StringIndexOutOfBoundsException thrown by HttpPostRequestDecoder.splitHeaderContentType() when Content-Type header starts with a semicolon
See original GitHub issueExpected behavior
I’m not sure what the desired behavior should be for HttpPostRequestDecoder.splitHeaderContentType()
when it finds a Content-Type header that starts with a semicolon, but I’m assuming StringIndexOutOfBoundsException
is not intentional.
Actual behavior
HttpPostRequestDecoder.splitHeaderContentType()
throws a StringIndexOutOfBoundsException
when it parses a Content-Type header that starts with a semicolon ;
. Specifically this line, because the aEnd
variable is 0 when the Content-Type header starts with a semicolon: https://github.com/netty/netty/blob/00afb19d7a37de21b35ce4f6cb3fa7f74809f2ab/codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestDecoder.java#L278.
Steps to reproduce
- Make a request to a Netty HTTP server and pass a Content-Type header that starts with a semicolon
;
. I’m not sure if there are HTTP clients that would sanitize this for you and prevent the problem, but I was able to reproduce this withRestAssured
and a NettyBootstrap
acting as a HTTP Client viaHttpClientCodec
, so there are at least a few clients you can use to reproduce. - In the Netty server that receives the request, call
HttpPostRequestDecoder.isMultipart(HttpRequest)
or any other code path that ultimately causesHttpPostRequestDecoder.splitHeaderContentType(String)
to be called with the request’s Content-Type header. - You’ll see a
StringIndexOutOfBoundsException
get thrown.
Netty version
4.1.30.Final
(probably others as well)
Issue Analytics
- State:
- Created 5 years ago
- Comments:16 (10 by maintainers)
Top Results From Across the Web
Comparing 38524ec3e2...37c03cce5e - netty5 - iGNUranza Git
Motivation: HttpPostRequestDecoder.splitHeaderContentType() throws a StringIndexOutOfBoundsException when it parses a Content-Type header that starts with a ...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
No problem, do that
Sorry I was out all last week, but your solution looks good to me! Thank you @amizurov !