Mercurial > hg > nginx

changeset 1151:b1ebd03de948

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
disable TRACE method
author Igor Sysoev <igor@sysoev.ru>
date Fri, 30 Mar 2007 18:59:26 +0000
parents 1030996f617c
children a9715f8f17a5
files src/http/ngx_http_parse.c src/http/ngx_http_request.c src/http/ngx_http_request.h
diffstat 3 files changed, 14 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -146,6 +146,12 @@ ngx_http_parse_request_line(ngx_http_req
                         r->method = NGX_HTTP_MKCOL;
                     }
 
+                    if (m[0] == 'T' && m[1] == 'R'
+                        && m[2] == 'A' && m[3] == 'C' && m[4] == 'E')
+                    {
+                        r->method = NGX_HTTP_TRACE;
+                    }
+
                     break;
 
                 case 6:
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1267,6 +1267,13 @@ ngx_http_process_request_header(ngx_http
         return NGX_ERROR;
     }
 
+    if (r->method & (NGX_HTTP_TRACE)) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent TRACE method");
+        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
+        return NGX_ERROR;
+    }
+
     if (r->headers_in.transfer_encoding
         && ngx_strstr(r->headers_in.transfer_encoding->value.data, "chunked"))
     {
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -37,6 +37,7 @@
 #define NGX_HTTP_PROPPATCH                 0x0800
 #define NGX_HTTP_LOCK                      0x1000
 #define NGX_HTTP_UNLOCK                    0x2000
+#define NGX_HTTP_TRACE                     0x4000
 
 #define NGX_HTTP_CONNECTION_CLOSE          1
 #define NGX_HTTP_CONNECTION_KEEP_ALIVE     2