Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate Content-Length headers for incoming requests #3231

Merged
merged 1 commit into from Mar 6, 2018
Merged

Conversation

@bryancall
Copy link
Contributor

@bryancall bryancall commented Mar 5, 2018

Respond with 400 code when Content-Length headers mismatch, remove
duplicate copies of the Content-Length header with exactly same values,
and remove Content-Length headers if Transfer-Encoding header exists.

@bryancall bryancall added the HTTP label Mar 5, 2018
@bryancall bryancall added this to the 8.0.0 milestone Mar 5, 2018
@bryancall bryancall self-assigned this Mar 5, 2018
@bryancall bryancall requested a review from zwoop Mar 5, 2018
@zwoop
Copy link
Contributor

@zwoop zwoop commented Mar 5, 2018

[approve ci debian]


if ((content_length_len != content_length_len_2) ||
(memcmp(content_length_val, content_length_val_2, content_length_len) != 0)) {
// Delete the duplicate since it has the same value
Copy link
Contributor

@zwoop zwoop Mar 5, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment looks wrong? In this case, you are returning a parse error, not removing the dupe, right?

Copy link
Contributor Author

@bryancall bryancall Mar 5, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, the comment is wrong

@zwoop zwoop added this to 7.1.3 backport in 7.x releases Mar 5, 2018
duplicate copies of the Content-Length header with exactly same values,
and remove Content-Length headers if Transfer-Encoding header exists.
zwoop
zwoop approved these changes Mar 6, 2018
@bryancall bryancall merged commit 44af6e5 into master Mar 6, 2018
9 checks passed
@zwoop
Copy link
Contributor

@zwoop zwoop commented Mar 6, 2018

Cherry-picked to 7.1.x

@zwoop zwoop removed this from 7.1.3 backport in 7.x releases Mar 6, 2018
@zwoop zwoop removed this from the 8.0.0 milestone Mar 6, 2018
@zwoop zwoop added this to the 7.1.3 milestone Mar 6, 2018
@bryancall bryancall deleted the content_length branch Mar 14, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants