in_http: urlencoded parser ignores body length, absorbs pipelined requests

Abierto
  • ¿Algo no está bien?
#12,650 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
c
Área
backend, networking

Línea de trabajo

Start with parse_payload_urlencoded() in plugins/in_http/http_prot.c and trace how the caller passes the payload and its length. Check the HTTP input tests for urlencoded bodies and pipelined requests, then add coverage showing parsing stops at Content-Length. Done means trailing bytes stay out of the parsed value and a following request is processed.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Bug Report

Describe the bug

The application/x-www-form-urlencoded parser in the http input ignores the request body length and consumes
everything up to the NUL terminator of the body buffer. Bytes after Content-Length — including a following
pipelined request — are absorbed into the last field's value, and the pipelined request is then never
processed.

To Reproduce

Start an http input on port 9880, then send one connection with a body shorter than the bytes that follow:

POST /one HTTP/1.1
Host: x
Content-Type: application/x-www-form-urlencoded
Content-Length: 3

a=1POST /two HTTP/1.1
Host: x
Content-Type: application/x-www-form-urlencoded
Content-Length: 3

b=2

Observed on stdout:

[0] one: [[..., {}], {"a"=>"1POST /two HTTP/1.1
Host: x
Content-Type: application/x-www-form-urlencoded
Content-Length: 3

b=2"}]

Only one record is produced, tagged one. The second request is swallowed entirely, and the connection
then times out instead of answering it.

Even without pipelining it is wrong — Content-Length: 3 with body a=1 followed by ZZZ=9 yields
{"a"=>"1ZZZ=9"}.

Root cause

plugins/in_http/http_prot.c, parse_payload_urlencoded():

kvs = flb_utils_split(payload, '&', -1 );

flb_utils_split() takes no length and is NUL-terminated-string based, so it runs to the end of the body
buffer rather than to size. The function receives size from its caller —

ret = parse_payload_urlencoded(ctx, &encoder, tag, payload,
                               cfl_sds_len(payload), request);

— but never uses it.

Expected behavior

Parsing should stop at size (e.g. a length-aware split, or a temporary NUL at payload[size]), so trailing
bytes and pipelined requests are not absorbed.

Your Environment

  • Fluent Bit 5.1.5 (fluent/fluent-bit:latest); the function is byte-identical on current master
  • Linux, aarch64, official container image
  • Input: http plugin, default settings, Content-Type: application/x-www-form-urlencoded

Impact

Pre-auth record corruption, and any pipelined request following a urlencoded POST is silently dropped. Also
makes the declared Content-Length meaningless for this content type.

Lenguaje dominante
C
Estrellas
8.2k
Forks
2k
Merge medio
3 d 20 h
PR fusionados (30 d)
99

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de fluent/fluent-bit

Todos los issues de fluent/fluent-bit

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.