Mercurial > hg > nginx

comparison src/http/ngx_http_request.c @ 7876:b290610bf812

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Moved TRACE method rejection to a better place. Previously, TRACE requests were rejected before parsing Transfer-Encoding. This is not important since keepalive is not enabled at this point anyway, though rejecting such requests after properly parsing other headers is less likely to cause issues in case of further code changes.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 28 Jun 2021 18:01:00 +0300
parents 5f765427c17a
children 63c66b7cc07c
comparison
equal deleted inserted replaced
7875:0c5e84096d99 7876:b290610bf812
1978 ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); 1978 ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
1979 return NGX_ERROR; 1979 return NGX_ERROR;
1980 } 1980 }
1981 } 1981 }
1982 1982
1983 if (r->method == NGX_HTTP_TRACE) {
1984 ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
1985 "client sent TRACE method");
1986 ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
1987 return NGX_ERROR;
1988 }
1989
1990 if (r->headers_in.transfer_encoding) { 1983 if (r->headers_in.transfer_encoding) {
1991 if (r->headers_in.transfer_encoding->value.len == 7 1984 if (r->headers_in.transfer_encoding->value.len == 7
1992 && ngx_strncasecmp(r->headers_in.transfer_encoding->value.data, 1985 && ngx_strncasecmp(r->headers_in.transfer_encoding->value.data,
1993 (u_char *) "chunked", 7) == 0) 1986 (u_char *) "chunked", 7) == 0)
1994 { 1987 {
2009 if (r->headers_in.keep_alive) { 2002 if (r->headers_in.keep_alive) {
2010 r->headers_in.keep_alive_n = 2003 r->headers_in.keep_alive_n =
2011 ngx_atotm(r->headers_in.keep_alive->value.data, 2004 ngx_atotm(r->headers_in.keep_alive->value.data,
2012 r->headers_in.keep_alive->value.len); 2005 r->headers_in.keep_alive->value.len);
2013 } 2006 }
2007 }
2008
2009 if (r->method == NGX_HTTP_TRACE) {
2010 ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
2011 "client sent TRACE method");
2012 ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
2013 return NGX_ERROR;
2014 } 2014 }
2015 2015
2016 return NGX_OK; 2016 return NGX_OK;
2017 } 2017 }
2018 2018