoding", "").lower() != "chunked":
        print("This demonstration requires a chunked request.")
        return

    # Step 2: Parse chunked body
    while True:
        size_line = request_stream.readline().strip()
        if not size_line:
            continue
        chunk_size = int(size_line, 16)

        if chunk_size == 0:
            # Reached the end of the chunked body.
            # A vulnerable parser would stop here.
            # A fixed parser proceeds to handle trailers.
            break

        # Read the chunk data and the trailing CRLF
        body += request_stream.read(chunk_size)
        request_stream.read(2)

    # Step 3: THE FIX - Correctly parse the trailer section
    # This loop consumes the trailer headers until an empty line is found,
    # ensuring they are part of the first request.
    while True:
        line = request_stream.readline()
        if line in (b'\r\n', b'\n', b''):
            # The empty line signifies the end of the trailers
            # and the true end of the HTTP message.
            break
        key, value = line.decode().strip().split(":", 1)
        trailers[key.strip()] = value.strip()

    # Step 4: Show parsed components and what remains in the stream
    remaining_data_in_buffer = request_stream.read()

    print("--- Demonstrating Fixed Parser Behavior ---")
    print(f"\n[OK] Parsed Body: {parsed_body.decode()!r}")
    print(f"[OK] Parsed Trailers: {parsed_trailers}")
    print("\n--- Buffer State After Parsing ---")
    if remaining_data_in_buffer:
        print("[FIX EFFECTIVE] Smuggled request was NOT parsed and remains in the buffer:")
        print("------------------")
        print(remaining_data_in_buffer.decode())
        print("------------------")
    else:
        print("[OK] No data left in buffer.")


if __name__ == '__main__':
    # This payload contains a valid chunked request followed by trailer headers
    # and then a second, "smuggled" request.
    request_with_trailers_and_smuggled_data = b"""POST /upload HTTP/1.1
Host: an-example.com
Content-Type: text/plain
Transfer-Encoding: chunked

7
aiohttp
0
X-Request-Info: trailer-data-here

GET /admin HTTP/1.1
Host: an-example.com
Connection: keep-alive

"""

    # Create a stream to simulate network I/O
    stream = io.BytesIO(request_with_trailers_and_smuggled_data)

    # Run the demonstration
    fixed_parser_logic(stream)