Handle invalid/malformed data from clients in HttpParser

proxy/http/parser/parser.py

@@ -23,7 +23,6 @@
 from .chunk import ChunkParser, chunkParserStates
 from .types import httpParserTypes, httpParserStates
 
-
 flags.add_argument(
     '--enable-proxy-protocol',
     action='store_true',
@@ -301,16 +300,27 @@ def _process_line_and_headers(self, raw: bytes) -> Tuple[bool, bytes]:
 
     def _process_line(self, raw: bytes) -> None:
         if self.type == httpParserTypes.REQUEST_PARSER:
+            # Ref:
+            # https://datatracker.ietf.org/doc/html/rfc2616#section-5.1
+            # https://greenbytes.de/tech/webdav/rfc7230.html#request.line
+            # https://greenbytes.de/tech/webdav/rfc7231.html#methods
+            # http://www.iana.org/assignments/http-methods/http-methods.xhtml
             if self.protocol is not None and self.protocol.version is None:
                 # We expect to receive entire proxy protocol v1 line
                 # in one network read and don't expect partial packets
                 self.protocol.parse(raw)
             else:
                 line = raw.split(WHITESPACE)
-                self.method = line[0].upper()
-                self.set_url(line[1])
-                self.version = line[2]
-                self.state = httpParserStates.LINE_RCVD
+                if len(line) == 3:
+                    self.method = line[0].upper()
+                    self.set_url(line[1])
+                    self.version = line[2]
+                    self.state = httpParserStates.LINE_RCVD
+                else:
+                    # raise exception
+                    # TODO, it would be better to use raise HttpProtocolException,
+                    # but we should solve circular import problem first
+                    raise NotImplementedError('Invalid request line')
         else:
             line = raw.split(WHITESPACE)
             self.version = line[0]

tests/http/test_http_parser.py

@@ -16,13 +16,23 @@
 
 from proxy.http import httpStatusCodes, httpMethods
 from proxy.http.parser import HttpParser, httpParserTypes, httpParserStates
+from proxy.http.exception import HttpProtocolException
 
 
 class TestHttpParser(unittest.TestCase):
 
     def setUp(self) -> None:
         self.parser = HttpParser(httpParserTypes.REQUEST_PARSER)
 
+    def test_issue_127(self) -> None:
+        with self.assertRaises(HttpProtocolException):
+            self.parser.parse(CRLF)
+
+        with self.assertRaises(HttpProtocolException):
+            raw = b'qwqrqw!@!#@!#ad adfad\r\n'
+            while True:
+                self.parser.parse(raw)
+
     def test_issue_398(self) -> None:
         p = HttpParser(httpParserTypes.RESPONSE_PARSER)
         p.parse(HTTP_1_0 + b' 200 OK' + CRLF)