mitre / mitre/HTTP-Proxy-Servlet

Incompatibility with servlet filters that consume the inputStream

Open
#54 21 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Java
Stars
1.5k
Forks
557
PR merge metrics
No merged PRs in 30d

Description

This proxy does not support POST form requests.
If you do a POST request in the proxy with content type "application/x-www-form-urlencoded" the proxy gets stuck.
After a lot of debugging I figured out that the servletRequest.getInputStream() is empty when the content type is "application/x-www-form-urlencoded".

In the ProxyServlet class under the else statement of the code bellow in service(...) method, it is trying to copy to the proxyRequest the body of the servletRequest. This body is empty so the line proxyResponse1 = this.proxyClient.execute(this.getTargetHost(servletRequest), (HttpRequest)proxyRequest); hangs.

if(servletRequest.getHeader("Content-Length") == null && servletRequest.getHeader("Transfer-Encoding") == null) {
proxyRequest = new BasicHttpRequest(method, proxyRequestUri);
} else {
BasicHttpEntityEnclosingRequest proxyResponse = new BasicHttpEntityEnclosingRequest(method, proxyRequestUri);
proxyResponse.setEntity(new InputStreamEntity(servletRequest.getInputStream(), (long)servletRequest.getContentLength()));
proxyRequest = proxyResponse;
}

A workaround is to manually copy the form body of the servletRequest, servletRequest.getParameterMap().

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in ProxyServlet.service(...) and trace the branch that builds an entity from servletRequest.getInputStream() for application/x-www-form-urlencoded POST requests. Compare it with the reported getParameterMap() workaround and reproduce the hanging proxy request. Done means the form body is forwarded and the request completes without hanging.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.