Detect chunked transfer-encoding as last value

[rsclarke]

Hi,

Whilst Transfer-Encoding: chunked is commonplace, RFC 7230 does permit comma separated values, in which chunked should be the last value.

This has influence on early body detection,

zuul/zuul-core/src/main/java/com/netflix/zuul/netty/server/ClientRequestReceiver.java

Lines 379 to 381 in 2232215

	if (HttpUtils.hasChunkedTransferEncodingHeader(request) || HttpUtils.hasNonZeroContentLengthHeader(request)) {
	request.setHasBody(true);
	}

Filters implementing shouldFilter relying on request.hasBody() evaluating to true may be skipped when subsequent HTTP content arrives after initial header processing in the pipeline.

More broadly, is the presence of the "Transfer-Encoding" header sufficient to call request.setHasBody(true), rather than explicitly checking for chunked?

I initially filed this issue through HackerOne (report id 3333247) as custom security filters dependent on the body may be bypassed, but it was triaged as informative and closed by HackerOne.