Issue #11659 - Properly ignore OWS before Content-Length value.

jetty · Apr 17, 2024 · a774047 · a774047
1 parent 940c744
commit a774047
Show file tree

Hide file tree

Showing 2 changed files with 54 additions and 5 deletions.
diff --git a/jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/HttpParser.java b/jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/HttpParser.java
@@ -1228,11 +1228,21 @@ private long convertContentLength(String valueString)
 
         for (int i = 0; i < length; i++)
         {
-            char c = valueString.charAt(i);
-            if (c < '0' || c > '9')
-                throw new BadMessageException("Invalid Content-Length Value", new NumberFormatException());
+            char ch = valueString.charAt(i);
+            HttpTokens.Token t = HttpTokens.getToken(ch);
 
-            value = Math.addExact(Math.multiplyExact(value, 10), c - '0');
+            switch (t.getType())
+            {
+                case SPACE:
+                case HTAB:
+                    // ignore OWS
+                    continue;
+                case DIGIT:
+                    value = Math.addExact(Math.multiplyExact(value, 10), ch - '0');
+                    break;
+                default:
+                    throw new BadMessageException("Invalid Content-Length Value", new NumberFormatException());
+            }
         }
         return value;
     }

diff --git a/jetty-core/jetty-http/src/test/java/org/eclipse/jetty/http/HttpParserTest.java b/jetty-core/jetty-http/src/test/java/org/eclipse/jetty/http/HttpParserTest.java
@@ -1971,7 +1971,8 @@ public void testBadCR(String eoln)
         "+10",
         "1.0",
         "1,0",
-        "10,"
+        "10,",
+        "10A"
     })
     public void testBadContentLengths(String contentLength)
     {
@@ -1994,6 +1995,44 @@ public void testBadContentLengths(String contentLength)
         assertEquals(HttpParser.State.CLOSED, parser.getState());
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {
+        " 10 ",
+        "10 ",
+        " 10",
+        "\t10",
+        "\t10\t",
+        "10\t",
+        " \t \t \t 10"
+    })
+    public void testContentLengthWithOWS(String contentLength)
+    {
+        String rawRequest = """
+            GET /test HTTP/1.1\r
+            Host: localhost\r
+            Content-Length: @LEN@\r
+            \r
+            1234567890
+            """.replace("@LEN@", contentLength);
+        ByteBuffer buffer = BufferUtil.toBuffer(rawRequest);
+
+        HttpParser.RequestHandler handler = new Handler();
+        HttpParser parser = new HttpParser(handler);
+        parseAll(parser, buffer);
+
+        assertEquals("GET", _methodOrVersion);
+        assertEquals("/test", _uriOrStatus);
+        assertEquals("HTTP/1.1", _versionOrReason);
+        assertEquals("localhost", _val[0]);
+        assertEquals("Host", _hdr[0]);
+        assertEquals("localhost", _val[0]);
+
+        assertEquals(_content.length(), 10);
+        assertEquals(parser.getContentLength(), 10);
+        assertTrue(_headerCompleted);
+        assertTrue(_messageCompleted);
+    }
+
     @ParameterizedTest
     @ValueSource(strings = {"\r\n", "\n"})
     public void testMultipleContentLengthWithLargerThenCorrectValue(String eoln)