umgeher/cowboy
0
Fork 0
mirror of https://github.com/ninenines/cowboy.git synced 2025-07-14 12:20:24 +00:00
Code Issues Wiki Activity

Reject invalid Connection header format

Browse source
This commit is contained in:
Boris Pozdnyakov 2023-02-17 16:34:54 +04:00
parent 879a6b8bc5
commit 72b9fa4120
2 changed files with 27 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

27
src/cowboy_http.erl
View file

@ -357,7 +357,10 @@ after_parse({request, Req=#{streamid := StreamID, method := Method,
method=Method, version=Version, te=TE}|Streams0], method=Method, version=Version, te=TE}|Streams0],
State1 = case maybe_req_close(State0, Headers, Version) of State1 = case maybe_req_close(State0, Headers, Version) of
close -> State0#state{streams=Streams, last_streamid=StreamID, flow=Flow}; close -> State0#state{streams=Streams, last_streamid=StreamID, flow=Flow};
keepalive -> State0#state{streams=Streams, flow=Flow} keepalive -> State0#state{streams=Streams, flow=Flow};
invalid_connection_header ->
error_terminate(400, State0,
{stream_error, protocol_error, 'The Connection header is invalid. (RFC7230 3.2.6) (RFC7230 6.1)'})
end, end,
State = set_timeout(State1, idle_timeout), State = set_timeout(State1, idle_timeout),
parse(Buffer, commands(State, StreamID, Commands)) parse(Buffer, commands(State, StreamID, Commands))
@ -1341,17 +1344,25 @@ stream_call_terminate(StreamID, Reason, StreamState, #state{opts=Opts}) ->
maybe_req_close(#state{opts=#{http10_keepalive := false}}, _, 'HTTP/1.0') -> maybe_req_close(#state{opts=#{http10_keepalive := false}}, _, 'HTTP/1.0') ->
close; close;
maybe_req_close(_, #{<<"connection">> := Conn}, 'HTTP/1.0') -> maybe_req_close(_, #{<<"connection">> := Conn}, 'HTTP/1.0') ->
Conns = cow_http_hd:parse_connection(Conn), try
case lists:member(<<"keep-alive">>, Conns) of Conns = cow_http_hd:parse_connection(Conn),
true -> keepalive; case lists:member(<<"keep-alive">>, Conns) of
false -> close true -> keepalive;
false -> close
end
catch _:_ ->
invalid_connection_header
end; end;
maybe_req_close(_, _, 'HTTP/1.0') -> maybe_req_close(_, _, 'HTTP/1.0') ->
close; close;
maybe_req_close(_, #{<<"connection">> := Conn}, 'HTTP/1.1') -> maybe_req_close(_, #{<<"connection">> := Conn}, 'HTTP/1.1') ->
case connection_hd_is_close(Conn) of try
true -> close; case connection_hd_is_close(Conn) of
false -> keepalive true -> close;
false -> keepalive
end
catch _:_ ->
invalid_connection_header
end; end;
maybe_req_close(_, _, _) -> maybe_req_close(_, _, _) ->
keepalive. keepalive.

8
test/rfc7230_SUITE.erl
View file

@ -754,6 +754,14 @@ invalid_header_value(Config) ->
"Host: localhost\0rm rf the world\r\n" "Host: localhost\0rm rf the world\r\n"
"\r\n"]). "\r\n"]).
invalid_header_connection(Config) ->
doc("Header field Connection has invalid format. (RFC7230 3.2.6) (RFC7230 6.1)"),
#{code := 400} = do_raw(Config, [
"GET / HTTP/1.1\r\n"
"Host: localhost\r\n"
"Connection: jndi{ldap127\r\n"
"\r\n"]).
lower_case_header(Config) -> lower_case_header(Config) ->
doc("The header field name is case insensitive. (RFC7230 3.2)"), doc("The header field name is case insensitive. (RFC7230 3.2)"),
#{code := 200} = do_raw(Config, [ #{code := 200} = do_raw(Config, [