Skip to content

Commit ef4296e

Browse files
authored
Configure max request line size limits to be the same as maxHeaderSize (#312)
* Configure max request line size limits to be the same as maxHeaderSize As part of ReadAsHttpRequestMessageAsync, the parsing of the HTTP request line is limited by a non-configurable 2k limit. The size does not affect buffer sizes, only the maximum allowed length. This PR updates the ReadAsHttpRequestMessageAsync API to use the same limits for HTTP request line as the HTTP header line, the latter which is configurable by user code. In the default case, this means the HTTP request line size now supports a 16k limit before it throws. Fixes #307
1 parent d1df0c8 commit ef4296e

File tree

2 files changed

+38
-4
lines changed

2 files changed

+38
-4
lines changed

src/System.Net.Http.Formatting/HttpContentMessageExtensions.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ private static async Task<HttpRequestMessage> ReadAsHttpRequestMessageAsyncCore(
223223

224224
HttpUnsortedRequest httpRequest = new HttpUnsortedRequest();
225225
HttpRequestHeaderParser parser = new HttpRequestHeaderParser(httpRequest,
226-
HttpRequestHeaderParser.DefaultMaxRequestLineSize, maxHeaderSize);
226+
Math.Max(HttpRequestHeaderParser.DefaultMaxRequestLineSize, maxHeaderSize), maxHeaderSize);
227227
ParserState parseStatus;
228228

229229
byte[] buffer = new byte[bufferSize];

test/System.Net.Http.Formatting.Test/HttpContentMessageExtensionsTests.cs

+37-3
Original file line numberDiff line numberDiff line change
@@ -482,16 +482,50 @@ public Task ReadAsHttpResponseMessageAsync_LargeHeaderSize()
482482
}
483483

484484
[Fact]
485-
public Task ReadAsHttpRequestMessageAsync_LargeHeaderSize()
485+
public async Task ReadAsHttpRequestMessageAsync_LargeHeaderSize()
486486
{
487+
string cookieValue = string.Format("{0}={1}", new String('a', 16 * 1024), new String('b', 16 * 1024));
487488
string[] request = new[] {
488489
@"GET / HTTP/1.1",
489490
@"Host: msdn.microsoft.com",
490-
String.Format("Cookie: {0}={1}", new String('a', 16 * 1024), new String('b', 16 * 1024))
491+
string.Format("Cookie: {0}", cookieValue),
492+
};
493+
494+
HttpContent content = CreateContent(true, request, "sample body");
495+
var httpRequestMessage = await content.ReadAsHttpRequestMessageAsync(Uri.UriSchemeHttp, 64 * 1024, 64 * 1024);
496+
497+
Assert.Equal(HttpMethod.Get, httpRequestMessage.Method);
498+
Assert.Equal("/", httpRequestMessage.RequestUri.PathAndQuery);
499+
Assert.Equal("msdn.microsoft.com", httpRequestMessage.Headers.Host);
500+
IEnumerable<string> actualCookieValue;
501+
Assert.True(httpRequestMessage.Headers.TryGetValues("Cookie", out actualCookieValue));
502+
Assert.Equal(cookieValue, Assert.Single(actualCookieValue));
503+
}
504+
505+
[Fact]
506+
public async Task ReadAsHttpRequestMessageAsync_LargeHttpRequestLine()
507+
{
508+
string requestPath = string.Format("/myurl?{0}={1}", new string('a', 4 * 1024), new string('b', 4 * 1024));
509+
string cookieValue = string.Format("{0}={1}", new String('a', 4 * 1024), new String('b', 4 * 1024));
510+
string[] request = new[]
511+
{
512+
string.Format("GET {0} HTTP/1.1", requestPath),
513+
@"Host: msdn.microsoft.com",
514+
string.Format("Cookie: {0}", cookieValue),
491515
};
492516

493517
HttpContent content = CreateContent(true, request, "sample body");
494-
return content.ReadAsHttpRequestMessageAsync(Uri.UriSchemeHttp, 64 * 1024, 64 * 1024);
518+
var httpRequestMessage = await content.ReadAsHttpRequestMessageAsync(
519+
Uri.UriSchemeHttp,
520+
bufferSize: 64 * 1024,
521+
maxHeaderSize: 64 * 1024);
522+
523+
Assert.Equal(HttpMethod.Get, httpRequestMessage.Method);
524+
Assert.Equal(requestPath, httpRequestMessage.RequestUri.PathAndQuery);
525+
Assert.Equal("msdn.microsoft.com", httpRequestMessage.Headers.Host);
526+
IEnumerable<string> actualCookieValue;
527+
Assert.True(httpRequestMessage.Headers.TryGetValues("Cookie", out actualCookieValue));
528+
Assert.Equal(cookieValue, Assert.Single(actualCookieValue));
495529
}
496530

497531
[Theory]

0 commit comments

Comments
 (0)