caddyhttp: Reject absurd methods (#4538)

* caddyhttp: Reject absurdly long methods * Limit method to 32 chars and truncate * Just reject the request and debug-log it * Log remote address

Matt Holt committed Jan 19, 2022 at 13:44 UTC bf380d00ab62ccedcf5d7f32125bfbd4dd636d01

1 file changed +11

modules/caddyhttp/server.go

+11

@@ -150,6 +150,17 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {

150 }

151 }

152

153 + // reject very long methods; probably a mistake or an attack

154 + if len(r.Method) > 32 {

155 + if s.shouldLogRequest(r) {

156 + s.accessLogger.Debug("rejecting request with long method",

157 + zap.String("method_trunc", r.Method[:32]),

158 + zap.String("remote_addr", r.RemoteAddr))

159 + }

160 + w.WriteHeader(http.StatusMethodNotAllowed)

161 + return

162 + }

163 +

164 repl := caddy.NewReplacer()

165 r = PrepareRequest(r, repl, w, s)

166