# Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444)

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities, but it does not interpret malformed HTTP requests in the same way as the entities it is communicating with.

- Prevalence: 中 覆盖 1 种语言
- Impact: 中 建议审查
- Prevention: 已记录 1 个修复示例

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

HTTP request smuggling exploits discrepancies in how different servers parse HTTP requests. Attackers can use this to bypass security controls, poison caches, or hijack other users' requests.

## Prevention

### Python

Hash user input before using it in cache keys to prevent key injection

## Warning Signs

- [MEDIUM] cache key construction using unsanitized user input

## Consequences

- 绕过保护机制
- 执行未授权代码
- 获取权限

## Mitigations

- 在转发前对 HTTP 请求进行规范化
- 在整个基础设施中使用相同的 HTTP 解析库
- 拒绝 Content-Length 与 Transfer-Encoding 冲突的歧义请求

## Detection

- Total rules: 1
- Languages: python

## Rules by Language

### Python (1 rules)

- **HTTP Cache Poisoning** [MEDIUM]: Detects cache key construction using unsanitized user input. Cache poisoning
occurs when attackers manipulate cache keys to serve malicious content to
other users or bypass security controls.
  - Remediation: Hash user input before using in cache keys to prevent poisoning.

```python
import hashlib

def safe_cache_key(user_input: str) -> str:
    safe = ''.join(c for c in user_input if c.isalnum())
    return hashlib.sha256(safe.encode()).hexdigest()[:16]

cache_key = safe_cache_key(request.args.get('q'))
cache.set(cache_key, results, timeout=300)
```

Learn more: https://shoulder.dev/learn/python/cwe-444/cache-poisoning