owasp-modsecurity / owasp-modsecurity/ModSecurity

ModSecurity IIS module add content-length when chunked transfer encoding is enabled

Open
#1,364 2 comments 0 reactions 1 assignee View on GitHub

@victorhora is already working on this.

Since May 5, 2017.

2.x enhancement Platform - IIS pr available
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Setup:
Modsecurity + Application Request Routing(ARR) + IIS

ModSecurity is adding content length header even when chunked encoding is enabled. According to RFC (https://www.ietf.org/rfc/rfc2616.txt)
"Messages MUST NOT include both a Content-Length header field and a
non-identity transfer-coding. If the message does include a non-
identity transfer-coding, the Content-Length MUST be ignored."

It is violating the first line of the above and ARR fails it down the pipeline.
The code is in:
iis/mymodule.cpp

apr_status_t WriteBodyCallback(request_rec *r, char *buf, unsigned int length)
{

CHAR szLength[21]; //Max length for a 64 bit int is 20

ZeroMemory(szLength, sizeof(szLength));

HRESULT hr = StringCchPrintfA(
        szLength, 
        sizeof(szLength) / sizeof(CHAR) - 1, "%d", 
        length);

if(FAILED(hr))
{
	// not possible
}

hr = pHttpRequest->SetHeader(
        HttpHeaderContentLength, 
        szLength, 
        (USHORT)strlen(szLength),
        TRUE);

Was this SetHeader Content-lenght intentional?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.