Add maxTrailerCount attribute for HTTP/1.1 chunked request trailers#1027
Open
HwangRock wants to merge 1 commit into
Open
Add maxTrailerCount attribute for HTTP/1.1 chunked request trailers#1027HwangRock wants to merge 1 commit into
HwangRock wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HTTP/2 has a
maxTrailerCountattribute (default 100) that limits the number of trailing headers in a request, but HTTP/1.1 has no equivalent. On HTTP/1.1 the chunked trailers are bounded only bymaxTrailerSize(bytes), so the number of trailer fields is effectively unlimited within that byte budget. Regular HTTP/1.1 headers already have a count limit throughmaxHeaderCount, and the commit message of 2aa5f6b noted thatmaxHeaderCountandmaxTrailerCountcould be added to HTTP/1.1 "at some point".maxHeaderCountwas added since;maxTrailerCountwas not.This adds
maxTrailerCountto the HTTP/1.1 connector, mirroring the HTTP/2 attribute. The value is threaded fromAbstractHttp11ProtocolthroughHttp11ProcessorintoChunkedInputFilter, which counts the trailer fields as they are parsed and fails the request with a 400 once the limit is exceeded. It reuses the same parse loop that already enforcesmaxTrailerSize, so the enforcement and error path match the existing trailer handling.The default is 100, matching
maxHeaderCountand the HTTP/2 equivalent. This does change behaviour: a request with more than 100 trailers that previously passed (within themaxTrailerSizebyte limit) is now rejected. A value less than 0 disables the limit. I went with 100 for consistency, but I'm happy to default it to -1 if leaving the existing behaviour unchanged is preferred.Tests in
TestChunkedInputFiltercover below/at/above the limit, the disabled (-1) case, the zero case, and a check that trailers under the limit are still parsed. A changelog entry is included.