arturobernalg opened a new pull request, #1147: URL: https://github.com/apache/tomcat/pull/1147
RFC 9112, section 3: "A server that receives a request-target longer than any URI it wishes to parse MUST respond with a 414 (URI Too Long) status code." When the request target did not fit in the buffer used to read the request line, Tomcat responded with 400. 414 is only used when the buffer fills while the request target is being read. A request header field that is too large still results in a 400, so the two conditions are not conflated (the concern raised in #228). `Http11Processor.badRequest()` no longer replaces the status of an error that has already been identified. Without that, the missing Host check that runs after the failed parse turns the 414 back into a 400. The new tests in `TestHttp11InputBuffer` cover a long path, a long query string and, as a control, a long header field. The two 414 tests fail without the change. All of `coyote/http11` plus `TestCoyoteAdapter`, `TestRequest`, `TestMaxConnections` and `TestKeepAliveCount` pass. Header fields that are too large could also be mapped to 431 (RFC 6585, section 5). The RFC does not require it, so I have left that unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
