IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-11-24 09:50:18 -06:00
Code Issues Packages Projects Releases Wiki Activity

HTTP/3: fixed handling of malformed request body length.

Browse Source 
Previously, a request body larger than declared in Content-Length resulted in
a 413 status code, because Content-Length was mistakenly used as the maximum
allowed request body, similar to client_max_body_size.  Following the HTTP/3
specification, such requests are now rejected with the 400 error as malformed.
This commit is contained in:
Sergey Kandaurov 2024-05-03 20:28:32 +04:00
parent 3f0fe15a98
commit a7e3cd52e0
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/http/v3/ngx_http_v3_request.c
View File

@ -1575,6 +1575,15 @@ ngx_http_v3_request_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
/* rc == NGX_OK */
if (max != -1 && (uint64_t) (max - rb->received) < st->length) {
if (r->headers_in.content_length_n != -1) {
ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
"client intended to send body data "
"larger than declared");
return NGX_HTTP_BAD_REQUEST;
}
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
"client intended to send too large "
"body: %O+%ui bytes",