Bug about content length -1

[Nihilistttt]

When response content length -1 that means header will send immediately. What if this request blocked that means response code will change 4xx or 5xx. But header already sent. It will not change antmore.

[jcchavezs]

Thanks @Nihilistttt in what connector are you experiencing this?

[Nihilistttt]

Connector?

[Nihilistttt]

func (i *rwInterceptor) WriteHeader(statusCode int) {
if i.wroteHeader {
log.Println("http: superfluous response.WriteHeader call")
return
}

for k, vv := range i.w.Header() {
	for _, v := range vv {
		i.tx.AddResponseHeader(k, v)
	}
}

i.statusCode = statusCode
if it := i.tx.ProcessResponseHeaders(statusCode, i.proto); it != nil {
	i.Header().Set("Content-Length", "0")
	i.statusCode = obtainStatusCodeFromInterruptionOrDefault(it, i.statusCode)
	i.flushWriteHeader()
	return
}

i.wroteHeader = true

}

In caddy repository interceptor.go file same with others. What will happen when reponse content-length is not exists or set to -1. After processing if content-length is -1. Server.go try to send header immediately. And if the response needs to be blocked, cant be done any more because response header already sent to client. Also in rwinterceptor element names w not holding right status code. I wrote example application for it. I didnt know the problem at that time. You can try it
#874

[jptosso]

Coraza doesn't perform any validation regarding this behavior, it's up to the ruleset to do so. It will also depend on the behavior of the connector, for example, if you use caddy, caddy will receive a chunked body and coraza will receive the real content length and the full body buffered.

[Nihilistttt]

I am using just regulat coraza package in reverse proxy what I explained before this.

[jptosso]

Can you share more details?

[Nihilistttt]

func (i *rwInterceptor) WriteHeader(statusCode int) {
if i.wroteHeader {
log.Println("http: superfluous response.WriteHeader call")
return
}

for k, vv := range i.w.Header() {
for _, v := range vv {
i.tx.AddResponseHeader(k, v)
}
}

i.statusCode = statusCode
if it := i.tx.ProcessResponseHeaders(statusCode, i.proto); it != nil {
i.Header().Set("Content-Length", "0")
i.statusCode = obtainStatusCodeFromInterruptionOrDefault(it, i.statusCode)
i.flushWriteHeader()
return
}

i.wroteHeader = true
}

In caddy repository interceptor.go file same with others. What will happen when reponse content-length is not exists or set to -1. After processing if content-length is -1. Server.go try to send header immediately. And if the response needs to be blocked, cant be done any more because response header already sent to client. Also in rwinterceptor element names w not holding right status code. I wrote example application for it. I didnt know the problem at that time. You can try it
#874