File 0913-inets-httpd-now-ignores-invalid-headers-as... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 0913-inets-httpd-now-ignores-invalid-headers-as-reported-.patch of Package erlang

From c06db0bedf49a9b40725745e73fa82e562612815 Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Fri, 22 Nov 2019 10:12:21 +0100
Subject: [PATCH] inets: httpd now ignores invalid headers as reported by
 ERL-1053

That is it is not allowed to have space between the HTTP header filed
name and the colon in the header.
---
 lib/inets/src/http_lib/http_request.erl     |  9 ++++++++-
 lib/inets/src/http_server/httpd_example.erl | 13 +++++++++++--
 lib/inets/src/http_server/httpd_request.erl |  2 +-
 lib/inets/test/httpd_SUITE.erl              | 20 ++++++++++++++++++++
 4 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/lib/inets/src/http_lib/http_request.erl b/lib/inets/src/http_lib/http_request.erl
index 2b1a0bd40f..c49402cc1f 100644
--- a/lib/inets/src/http_lib/http_request.erl
+++ b/lib/inets/src/http_lib/http_request.erl
@@ -28,7 +28,14 @@
 key_value(KeyValueStr) ->
     case lists:splitwith(fun($:) -> false; (_) -> true end, KeyValueStr) of
 	{Key, [$: | Value]} when Key =/= [] ->
-	    {http_util:to_lower(string:strip(Key)),  string:strip(Value)};
+            %% RFC 7230 - 3.2.4 ... No whitespace is allowed between the header field-name and colon. 
+            case string:strip(Key, right) of
+                Key ->
+                    {http_util:to_lower(string:strip(Key, left)),  string:strip(Value)};
+                 _ ->
+                    %% Ignore invalid header
+                    undefined
+            end;
 	{_, []} -> 
 	    undefined;
         _ ->
diff --git a/lib/inets/src/http_server/httpd_example.erl b/lib/inets/src/http_server/httpd_example.erl
index aaa7e428c2..3c25ca336f 100644
--- a/lib/inets/src/http_server/httpd_example.erl
+++ b/lib/inets/src/http_server/httpd_example.erl
@@ -22,7 +22,7 @@
 -export([print/1]).
 -export([get/2, put/2, post/2, yahoo/2, test1/2, get_bin/2, peer/2,new_status_and_location/2]).
 
--export([newformat/3, post_chunked/3, post_204/3]).
+-export([newformat/3, post_chunked/3, post_204/3, ignore_invalid_header/3]).
 %% These are used by the inets test-suite
 -export([delay/1, chunk_timeout/3, get_chunks/3]).
 
@@ -156,7 +156,16 @@ post_204(SessionID, _Env, _Input) ->
                     ["Status: 204 No Content" ++ "\r\n\r\n"]),
     mod_esi:deliver(SessionID, []).
 
-
+ignore_invalid_header(SessionID, Env, _Input) ->
+    case proplists:get_value(content_length, Env, undefined) of
+        undefined ->
+            mod_esi:deliver(SessionID,
+                            ["Status: 204 No Content" ++ "\r\n\r\n"]);
+        _ -> %% Invalid content_length header should have been ignored
+            mod_esi:deliver(SessionID,
+                            ["Status: 500 Internal Server Error" ++ "\r\n\r\n"])
+    end.            
+                         
 newformat(SessionID,_,_) ->
     mod_esi:deliver(SessionID, "Content-Type:text/html\r\n\r\n"),
     mod_esi:deliver(SessionID, top("new esi format test")),
diff --git a/lib/inets/src/http_server/httpd_request.erl b/lib/inets/src/http_server/httpd_request.erl
index 79566e3ac8..3df55c0f7a 100644
--- a/lib/inets/src/http_server/httpd_request.erl
+++ b/lib/inets/src/http_server/httpd_request.erl
@@ -207,7 +207,7 @@ parse_headers(<<?CR,?LF,?CR,?LF,Body/binary>>, Header, Headers, _, _,
 	      Options, Result) ->
     Customize = proplists:get_value(customize, Options),
     case http_request:key_value(lists:reverse(Header)) of
-	undefined -> %% Skip headers with missing :
+	undefined -> %% Skip invalid headers
 	    FinalHeaders = lists:filtermap(fun(H) ->
 						   httpd_custom:customize_headers(Customize, request_header, H)
 					   end,
diff --git a/lib/inets/test/httpd_SUITE.erl b/lib/inets/test/httpd_SUITE.erl
index 1d80d604b7..1289432f0d 100644
--- a/lib/inets/test/httpd_SUITE.erl
+++ b/lib/inets/test/httpd_SUITE.erl
@@ -168,6 +168,7 @@ http_get() ->
      missing_CR,
      max_header,
      max_content_length,
+     ignore_invalid_header,
      ipv6
     ].
 
@@ -1361,6 +1362,25 @@ max_content_length(Config) when is_list(Config) ->
     garbage_content_length(proplists:get_value(type, Config), proplists:get_value(port, Config), Host, 
 			   proplists:get_value(node, Config), Version).
 
+%%-------------------------------------------------------------------------
+ignore_invalid_header() ->
+    ["RFC 7230 - 3.2.4 ... No whitespace is allowed between the header field-name and colon"].
+ignore_invalid_header(Config) when is_list(Config) ->
+     Host =  proplists:get_value(host, Config),
+     Port =  proplists:get_value(port, Config),
+    {Url, Header, Opts} =
+        case proplists:get_value(type, Config) of
+            ip_comm ->
+                {"http://"  ++ Host ++  ":" ++ integer_to_list(Port) ++ "/cgi-bin/erl/httpd_example:ignore_invalid_header",
+                 [{"Host", "localhost"},{"Te", ""}, {"Content-Length ", "0"}], []};
+            ssl ->
+                Conf = proplists:get_value(client_config, proplists:get_value(ssl_conf, Config)),
+                {"https://"  ++ Host ++  ":" ++ integer_to_list(Port) ++ "/cgi-bin/erl/httpd_example:ignore_invalid_header",
+                 [{"Host", "localhost"},{"Te", ""}, {"Content-Length ", "0"}], [{ssl, Conf}]}
+        end,
+    {ok,{{_,204,_}, _, _}}
+        = httpc:request(get, {Url, Header}, [{timeout, 45000} | Opts], [{headers_as_is, true}]).
+
 %%-------------------------------------------------------------------------
 security_1_1(Config) when is_list(Config) -> 
     security([{http_version, "HTTP/1.1"} | Config]).
-- 
2.16.4

Places

File 0913-inets-httpd-now-ignores-invalid-headers-as-reported-.patch of Package erlang

Places