fastcgi: check for CONTENT_LENGTH when sending requests (#6661)

* fastcgi: check for CONTENT_LENGTH when sending requests * order imports * use strconv.ParseUint instead of strconv.ParseInt Co-authored-by: Kévin Dunglas <kevin@dunglas.fr> --------- Co-authored-by: Kévin Dunglas <kevin@dunglas.fr>

WeidiDeng committed Dec 18, 2024 at 08:22 UTC 6790c0e38abcc534c4b3365b6e438148001fd6df

1 file changed +11

modules/caddyhttp/reverseproxy/fastcgi/client.go

+11

@@ -41,6 +41,8 @@ import (

42 "go.uber.org/zap"

43 "go.uber.org/zap/zapcore"

44 +

45 + "github.com/caddyserver/caddy/v2/modules/caddyhttp"

46 )

48 // FCGIListenSockFileno describes listen socket file number.

@@ -136,6 +138,15 @@ type client struct {

138 // Do made the request and returns a io.Reader that translates the data read

139 // from fcgi responder out of fcgi packet before returning it.

140 func (c *client) Do(p map[string]string, req io.Reader) (r io.Reader, err error) {

141 + // check for CONTENT_LENGTH, since the lack of it or wrong value will cause the backend to hang

142 + if clStr, ok := p["CONTENT_LENGTH"]; !ok {

143 + return nil, caddyhttp.Error(http.StatusLengthRequired, nil)

144 + } else if _, err := strconv.ParseUint(clStr, 10, 64); err != nil {

145 + // stdlib won't return a negative Content-Length, but we check just in case,

146 + // the most likely cause is from a missing content length, which is -1

147 + return nil, caddyhttp.Error(http.StatusLengthRequired, err)

148 + }

149 +

150 writer := &streamWriter{c: c}

151 writer.buf = bufPool.Get().(*bytes.Buffer)

152 writer.buf.Reset()