Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lack validation of whether request payload match content-length #3067

Open
hxzhao527 opened this issue Jul 8, 2023 · 1 comment · May be fixed by #3068
Open

lack validation of whether request payload match content-length #3067

hxzhao527 opened this issue Jul 8, 2023 · 1 comment · May be fixed by #3068
Labels
A-http project: actix-http C-bug Category: bug needs-investigation

Comments

@hxzhao527
Copy link

hxzhao527 commented Jul 8, 2023

Steps to Reproduce (for bugs)

code

use actix_web::{post, web, App, HttpServer};
use serde::Deserialize;

use log::warn;

#[derive(Deserialize)]
struct Info {
    name: String,
}

#[post("/")]
async fn index(web::Form(form): web::Form<Info>) -> String {
    warn!("name length: {}", form.name.len());
    format!("Welcome {}!", form.name)
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    std::env::set_var("RUST_LOG", "debug");
    env_logger::init();

    HttpServer::new(|| {
        let form_config = web::FormConfig::default()
            .limit(4096)
            .error_handler(|err, _| {
                warn!("Form error: {}", err);
                actix_web::error::InternalError::from_response(
                    err,
                    actix_web::HttpResponse::Conflict().finish(),
                )
                .into()
            });
        App::new()
            .app_data(form_config)
            .service(index)
            .wrap(actix_web::middleware::Logger::default())
    })
    .bind(("127.0.0.1", 1234))?
    .run()
    .await
}
[dependencies]
actix-web = "4.3.1"
env_logger = "0.10.0"
log = "0.4.19"
serde = { version = "1.0", features = ["derive"] }

steps

  1. cargo run
  2. send a request with content-length larger thn body
curl -v --location 'http://127.0.0.1:1234' --header 'Content-Length: 1000' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'name=haha'
  1. ctrl-c stop the curl

Current Behavior

❯ cargo run
    Finished dev [unoptimized + debuginfo] target(s) in 0.04s
     Running `target/debug/rust_study`
[2023-07-08T01:59:18Z INFO  actix_server::builder] starting 8 workers
[2023-07-08T01:59:18Z INFO  actix_server::server] Actix runtime found; starting in Actix runtime
[2023-07-08T01:59:26Z WARN  rust_study] name length: 4
[2023-07-08T01:59:26Z INFO  actix_web::middleware::logger] 127.0.0.1 "POST / HTTP/1.1" 200 13 "-" "curl/8.1.2" 3.468221

Expected Behavior

  1. log something like Form error: incomplete request
  2. http-status code 400 not 200

Context

rfc-2616
When a Content-Length is given in a message where a message-body is allowed, its field value MUST exactly match the number of OCTETs in the message-body. HTTP/1.1 user agents MUST notify the user when an invalid length is received and detected.

the incomplete request should not be handled as normal. because:

  1. not match http sepc
  2. the handler does not have the Content-Length, it can not valid this by itself.

Possible Solution

take form as an example, check payload length after got

while let Some(item) = stream.next().await {
let chunk = item?;
if (body.len() + chunk.len()) > limit {
return Err(UrlencodedError::Overflow {
size: body.len() + chunk.len(),
limit,
});
} else {
body.extend_from_slice(&chunk);
}
}
if encoding == UTF_8 {

@ihciah ihciah linked a pull request Jul 10, 2023 that will close this issue
5 tasks
@ihciah
Copy link

ihciah commented Jul 10, 2023

I encountered this issue last week. I'm just about to open an issue, and I just write here.

After some investigating I think the core problem is at Payload status passing. I submitted an PR #3068 to fixed. With your demo code, the output becomes:

[2023-07-10T07:35:53Z INFO  actix_server::builder] starting 32 workers
[2023-07-10T07:35:53Z INFO  actix_server::server] Actix runtime found; starting in Actix runtime
[2023-07-10T07:35:58Z WARN  demo] Form error: Error that occur during reading payload: payload reached EOF before completing: Some(Kind(UnexpectedEof)).
[2023-07-10T07:35:58Z DEBUG actix_web::middleware::logger] Error in response: Payload(Incomplete(Some(Kind(UnexpectedEof))))
[2023-07-10T07:35:58Z INFO  actix_web::middleware::logger] 127.0.0.1 "POST / HTTP/1.1" 409 0 "-" "curl/8.1.2" 3.143109

@robjtede robjtede added this to the actix-web v4.4 milestone Jul 19, 2023
@robjtede robjtede added C-bug Category: bug needs-investigation A-http project: actix-http labels Jul 19, 2023
@robjtede robjtede removed this from the actix-web v4.4 milestone Feb 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-http project: actix-http C-bug Category: bug needs-investigation
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants