lpeg_patterns/http: Allow OWS between STS directives

Author: daurnimator

lpeg_patterns/http.lua

@@ -420,7 +420,7 @@ _M.Sec_WebSocket_Version_Server = comma_sep(version)
 -- RFC 6797
 local directive_name = _M.token / string.lower
 local directive_value = _M.token + _M.quoted_string
-local directive = Cg(directive_name * ((P"=" * directive_value) + Cc(true)))
+local directive = Cg(directive_name * ((_M.OWS * P"=" * _M.OWS * directive_value) + Cc(true)))
 _M.Strict_Transport_Security = directive^-1 * (_M.OWS * P";" * _M.OWS * directive^-1)^0
 
 -- RFC 7089

spec/http_spec.lua

@@ -201,4 +201,12 @@ describe("http patterns", function()
 		assert.same({"foo", {filename="example"}}, Content_Disposition:match"foo; filename=example")
 		assert.same({"foo", {filename="example"}}, Content_Disposition:match"foo; filename*=UTF-8''example")
 	end)
+	it("Parses a Strict-Transport-Security header", function()
+		local sts_patt = lpeg.Cf(lpeg.Ct(true) * http.Strict_Transport_Security, rawset) * EOF
+		assert.same({["max-age"] = "0"}, sts_patt:match("max-age=0"))
+		assert.same({["max-age"] = "0"}, sts_patt:match("max-age = 0"))
+		assert.same({["max-age"] = "0"}, sts_patt:match("Max-Age=0"))
+		assert.same({["max-age"] = "0"; includesubdomains = true}, sts_patt:match("max-age=0;includeSubdomains"))
+		assert.same({["max-age"] = "0"; includesubdomains = true}, sts_patt:match("max-age=0 ; includeSubdomains"))
+	end)
 end)