Allow opting out of the default charset being appended to the request `Content-Type` header
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
從 AwsProxyHttpServletRequestReader.java 和 ContainerConfig.java 開始,追蹤預設字元集如何新增和設定。接著閱讀或執行 AwsProxyHttpServletRequestReaderTest;新增涵蓋選擇停用、未變更的預設行為,以及既有 charset= 參數的測試。完成的標準是:選擇停用後,傳入的 Content-Type 保持不變,同時預設行為仍維持原狀。
由索引模型根據 Issue 內容生成。
描述
- Framework version: 3.0.2 (also confirmed identical in 3.0.3 and on
main) - Implementations: All (core
AwsProxyHttpServletRequestReader)
Scenario
AwsProxyHttpServletRequestReader.readRequest(...) rewrites the incoming Content-Type header on the
proxy event before the servlet request is built (and so before any filter runs):
// AwsProxyHttpServletRequestReader.java#L55
request.getMultiValueHeaders().putSingle(HttpHeaders.CONTENT_TYPE, getContentTypeWithCharset(contentType, config));
If the client sent a Content-Type without a charset parameter, getContentTypeWithCharset appends
"; charset=" + config.getDefaultContentCharset(), which defaults to ISO-8859-1:
AwsProxyHttpServletRequestReader.javaL55: the mutation onto the eventAwsProxyHttpServletRequestReader.javaL82-L98:getContentTypeWithCharsetContainerConfig.javaL27:DEFAULT_CONTENT_CHARSET = "ISO-8859-1"ContainerConfig.javaL278-L291: getter/setter
This breaks any application that has to see the request headers exactly as the client sent them.
The case I hit is request-signature verification: the client signs a set of request components that
includes Content-Type (e.g. an HTTP message signature, a proof-of-possession token whose claims
hash the request headers, or an HMAC scheme). A servlet filter then recomputes the signature input
from HttpServletRequest. Because the container has already changed application/json to
application/json; charset=ISO-8859-1, the recomputed hash never matches and every request that
omits a charset fails verification.
There is currently no way to turn this off through ContainerConfig:
setDefaultContentCharset(null)producesContent-Type: application/json; charset=nullsetDefaultContentCharset("")producesContent-Type: application/json; charset=
Both still change the header. The only workarounds are to replace or subclass the request reader, or to
reverse-engineer the exact appended suffix inside the verifier and retry with it stripped. Both
depend on container internals.
(Related background: #175 covered how a forced default charset interacts badly with
application/json, which RFC 8259 defines as UTF-8 and which has no charset parameter.)
Expected behavior
There should be a supported way to make the container leave the client's Content-Type unmodified.
The default behavior can stay as it is.
Actual behavior
Whenever no charset is present, the header is always rewritten, and no configuration value avoids it.
Steps to reproduce
- Build an
AwsProxyRequestwith headerContent-Type: application/json(no charset). - Run it through
AwsProxyHttpServletRequestReader.readRequest(...). Calling
setDefaultContentCharset(null)on theContainerConfigfirst doesn't change the outcome. - Observe
servletRequest.getHeader("Content-Type")returnsapplication/json; charset=ISO-8859-1
(or; charset=null), and that the original event's multi-value headers were mutated as well.
Proposed fix
Make the append opt-out-able, default unchanged. Two options, happy to go with whichever the
maintainers prefer:
Option A: treat a null/blank charset as "don't append" (smallest diff, no new API)
private String getContentTypeWithCharset(String headerValue, ContainerConfig config) {
if (headerValue == null || "".equals(headerValue.trim())) {
return headerValue;
}
if (headerValue.contains("charset=")) {
return headerValue;
}
String charset = config.getDefaultContentCharset();
if (charset == null || charset.trim().isEmpty()) {
return headerValue;
}
...
}
Users opt out with config.setDefaultContentCharset(null). Downside: it gives null a special meaning
that isn't obvious from the API, so the setDefaultContentCharset Javadoc would need to document it.
Right now null just produces a malformed charset=null value, so nobody can depend on the current
behavior.
Option B: explicit boolean flag (more readable intent)
Add ContainerConfig#setAppendDefaultContentCharset(boolean) (default true) and check it in
getContentTypeWithCharset. It's a slightly bigger change (field, getter/setter, default init, guard),
but the setting explains itself.
Either way the default (ISO-8859-1 appended) stays the same, so existing users aren't affected. I'm
happy to open a PR with the change plus tests in AwsProxyHttpServletRequestReaderTest. The tests would
cover: no suffix when opted out, the default path still appending, and an existing charset= left as is.
- 主要語言
- Java
- 星號
- 1.6k
- 分支
- 575
- 平均合併
- 1 天 15 小時
- 30 天內合併 PR
- 12
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue,再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫,在一個分支上完成修改。
- 送出 Pull Request,並在描述裡引用這個 Issue 編號。
aws/serverless-java-container 的其他 Issue
-
難度 1/5 1 小時以內 新手友好度 88/100
aws/serverless-java-container#1715 ·
維護者通常 1 天內回覆
-
Support for API Gateway mTLS clientCert field可能已有人在做 @2748109647 於 10 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 48/100
aws/serverless-java-container#1726 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 35/100
aws/serverless-java-container#1579 · 3 則留言 · 1 個 reaction ·
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 42/100
aws/serverless-java-container#1568 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 42/100
aws/serverless-java-container#1551 ·
維護者通常 1 天內回覆
查看 aws/serverless-java-container 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 75/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 75/100
ls1intum/thesis-management#1473 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 76/100
LunaDeerMC/Dominion#301 · 1 則留言 ·
-
[FEATURE] Expose external refresh, node-level translog and warmer stats可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉untriaged
難度 2/5 1-3 小時 新手友好度 68/100
opensearch-project/opensearch-prometheus-exporter#680 ·
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 85/100