-
Notifications
You must be signed in to change notification settings - Fork 39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NPE when nonstandard HTTP method is used in request and broken connection #107
Comments
This is because list of supported methods is loaded here vertx-dropwizard-metrics/src/main/java/io/vertx/ext/dropwizard/impl/HttpMetricsImpl.java Line 54 in 4ea6d3f
As this is not initiated NPE is thrown. This is a critical bug as a server can be rendered useless by attacker in few steps. Maybe init the stat by method lazily so that this NPE can not fire. |
I was able to replicated but this (with your gist) will not affect the server, it won't get blocked. |
It doesn't seem critical, the broken connection is your connection i.e. only the next sender request will hang. Though I'm not sure what happens to this connection later, maybe it can lead to resource exhaustion if you send a lot of such requests. |
I get this same stack trace in 4.5.1 whenever my site is scanned by CensysInspect. The cause appears different. Always happens after the following log entries: |
Fixes vert-x3#107 If the HTTP method is not standard, skip specific method / uri request metrics. Signed-off-by: Thomas Segismont <tsegismo@redhat.com>
See vert-x3#107 If the HTTP method is not standard, skip specific method / uri request metrics. Signed-off-by: Thomas Segismont <tsegismo@redhat.com>
Fixes vert-x3#107 If the HTTP method is not standard, skip specific method / uri request metrics. Signed-off-by: Thomas Segismont <tsegismo@redhat.com>
See #107 If the HTTP method is not standard, skip specific method / uri request metrics. Signed-off-by: Thomas Segismont <tsegismo@redhat.com>
Fixes #107 If the HTTP method is not standard, skip specific method / uri request metrics. Signed-off-by: Thomas Segismont <tsegismo@redhat.com>
Closed by #114 |
Version
4.2.5
Context
Sending a request with nonstandard HTTP method to a Vert.x app with Dropwizard metrics enabled always results in an NPE. It also seems to leave the connection in a broken state.
Do you have a reproducer?
Yes, see gist. Let me know if you need the entire project though this is just a basic project from the app generator with
vertx-web
andvertx-dropwizard-metrics
.Steps to reproduce
Server started
curl -X FAKE http://localhost:8080
you will see response and NPE.Extra
Tested on Linux and macOS. JVM 11.
The text was updated successfully, but these errors were encountered: