On Tue, 16 Dec 2025 22:09:33 GMT, Daniel Fuchs <[email protected]> wrote:
>> src/jdk.httpserver/share/classes/sun/net/httpserver/ServerImpl.java line 740:
>>
>>> 738: Request req;
>>> 739: try {
>>> 740: req = new Request(rawin, rawout, newconnection &&
>>> !https);
>>
>> I'd skip the `!https` check here.
>
> We only need the check for clear connections. Why would you keep it with
> https?
Because any input that starts with a character below 32 may not be a HTTP
request, so we might as well reject such bytes over TLS too.
Ideally we'd have a state machine that would reject any request as soon as we
receive a byte that is not valid in a HTTP request, but what you have is a good
improvement already.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/28827#discussion_r2626385975
