[jira] Commented: (HTTPCORE-81) Enforce maximum line length and header count

["Oleg Kalnichevski (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HTTPCORE-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12504411 ] 

Oleg Kalnichevski commented on HTTPCORE-81:
-------------------------------------------

> The naming of HttpMessageParser.reset(HttpParams) is not optimal since the class already has a reset() method. 

I moved maxLineLen and maxHeaderCount to the HttpMessageParser constructor, since these parameters are applied only once at the initialization time. I am also going to do away with the #reset method in blocking HttpDataTransmitter and HttpDataReceiver for the same reason.

> Revised patch to also check length of folded headers. It seems to be possible to work around the limits set for the blocking 
> implementation using folded headers as well

Well spotted. I'll fix the problem in HttpCore base

> it might be a good idea to introduce an additional property HttpConnectionParams.MAX_HEADER_LENGTH

I am not sure there is really much practical value in being able to differentiate the two cases, but I do not mind adding the parameter if you think otherwise.

The patch applied with some minor tweaks mentioned above. Many thanks, Steffen

Oleg

> Enforce maximum line length and header count
> --------------------------------------------
>
>                 Key: HTTPCORE-81
>                 URL: https://issues.apache.org/jira/browse/HTTPCORE-81
>             Project: HttpComponents Core
>          Issue Type: Improvement
>          Components: HttpCore NIO
>            Reporter: Steffen Pingel
>         Attachments: httpcore-limit-message-length.patch, httpcore-limit-message-length.patch
>
>
> The NIO module does not enforce the 'http.connection.max-line-length' and 'http.connection.max-header-count' parameters.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


---------------------------------------------------------------------
To unsubscribe, e-mail: httpcomponents-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: httpcomponents-dev-help@jakarta.apache.org