Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Early rejection for requests exceeding configured maxRequestLength #5880

Open
yzfeng2020 opened this issue Aug 21, 2024 · 0 comments
Open

Early rejection for requests exceeding configured maxRequestLength #5880

yzfeng2020 opened this issue Aug 21, 2024 · 0 comments
Labels
Milestone

Comments

@yzfeng2020
Copy link
Contributor

yzfeng2020 commented Aug 21, 2024

It is is possible to implement early rejection of HTTP requests when the Content-Length header indicates a value larger than the maximum configured request length. This would be beneficial to avoid unnecessary processing of oversized requests.

The relevant code section is located at

if (contentLengthStr != null) {
long contentLength;
try {
contentLength = Long.parseLong(contentLengthStr);
} catch (NumberFormatException ignored) {
contentLength = -1;
}
if (contentLength < 0) {
fail(id, headers, HttpStatus.BAD_REQUEST, "Invalid content length", null);
return;
}
contentEmpty = contentLength == 0;
} else {
contentEmpty = true;
}
for H1 and
final String contentLengthStr = headers.get(HttpHeaderNames.CONTENT_LENGTH);
if (contentLengthStr != null) {
long contentLength;
try {
contentLength = Long.parseLong(contentLengthStr);
} catch (NumberFormatException ignored) {
contentLength = -1;
}
if (contentLength < 0) {
writeErrorResponse(streamId, headers, HttpStatus.BAD_REQUEST,
"Invalid content length", null);
return;
}
}
for H2.

discord discussion: https://discord.com/channels/1087271586832318494/1087272728177942629/1275651316034699327

@ikhoon ikhoon added this to the 1.31.0 milestone Sep 12, 2024
@ikhoon ikhoon added the defect label Sep 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants