mitre / mitre/HTTP-Proxy-Servlet

Cookie empty value copy

Open
#47 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
1.5k
Forks
557
PR merge metrics
No merged PRs in 30d

Description

should be:

protected void copyRequestHeaders(HttpServletRequest servletRequest,
HttpRequest proxyRequest) {
// Get an Enumeration of all of the header names sent by the client
Enumeration enumerationOfHeaderNames = servletRequest.getHeaderNames();
while (enumerationOfHeaderNames.hasMoreElements()) {
String headerName = (String) enumerationOfHeaderNames.nextElement();
// Instead the content-length is effectively set via
// InputStreamEntity
if (headerName.equalsIgnoreCase(HttpHeaders.CONTENT_LENGTH))
continue;
if (hopByHopHeaders.containsHeader(headerName))
continue;

        Enumeration headers = servletRequest.getHeaders(headerName);
        while (headers.hasMoreElements()) {// sometimes more than one value
            String headerValue = (String) headers.nextElement();
            // In case the proxy host is running multiple virtual servers,
            // rewrite the Host header to ensure that we get content from
            // the correct virtual server
            if (headerName.equalsIgnoreCase(HttpHeaders.HOST)) {
                HttpHost host = getTargetHost(servletRequest);
                headerValue = host.getHostName();
                if (host.getPort() != -1)
                    headerValue += ":" + host.getPort();
            } else if (headerName
                    .equalsIgnoreCase(org.apache.http.cookie.SM.COOKIE)) {
                    headerValue = getRealCookie(headerValue);
            }
            if (headerValue != null && !headerValue.equals("")) {
                proxyRequest.addHeader(headerName, headerValue);
            }
        }
    }
}

to avoid "Cookie: "

example: with Grizzly Server as target after proxy will couse in target 500 error, bcs of sending "Cookie: "

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the copyRequestHeaders(HttpServletRequest, HttpRequest) method shown in the issue and inspect how cookie headers are transformed before being added to the proxy request. Reproduce the Grizzly target failure if possible, then verify that an empty cookie value is not forwarded and that normal cookie values still are.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.