Client GET requests with transfer-encoding are wrongly stripped

[seanmonstar]

The client wrongly strips transfer-encoding: chunked from GET requests, thinking that GET requests shouldn't have payloads. However, that's not explicitly true:

A payload within a GET request message has no defined semantics;
sending a payload body on a GET request might cause some existing
implementations to reject the request.

The original implementation was trying to protect from empty Body::wrap_stream(some_empty_stream)s automatically adding transfer-encoding: chunked to a GET request.

The fix should probably still protect against that, but if the transfer-encoding header has been explicitly set on the Request, it should be forwarded as-is.

[Shnatsel]

FYI there is a PR open against RustSec vulnerability database describing this issue as a potential request smuggling vector: rustsec/advisory-db#255

This article provides a nice explanation of request smuggling vulnerabilities: https://portswigger.net/web-security/request-smuggling

Any additional info from the maintainers would be appreciated.