Mattermost, Inc.

Incoming webhook rejected due to Content-Type header

Summary

Webhooks with a Content-Type: application/x-www-form-urlencoded; charset=UTF-8 header is accepted, Content-Type: application/x-www-form-urlencoded;charset=UTF-8 is rejected

Steps to reproduce

Send a properly formed incoming webhook with a Content-Type: application/x-www-form-urlencoded;charset=UTF-8 header.

Mattermost Version: 5.19.1
Database Schema Version: 5.19.0
Database: postgres

Expected behavior

Content from webhook appears in channel.

Observed behavior

Content from webhook does not appear in channel, error appears in logs. Unable to parse incoming data.

{"level":"error","ts":1579749627.7594903,"caller":"mlog/log.go:174","msg":"Unable to parse incoming data","path":"/hooks/{redacted}","request_id":"{redacted}","ip_addr":"18.194.228.6","user_id":"","method":"POST","err_where":"IncomingWebhookRequestFromJson","http_code":400,"err_details":"EOF"}

Reviewing RFCs 7230 (section 3.2.3) and 7231 (sections 3.1.1.5 and 3.1.1.1), it appears that Mattermost is not following the HTTP spec, which indicates that both a space or no space as valid.