From 18c40c778db2aabe64c996d009fd7b1e070b656e Mon Sep 17 00:00:00 2001
From: A13501350 <18516149786@163.com>
Date: Sat, 22 Aug 2026 23:56:52 +0800
Subject: [PATCH] iis: drop chunked Transfer-Encoding when Content-Length is
 set

WriteBodyCallback copies the request Transfer-Encoding header verbatim and
then sets Content-Length, so the forwarded request could contain both
Transfer-Encoding: chunked and Content-Length, which is malformed and
rejected by some backends.

Delete the Transfer-Encoding header when it is chunked right before setting
Content-Length, so only one framing header remains.

Adapted from microsoft/ModSecurity waf_iis.
---
 iis/mymodule.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/iis/mymodule.cpp b/iis/mymodule.cpp
index dfaee4b2cb..07bc4cf370 100644
--- a/iis/mymodule.cpp
+++ b/iis/mymodule.cpp
@@ -1147,6 +1147,17 @@ apr_status_t WriteBodyCallback(request_rec *r, char *buf, unsigned int length)
 		// not possible
     }
 
+	// Remove the Transfer-Encoding header if "chunked" is set in the request.
+	// ModSecurity always sends Content-Length, so leaving chunked would produce a
+	// request with both headers, which is malformed.
+	USHORT teLen = 0;
+	PCSTR te = pHttpRequest->GetHeader(HttpHeaderTransferEncoding, &teLen);
+	if (te != NULL && teLen != 0 &&
+	    0 == stricmp(ZeroTerminate(te, teLen, r->pool), "chunked"))
+	{
+		pHttpRequest->DeleteHeader(HttpHeaderTransferEncoding);
+	}
+
     hr = pHttpRequest->SetHeader(
             HttpHeaderContentLength, 
             szLength,