actix / actix/actix-web

actix-web returns 400 bad request for http requests emitted by many user agents

Đang mở
#3,102 3 bình luận 0 reaction 0 người được giao Xem trên GitHub
A-http needs-investigation
Ngôn ngữ chính
Rust
Star
24.8k
Fork
1.9k
Merge trung bình
23 giờ 10 phút
Pull request đã merge (30 ngày)
26

Mô tả

Hello, and first, thank you for this great library !

Recently, I published a blog post titled [*I’m sorry I forked you*](https://sql.ophir.dev/blog.sql?post=I%E2%80%99m%20sorry%20I%20forked%20you). In the title, the second character is a [curly apostrophe](https://practicaltypography.com/straight-and-curly-quotes.html) (`’` U+2019 Right Single Quotation Mark).

I shared it online and started getting hits from a lot of different browsers. I significant portion of hits (I don't know which browsers exactly), did not encode the apostrophe (as `%E2%80%99`), but included the `’` directly in the HTTP query.

There are two layers between the web and my actix service:
- cloudflare, which parsed and understood the HTTP query perfectly well, and forwarded it with the curved apostrophe
- nginx, which also parsed and forwarded the query without issue.

But when it got to actix-web, it failed to parse the query, and returned a 400 back without even invoking my code.
The very confusing error message I got was: `[ERROR actix_http::h1::dispatcher] stream error: Request parse error: Invalid Header provided` (confusing because the problem did not state what the problem was exactly, and said it came from headers instead of the query string).

See: https://en.wikipedia.org/wiki/Internationalized_Resource_Identifier

## Expected Behavior

Since clients in the real world emit http requests with unicode characters, I think actix-web should accept them, and just invoke the user code with the unicode query string.

And when it encounters a real issue with the query string, it should say it comes from the query string, not from the headers, and give more details than just `Request parse error`.

## Current Behavior

logs `[ERROR actix_http::h1::dispatcher] stream error: Request parse error: Invalid Header provided`

and returns an HTTP 400 bad request response to the client.

## Steps to Reproduce (for bugs)

```rust
#[actix_web::main]
async fn main() -> std::io::Result<()> {
actix_web::HttpServer::new(|| actix_web::App::new())
.bind(("127.0.0.1", 8080))?
.run()
.await
}
```

```
❯ curl -v 'localhost:8080/’'
* Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /’ HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< content-length: 0
< connection: close
< date: Sun, 13 Aug 2023 20:01:26 GMT
<
* Closing connection 0
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

Start with the minimal actix_web::HttpServer example in the issue and reproduce the failure using curl with the unencoded curly apostrophe in the request path. Trace the request parsing that produces “Invalid Header provided,” then verify that valid Unicode requests reach user code and that malformed query or request input reports the correct source and details.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
rust
Lĩnh vực
api, backend, networking
Loại issue
Lỗi
Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Khá rõ ràng
Mức phù hợp với người mới
35/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.