Author: markt
Date: Thu Apr  9 13:54:05 2009
New Revision: 763654

URL: http://svn.apache.org/viewvc?rev=763654&view=rev
Log:
Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=46984
CR & LF in middle of method name should cause a 400
So client sees 400, stop processing the request once we know it is bad

Modified:
    tomcat/trunk/java/org/apache/coyote/http11/Http11AprProcessor.java
    tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java
    tomcat/trunk/java/org/apache/coyote/http11/Http11Processor.java
    tomcat/trunk/java/org/apache/coyote/http11/InternalAprInputBuffer.java
    tomcat/trunk/java/org/apache/coyote/http11/InternalInputBuffer.java
    tomcat/trunk/java/org/apache/coyote/http11/InternalNioInputBuffer.java
    tomcat/trunk/java/org/apache/coyote/http11/LocalStrings.properties

Modified: tomcat/trunk/java/org/apache/coyote/http11/Http11AprProcessor.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/Http11AprProcessor.java?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/Http11AprProcessor.java 
(original)
+++ tomcat/trunk/java/org/apache/coyote/http11/Http11AprProcessor.java Thu Apr  
9 13:54:05 2009
@@ -818,17 +818,19 @@
                 error = true;
             }
 
-            // Setting up filters, and parse some request headers
-            rp.setStage(org.apache.coyote.Constants.STAGE_PREPARE);
-            try {
-                prepareRequest();
-            } catch (Throwable t) {
-                if (log.isDebugEnabled()) {
-                    log.debug(sm.getString("http11processor.request.prepare"), 
t);
+            if (!error) {
+                // Setting up filters, and parse some request headers
+                rp.setStage(org.apache.coyote.Constants.STAGE_PREPARE);
+                try {
+                    prepareRequest();
+                } catch (Throwable t) {
+                    if (log.isDebugEnabled()) {
+                        
log.debug(sm.getString("http11processor.request.prepare"), t);
+                    }
+                    // 400 - Internal Server Error
+                    response.setStatus(400);
+                    error = true;
                 }
-                // 400 - Internal Server Error
-                response.setStatus(400);
-                error = true;
             }
 
             if (maxKeepAliveRequests > 0 && --keepAliveLeft == 0)

Modified: tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java 
(original)
+++ tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java Thu Apr  
9 13:54:05 2009
@@ -849,17 +849,19 @@
                 error = true;
             }
 
-            // Setting up filters, and parse some request headers
-            rp.setStage(org.apache.coyote.Constants.STAGE_PREPARE);
-            try {
-                prepareRequest();
-            } catch (Throwable t) {
-                if (log.isDebugEnabled()) {
-                    log.debug(sm.getString("http11processor.request.prepare"), 
t);
+            if (!error) {
+                // Setting up filters, and parse some request headers
+                rp.setStage(org.apache.coyote.Constants.STAGE_PREPARE);
+                try {
+                    prepareRequest();
+                } catch (Throwable t) {
+                    if (log.isDebugEnabled()) {
+                        
log.debug(sm.getString("http11processor.request.prepare"), t);
+                    }
+                    // 400 - Internal Server Error
+                    response.setStatus(400);
+                    error = true;
                 }
-                // 400 - Internal Server Error
-                response.setStatus(400);
-                error = true;
             }
             
             if (maxKeepAliveRequests == 1 )

Modified: tomcat/trunk/java/org/apache/coyote/http11/Http11Processor.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/Http11Processor.java?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/Http11Processor.java (original)
+++ tomcat/trunk/java/org/apache/coyote/http11/Http11Processor.java Thu Apr  9 
13:54:05 2009
@@ -807,17 +807,19 @@
                 error = true;
             }
 
