umgeher/cowboy
0
Fork 0
mirror of https://github.com/ninenines/cowboy.git synced 2025-07-14 12:20:24 +00:00
Code Issues Wiki Activity

Add more HTTP/1.1 header parsing tests

Browse source 
Fix a case where Cowboy was waiting for more data that simply
did not come. Now Cowboy will generate an error immediately
when a header line has no colon separator.

These test cases come from known request smuggling attack
vectors. Cowboy was not vulnerable to any of them.
This commit is contained in:
Loïc Hoguin 2019-10-02 13:31:13 +02:00
parent 8e31548597
commit a14ecf19c6
No known key found for this signature in database
GPG key ID: 8A9DF795F6FED764
2 changed files with 84 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/cowboy_http.erl
View file

@ -541,7 +541,16 @@ parse_header_colon(Buffer, State=#state{opts=Opts, in_state=PS}, Headers) ->
{connection_error, limit_reached,
'A header name is larger than configuration allows. (RFC7230 3.2.5, RFC6585 5)'});
nomatch ->
{more, State#state{in_state=PS#ps_header{headers=Headers}}, Buffer};
%% We don't have a colon but we might have an invalid header line,
%% so check if we have an LF and abort with an error if we do.
case match_eol(Buffer, 0) of
nomatch ->
{more, State#state{in_state=PS#ps_header{headers=Headers}}, Buffer};
_ ->
error_terminate(400, State#state{in_state=PS#ps_header{headers=Headers}},
{connection_error, protocol_error,
'A header line is missing a colon separator. (RFC7230 3.2.4)'})
end;
_ ->
parse_hd_name(Buffer, State, Headers, <<>>)
end.