umgeher/cowboy
0
Fork 0
mirror of https://github.com/ninenines/cowboy.git synced 2025-07-14 12:20:24 +00:00
Code Issues Wiki Activity

Reject invalid Connection header

Browse source 
LH: Small tweaks and added an HTTP/1.0 test.
This commit is contained in:
Boris Pozdnyakov 2023-02-17 16:34:54 +04:00 • committed by Loïc Hoguin
parent 1547e9b93e
commit e200272178
No known key found for this signature in database
GPG key ID: 8A9DF795F6FED764
2 changed files with 43 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/cowboy_http.erl
View file

@ -350,11 +350,17 @@ after_parse({request, Req=#{streamid := StreamID, method := Method,
TE = maps:get(<<"te">>, Headers, undefined),
Streams = [#stream{id=StreamID, state=StreamState,
method=Method, version=Version, te=TE}|Streams0],
State1 = case maybe_req_close(State0, Headers, Version) of
close -> State0#state{streams=Streams, last_streamid=StreamID, flow=Flow};
keepalive -> State0#state{streams=Streams, flow=Flow}
State1 = State0#state{streams=Streams, flow=Flow},
State2 = case maybe_req_close(State1, Headers, Version) of
close ->
State1#state{last_streamid=StreamID};
keepalive ->
State1;
bad_connection_header ->
error_terminate(400, State1, {connection_error, protocol_error,
'The Connection header is invalid. (RFC7230 6.1)'})
end,
State = set_timeout(State1, idle_timeout),
State = set_timeout(State2, idle_timeout),
parse(Buffer, commands(State, StreamID, Commands))
catch Class:Exception:Stacktrace ->
cowboy:log(cowboy_stream:make_error_log(init,
@ -1353,17 +1359,23 @@ stream_call_terminate(StreamID, Reason, StreamState, #state{opts=Opts}) ->
maybe_req_close(#state{opts=#{http10_keepalive := false}}, _, 'HTTP/1.0') ->
close;
maybe_req_close(_, #{<<"connection">> := Conn}, 'HTTP/1.0') ->
Conns = cow_http_hd:parse_connection(Conn),
case lists:member(<<"keep-alive">>, Conns) of
true -> keepalive;
false -> close
try cow_http_hd:parse_connection(Conn) of
Conns ->
case lists:member(<<"keep-alive">>, Conns) of
true -> keepalive;
false -> close
end
catch _:_ ->
bad_connection_header
end;
maybe_req_close(_, _, 'HTTP/1.0') ->
close;
maybe_req_close(_, #{<<"connection">> := Conn}, 'HTTP/1.1') ->
case connection_hd_is_close(Conn) of
try connection_hd_is_close(Conn) of
true -> close;
false -> keepalive
catch _:_ ->
bad_connection_header
end;
maybe_req_close(_, _, _) ->
keepalive.