You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Christoph Kukulies <ku...@kukulies.org.INVALID> on 2024/06/04 09:49:46 UTC
Invalid character found in the request target
I'm getting these when startig tomcat9:
04-Jun-2024 09:49:11.448 INFO [http-nio-8080-exec-6] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Invalid character found in the request target [/sra_{xxxxxxx0-DDDD-3333-yyyyyyyyyyyyyy}/ ]. The valid characters are defined in RFC 7230 and RFC 3986
at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:502)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:271)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:889)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1735)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:829)
Any clues?
System is Ubuntu 64 22.04.
TIA,
Christoph
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Invalid character found in the request target
Posted by Mark Thomas <ma...@apache.org>.
On 04/06/2024 15:37, Christopher Schultz wrote:
> On 6/4/24 09:10, Chuck Caldarale wrote:
<snip/>
>>> The problem is the { and } characters.
>>>
>>> My reading of RFC 7230 is that { and } /should/ be allowed, but
>>> Tomcat's code rejects them by default.
My reading is as follows:
RFC 9110:
http-URI = "http" "://" authority path-abempty [ "?" query ]
RFC 3968:
path-abempty = *( "/" segment )
segment = *pchar
pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
/ "*" / "+" / "," / ";" / "="
Neither '{' nor '}' are included in unreserved or sub-delims The are not
pct-encoded. Nor are they ':' or '@'. Therefore, there are not valid for
use in a segment. If you want to use them, they need to be pct-encoded.
While some of the text of RFC 3968, section 2.3 could be read as
suggesting other characters are included in unreserved, my reading of
that section is that the intended definition of unreserved is the
explicit definition I quoted above.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Invalid character found in the request target
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Chuck,
On 6/4/24 09:10, Chuck Caldarale wrote:
>
>> On Jun 4, 2024, at 06:07, Christopher Schultz <ch...@christopherschultz.net> wrote:
>
>
> <snip/>
>
>
>>> 04-Jun-2024 09:49:11.448 INFO [http-nio-8080-exec-6] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
>>> Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
>>> java.lang.IllegalArgumentException: Invalid character found in the request target [/sra_{xxxxxxx0-DDDD-3333-yyyyyyyyyyyyyy}/ ]. The valid characters are defined in RFC 7230 and RFC 3986
>>
>> The problem is the { and } characters.
>>
>> My reading of RFC 7230 is that { and } /should/ be allowed, but Tomcat's code rejects them by default.
>
>
> I think it depends on which part of RFC 3986 one looks at. Appendix A should have the precise URI syntax, where the reserved and unreserved sets are defined as follows:
>
> unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
> reserved = gen-delims / sub-delims
> gen-delims = ":" / "/" / "?" / "#" / "[" / "]" / "@"
> sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
> / "*" / "+" / "," / ";" / "="
>
> Some ASCII characters, notably braces, are simply left out of either set here. However, section 2.3 declares:
>
> Characters that are allowed in a URI but do not have a reserved
> purpose are called unreserved. These include uppercase and lowercase
> letters, decimal digits, hyphen, period, underscore, and tilde.
>
> The use of “include” would seem to imply “not limited to”, but that’s not explicitly stated here.
>
> Nothing like a little ambiguity to keep things interesting…
Yup. RFC 3986 does not include the { character anywhere in the text. RFC
7230 mentions it as a character not allowed in "field values" which I
think only applies to headers.... unless you consider the "request line"
to be "header 0" or somesuch.
At any rate, characters such as { and } could be considered "dangerous"
and so, while I would argue the RFC doesn't prohibit them, Tomcat's
refusal to accept them under a default configuration is a reasonable
one... especially because you can simply re-enable them if your
application needs them.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Invalid character found in the request target
Posted by Chuck Caldarale <n8...@gmail.com>.
> On Jun 4, 2024, at 06:07, Christopher Schultz <ch...@christopherschultz.net> wrote:
<snip/>
>> 04-Jun-2024 09:49:11.448 INFO [http-nio-8080-exec-6] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
>> Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
>> java.lang.IllegalArgumentException: Invalid character found in the request target [/sra_{xxxxxxx0-DDDD-3333-yyyyyyyyyyyyyy}/ ]. The valid characters are defined in RFC 7230 and RFC 3986
>
> The problem is the { and } characters.
>
> My reading of RFC 7230 is that { and } /should/ be allowed, but Tomcat's code rejects them by default.
I think it depends on which part of RFC 3986 one looks at. Appendix A should have the precise URI syntax, where the reserved and unreserved sets are defined as follows:
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
reserved = gen-delims / sub-delims
gen-delims = ":" / "/" / "?" / "#" / "[" / "]" / "@"
sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
/ "*" / "+" / "," / ";" / "="
Some ASCII characters, notably braces, are simply left out of either set here. However, section 2.3 declares:
Characters that are allowed in a URI but do not have a reserved
purpose are called unreserved. These include uppercase and lowercase
letters, decimal digits, hyphen, period, underscore, and tilde.
The use of “include” would seem to imply “not limited to”, but that’s not explicitly stated here.
Nothing like a little ambiguity to keep things interesting…
- Chuck
> You can override this behavior by using the relaxedPathChars configuration attribute on your <Connector>[1].
>
> -chris
>
> [1] https://tomcat.apache.org/tomcat-9.0-doc/config/http.html
Re: Invalid character found in the request target
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Christoph,
On 6/4/24 05:49, Christoph Kukulies wrote:
> I'm getting these when startig tomcat9:
This is a request, not startup. But it's not important.
> 04-Jun-2024 09:49:11.448 INFO [http-nio-8080-exec-6] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
> Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
> java.lang.IllegalArgumentException: Invalid character found in the request target [/sra_{xxxxxxx0-DDDD-3333-yyyyyyyyyyyyyy}/ ]. The valid characters are defined in RFC 7230 and RFC 3986
> at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:502)
> at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:271)
> at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
> at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:889)
> at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1735)
> at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
> at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
> at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
> at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> at java.base/java.lang.Thread.run(Thread.java:829)
>
> Any clues?
The problem is the { and } characters.
My reading of RFC 7230 is that { and } /should/ be allowed, but Tomcat's
code rejects them by default.
You can override this behavior by using the relaxedPathChars
configuration attribute on your <Connector>[1].
-chris
[1] https://tomcat.apache.org/tomcat-9.0-doc/config/http.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org