owasp-modsecurity / owasp-modsecurity/ModSecurity
ModSecurity IIS module add content-length when chunked transfer encoding is enabled
@victorhora is already working on this.
Since May 5, 2017.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Setup:
Modsecurity + Application Request Routing(ARR) + IIS
ModSecurity is adding content length header even when chunked encoding is enabled. According to RFC (https://www.ietf.org/rfc/rfc2616.txt)
"Messages MUST NOT include both a Content-Length header field and a
non-identity transfer-coding. If the message does include a non-
identity transfer-coding, the Content-Length MUST be ignored."
It is violating the first line of the above and ARR fails it down the pipeline.
The code is in:
iis/mymodule.cpp
apr_status_t WriteBodyCallback(request_rec *r, char *buf, unsigned int length)
{
CHAR szLength[21]; //Max length for a 64 bit int is 20
ZeroMemory(szLength, sizeof(szLength));
HRESULT hr = StringCchPrintfA(
szLength,
sizeof(szLength) / sizeof(CHAR) - 1, "%d",
length);
if(FAILED(hr))
{
// not possible
}
hr = pHttpRequest->SetHeader(
HttpHeaderContentLength,
szLength,
(USHORT)strlen(szLength),
TRUE);
Was this SetHeader Content-lenght intentional?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.