CPPWebFramework icon indicating copy to clipboard operation
CPPWebFramework copied to clipboard

发现代码中因HTTP Header 大小写不统一导致无法正确解析Request Header的BUG

Open LiChen23333 opened this issue 1 year ago • 1 comments

我是在使用了vite 的proxy 进行接口转发时发现的此类问题,应该是vite的代理将我原来的header全部转为小写了,例如将 Content-Length:256368 转为了content-length:256368 这样无法正确读取到body的总长度,因此body长度一旦超过tcp窗口的最大值,则无法正确运行httpreadrequest.cpp 中 HttpReadRequest::readBody的逻辑,导致我无法继续接收下一个tcp包的body数据,所以我的post body被截断了。

修改如下: 在cwf/httpparser.cpp中 56-68行 void HttpParser::doParseHttpHeader(QByteArray &httpMessage) int size = lines.size(); for(int i = 1, column = 0; i < size; ++i) { QByteArray &line = lines[i]; if(line.isEmpty()) continue; column = line.indexOf(':'); headerField.insert(line.left(column).trimmed(), line.mid(column + 1).trimmed()); }

contentLenght = headerField.value(HTTP::CONTENT_LENGTH).toLongLong();
contentType   = headerField.value(HTTP::CONTENT_TYPE);
multiPart     = contentType.contains(HTTP::MULTIPART);

这里HTTP::CONTENT_LENGTH的定义为 const QByteArray CONTENT_LENGTH = "Content-Length";

我将这里改为了 int size = lines.size(); for(int i = 1, column = 0; i < size; ++i) { QByteArray &line = lines[i]; if(line.isEmpty()) continue; column = line.indexOf(':');

    QByteArray key = line.left(column).trimmed().toLower();
    headerField.insert(key, line.mid(column + 1).trimmed());
}

contentLenght = headerField.value(HTTP::CONTENT_LENGTH.toLower()).toLongLong();
contentType   = headerField.value(HTTP::CONTENT_TYPE.toLower());
multiPart     = contentType.contains(HTTP::MULTIPART.toLower());

使用全小写去匹配,这样就可以正确解析request的header了。

希望对后来人有帮助,如果作者能看到希望可以同步到你仓库的代码中。 感谢作者!

LiChen23333 avatar Aug 21 '23 12:08 LiChen23333

As we discussed in PR: https://github.com/HerikLyma/CPPWebFramework/pull/39 that client must send proper headers by RFC https://datatracker.ietf.org/doc/html/rfc7231#section-3.1.1.5 - Content-Type https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.2 - Content-Length

This ISSUE must be closed and opened in clientside library to send correct by protocol standards headers.

num8er avatar Sep 11 '23 13:09 num8er