mitre / mitre/HTTP-Proxy-Servlet
Incompatibility with servlet filters that consume the inputStream
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 557
- PR merge metrics
- No merged PRs in 30d
Description
This proxy does not support POST form requests.
If you do a POST request in the proxy with content type "application/x-www-form-urlencoded" the proxy gets stuck.
After a lot of debugging I figured out that the servletRequest.getInputStream() is empty when the content type is "application/x-www-form-urlencoded".
In the ProxyServlet class under the else statement of the code bellow in service(...) method, it is trying to copy to the proxyRequest the body of the servletRequest. This body is empty so the line proxyResponse1 = this.proxyClient.execute(this.getTargetHost(servletRequest), (HttpRequest)proxyRequest); hangs.
if(servletRequest.getHeader("Content-Length") == null && servletRequest.getHeader("Transfer-Encoding") == null) {
proxyRequest = new BasicHttpRequest(method, proxyRequestUri);
} else {
BasicHttpEntityEnclosingRequest proxyResponse = new BasicHttpEntityEnclosingRequest(method, proxyRequestUri);
proxyResponse.setEntity(new InputStreamEntity(servletRequest.getInputStream(), (long)servletRequest.getContentLength()));
proxyRequest = proxyResponse;
}
A workaround is to manually copy the form body of the servletRequest, servletRequest.getParameterMap().
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in ProxyServlet.service(...) and trace the branch that builds an entity from servletRequest.getInputStream() for application/x-www-form-urlencoded POST requests. Compare it with the reported getParameterMap() workaround and reproduce the hanging proxy request. Done means the form body is forwarded and the request completes without hanging.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100