HTTP/2 error when parsing percent-encoded query string
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 48/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 停滞
- 技术栈
- scala
调研方向
从 http-core/src/main/scala/org/apache/pekko/http/impl/model/parser/UriParser.scala 以及 http-core/src/main/scala/org/apache/pekko/http/impl/engine/http2/hpack/HeaderDecompression.scala 中的 HTTP/2 流程开始，包括 parseAndEmit。使用 curl 通过 HTTP/1.1 和 HTTP/2 复现无效的 %_D query，然后跟踪 ParsingException 的处理方式。完成的标准是：HTTP/2 返回 400 Bad Request 以及文档中说明的错误正文，而不是因 HTTP/2 framing error 而关闭连接。
由索引模型根据 Issue 内容生成。
描述
Very simple reproducer with explanation: https://github.com/mkurz/akka-http-percent-encoding-bug (that reproducer is still based on akka-http but should work 1:1 when applied to pekko-http)
Copy and pasted README (in case I ever delete that repo):
pekko-http's (experimental?) http2 support does not correctly handle URL parsing errors.
Specially when passing an invalid percent-encoded character in the path and/or query string (here %_D):
As reproducer the example from the akka docs can be used, but with HTTP/2 enabled:
- https://doc.akka.io/docs/akka-http/current/introduction.html#low-level-http-server-apis
- https://doc.akka.io/docs/akka-http/current/server-side/http2.html#enable-http-2-support
# Start the server
sbt run
# HTTP/1 works:
$ curl --http1.1 -v http://localhost:8080/?param=%_D
* Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /?param=%_D HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.87.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< Server: akka-http/10.2.10
< Date: Wed, 15 Feb 2023 16:29:18 GMT
< Connection: close
< Content-Type: text/plain; charset=UTF-8
< Content-Length: 78
<
* Closing connection 0
Illegal request-target: Invalid input '_', expected HEXDIG (line 1, column 10)
# HTTP/2 gives error:
$ curl --http2-prior-knowledge -v http://localhost:8080/?param=%_D
* Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
* Using HTTP2, server supports multiplexing
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* h2h3 [:method: GET]
* h2h3 [:path: /?param=%_D]
* h2h3 [:scheme: http]
* h2h3 [:authority: localhost:8080]
* h2h3 [user-agent: curl/7.87.0]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0xaaabd90f0dc0)
> GET /?param=%_D HTTP/2
> Host: localhost:8080
> user-agent: curl/7.87.0
> accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 256)!
* Closing connection 0
curl: (16) Error in the HTTP2 framing layer
At some point, no matter if using HTTP/1 or HTTP/2, the parser ends up here
As you can see it will (also) be looked for pct-encoded characters, which expect a % sign, followed by two HEXDIG signs:
Now if that fails...
- ...when using HTTP/1...
...then the method parseHttpRequestTarget fails with (=throws) an IllegalUriException, which will later be handled so a 400 Bad Request with following body will be send:
Illegal request-target: Invalid input '_', expected HEXDIG (line 1, column 10)
(There are various places in the http-core module where IllegalUriExceptions and ParsingExceptions are caught and handled)
- ...when using HTTP/2...
PathAndQuery.parse in following line throws an ParsingException which is never handled (this is in the org.apache.pekko.http.impl.engine.http2 package, so not used by HTTP/1):
A couple of lines later only an IOException gets caught:
If you see where the containing method parseAndEmit gets called, the ParsingException never gets handled.
Expected Result
When using HTTP/2 I would expect to also receive a 400 Bad Request with the body:
Illegal request-target: Invalid input '_', expected HEXDIG (line 1, column 10)
- 主要语言
- Scala
- 星标
- 196
- 派生
- 56
- 平均合并
- 1 天 18 小时
- 30 天内合并 PR
- 43
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
apache/pekko-http 的其他 Issue
-
dependencies
难度 1/5 1 小时以内 新手友好度 78/100
apache/pekko-http#1354 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 45/100
apache/pekko-http#1273 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 35/100
apache/pekko-http#1249 ·
维护者通常 1 天内回复
-
enhancement
难度 5/5 一周以上 新手友好度 35/100
apache/pekko-http#1248 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 42/100
apache/pekko-http#1180 ·
维护者通常 1 天内回复
查看 apache/pekko-http 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 84/100
containerbase/base#7891 ·
维护者通常 1 天内回复
-
难度 1/5 1-3 小时 新手友好度 91/100
com-vitthalmirji/toon4s#117 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
scalameta/metals#8944 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
zio/zio-blocks#1780 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
digital-asset/participant-query-store#168 ·
维护者通常 1 天内回复