-            // Setting up filters, and parse some request headers
-            rp.setStage(org.apache.coyote.Constants.STAGE_PREPARE);
-            try {
-                prepareRequest();
-            } catch (Throwable t) {
-                if (log.isDebugEnabled()) {
-                    log.debug(sm.getString("http11processor.request.prepare"), 
t);
+            if (!error) {
+                // Setting up filters, and parse some request headers
+                rp.setStage(org.apache.coyote.Constants.STAGE_PREPARE);
+                try {
+                    prepareRequest();
+                } catch (Throwable t) {
+                    if (log.isDebugEnabled()) {
+                        
log.debug(sm.getString("http11processor.request.prepare"), t);
+                    }
+                    // 400 - Internal Server Error
+                    response.setStatus(400);
+                    error = true;
                 }
-                // 400 - Internal Server Error
-                response.setStatus(400);
-                error = true;
             }
 
             if (maxKeepAliveRequests > 0 && --keepAliveLeft == 0)

Modified: tomcat/trunk/java/org/apache/coyote/http11/InternalAprInputBuffer.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/InternalAprInputBuffer.java?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/InternalAprInputBuffer.java 
(original)
+++ tomcat/trunk/java/org/apache/coyote/http11/InternalAprInputBuffer.java Thu 
Apr  9 13:54:05 2009
@@ -403,6 +403,11 @@
                     throw new EOFException(sm.getString("iib.eof.error"));
             }
 
+            // Spec says no CR or LF in method name
+            if (buf[pos] == Constants.CR || buf[pos] == Constants.LF) {
+                throw new IllegalArgumentException(
+                        sm.getString("iib.invalidmethod"));
+            }
             // Spec says single SP but it also says be tolerant of HT
             if (buf[pos] == Constants.SP || buf[pos] == Constants.HT) {
                 space = true;

Modified: tomcat/trunk/java/org/apache/coyote/http11/InternalInputBuffer.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/InternalInputBuffer.java?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/InternalInputBuffer.java 
(original)
+++ tomcat/trunk/java/org/apache/coyote/http11/InternalInputBuffer.java Thu Apr 
 9 13:54:05 2009
@@ -391,6 +391,11 @@
                     throw new EOFException(sm.getString("iib.eof.error"));
             }
 
+            // Spec says no CR or LF in method name
+            if (buf[pos] == Constants.CR || buf[pos] == Constants.LF) {
+                throw new IllegalArgumentException(
+                        sm.getString("iib.invalidmethod"));
+            }
             // Spec says single SP but it also says be tolerant of HT
             if (buf[pos] == Constants.SP || buf[pos] == Constants.HT) {
                 space = true;

Modified: tomcat/trunk/java/org/apache/coyote/http11/InternalNioInputBuffer.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/InternalNioInputBuffer.java?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/InternalNioInputBuffer.java 
(original)
+++ tomcat/trunk/java/org/apache/coyote/http11/InternalNioInputBuffer.java Thu 
Apr  9 13:54:05 2009
@@ -454,6 +454,11 @@
                     if (!fill(true, false)) //request line parsing
                         return false;
                 }
+                // Spec says no CR or LF in method name
+                if (buf[pos] == Constants.CR || buf[pos] == Constants.LF) {
+                    throw new IllegalArgumentException(
+                            sm.getString("iib.invalidmethod"));
+                }
                 if (buf[pos] == Constants.SP || buf[pos] == Constants.HT) {
                     space = true;
                     request.method().setBytes(buf, parsingRequestLineStart, 
pos - parsingRequestLineStart);

Modified: tomcat/trunk/java/org/apache/coyote/http11/LocalStrings.properties
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/LocalStrings.properties?rev=763654&r1=763653&r2=763654&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/LocalStrings.properties 
(original)
+++ tomcat/trunk/java/org/apache/coyote/http11/LocalStrings.properties Thu Apr  
9 13:54:05 2009
@@ -63,4 +63,5 @@
 
 iib.eof.error=Unexpected EOF read on the socket
 iib.requestheadertoolarge.error=Request header is too large
+iib.invalidmethod=Invalid character (CR or LF) found in method name
 



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Reply via email to