HTTP parser: allowed more characters in header field names.
Previously, all requests that contained in header field names characters other than alphanumeric, or "-", or "_" were rejected with a 400 "Bad Request" error response. Now, the parser allows the same set of characters as specified in RFC 7230, including: "!", "#", "$", "%", "&", "'", "*", "+", ".", "^", "`", "|", and "~". Header field names that contain only these characters are considered valid. Also, there's a new option introduced: "discard_unsafe_fields". It accepts boolean value and it is set to "true" by default. When this option is "true", all header field names that contain characters in valid range, but other than alphanumeric or "-" are skipped during parsing. When the option is "false", these header fields aren't skipped. Requests with non-valid characters in header field names according to RFC 7230 are rejected regardless of "discard_unsafe_fields" setting. This closes #422 issue on GitHub.
This commit is contained in:
@@ -1262,6 +1262,12 @@ static nxt_conf_map_t nxt_router_http_conf[] = {
|
||||
NXT_CONF_MAP_STR,
|
||||
offsetof(nxt_socket_conf_t, body_temp_path),
|
||||
},
|
||||
|
||||
{
|
||||
nxt_string("discard_unsafe_fields"),
|
||||
NXT_CONF_MAP_INT8,
|
||||
offsetof(nxt_socket_conf_t, discard_unsafe_fields),
|
||||
},
|
||||
};
|
||||
|
||||
|
||||
@@ -1649,6 +1655,7 @@ nxt_router_conf_create(nxt_task_t *task, nxt_router_temp_conf_t *tmcf,
|
||||
skcf->header_buffer_size = 2048;
|
||||
skcf->large_header_buffer_size = 8192;
|
||||
skcf->large_header_buffers = 4;
|
||||
skcf->discard_unsafe_fields = 1;
|
||||
skcf->body_buffer_size = 16 * 1024;
|
||||
skcf->max_body_size = 8 * 1024 * 1024;
|
||||
skcf->proxy_header_buffer_size = 64 * 1024;
|
||||
|
||||
Reference in New Issue
Block a user