mitre / mitre/HTTP-Proxy-Servlet
Cookie empty value copy
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 557
- PR merge metrics
- No merged PRs in 30d
Description
should be:
protected void copyRequestHeaders(HttpServletRequest servletRequest,
HttpRequest proxyRequest) {
// Get an Enumeration of all of the header names sent by the client
Enumeration enumerationOfHeaderNames = servletRequest.getHeaderNames();
while (enumerationOfHeaderNames.hasMoreElements()) {
String headerName = (String) enumerationOfHeaderNames.nextElement();
// Instead the content-length is effectively set via
// InputStreamEntity
if (headerName.equalsIgnoreCase(HttpHeaders.CONTENT_LENGTH))
continue;
if (hopByHopHeaders.containsHeader(headerName))
continue;
Enumeration headers = servletRequest.getHeaders(headerName);
while (headers.hasMoreElements()) {// sometimes more than one value
String headerValue = (String) headers.nextElement();
// In case the proxy host is running multiple virtual servers,
// rewrite the Host header to ensure that we get content from
// the correct virtual server
if (headerName.equalsIgnoreCase(HttpHeaders.HOST)) {
HttpHost host = getTargetHost(servletRequest);
headerValue = host.getHostName();
if (host.getPort() != -1)
headerValue += ":" + host.getPort();
} else if (headerName
.equalsIgnoreCase(org.apache.http.cookie.SM.COOKIE)) {
headerValue = getRealCookie(headerValue);
}
if (headerValue != null && !headerValue.equals("")) {
proxyRequest.addHeader(headerName, headerValue);
}
}
}
}
to avoid "Cookie: "
example: with Grizzly Server as target after proxy will couse in target 500 error, bcs of sending "Cookie: "
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the copyRequestHeaders(HttpServletRequest, HttpRequest) method shown in the issue and inspect how cookie headers are transformed before being added to the proxy request. Reproduce the Grizzly target failure if possible, then verify that an empty cookie value is not forwarded and that normal cookie values still are.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100