ByteBufs into HttpMessages and
HttpContents.
| Name | Default value | Meaning |
|---|---|---|
maxInitialLineLength |
4096 | The maximum length of the initial line
(e.g. "GET / HTTP/1.0" or "HTTP/1.0 200 OK")
If the length of the initial line exceeds this value, a
TooLongHttpLineException will be raised. |
maxHeaderSize |
8192 | The maximum length of all headers. If the sum of the length of each
header exceeds this value, a TooLongHttpHeaderException will be raised. |
maxChunkSize |
8192 | The maximum length of the content or each chunk. If the content length
(or the length of each chunk) exceeds this value, the content or chunk
will be split into multiple HttpContents whose length is
maxChunkSize at maximum. |
| Name | Default value | Meaning |
|---|---|---|
allowDuplicateContentLengths |
false | When set to false, will reject any messages that contain multiple Content-Length header fields.
When set to true, will allow multiple Content-Length headers only if they are all the same decimal value.
The duplicated field-values will be replaced with a single valid Content-Length field.
See RFC 7230, Section 3.3.2. |
allowPartialChunks |
true | If the length of a chunk exceeds the ByteBufs readable bytes and allowPartialChunks
is set to true, the chunk will be split into multiple HttpContents.
Otherwise, if the chunk size does not exceed maxChunkSize and allowPartialChunks
is set to false, the ByteBuf is not decoded into an HttpContent until
the readable bytes are greater or equal to the chunk size. |
maxChunkSize or
the transfer encoding of the HTTP message is 'chunked', this decoder
generates one HttpMessage instance and its following
HttpContents per single HTTP message to avoid excessive memory
consumption. For example, the following HTTP message:
GET / HTTP/1.1 Transfer-Encoding: chunked 1a abcdefghijklmnopqrstuvwxyz 10 1234567890abcdef 0 Content-MD5: ... [blank line]triggers
HttpRequestDecoder to generate 3 objects:
HttpRequest,HttpContent whose content is 'abcdefghijklmnopqrstuvwxyz',LastHttpContent whose content is '1234567890abcdef', which marks
the end of the content.HttpContents by yourself for your
convenience, insert HttpObjectAggregator after this decoder in the
ChannelPipeline. However, please note that your server might not
be as memory efficient as without the aggregator.
Without header validation, your system can become vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') .
This recommendation stands even when both peers in the HTTP exchange are trusted, as it helps with defence-in-depth.
| Modifier and Type | Class and Description |
|---|---|
| private static class | |
| private class | |
| private static enum | HttpObjectDecoder.State
The internal state of |
| Modifier and Type | Field and Description |
|---|---|
| private final boolean | |
| private final boolean | |
| private boolean | |
| private final boolean | |
| private long | |
| private long | |
| private HttpObjectDecoder. | |
| public static final boolean | |
| public static final boolean | |
| public static final boolean | |
| public static final int | |
| public static final int | |
| public static final int | |
| public static final int | |
| public static final boolean | |
| private final HttpObjectDecoder. | |
| protected final HttpHeadersFactory | |
| private static final boolean[] | |
| private boolean | |
| private static final boolean[] | |
| private final HttpObjectDecoder. | |
| private final int | |
| private HttpMessage | |
| private AsciiString | |
| private final ByteBuf | |
| private final AtomicBoolean | |
| private static final ByteProcessor | |
| private static final boolean[] | |
| private LastHttpContent | |
| protected final HttpHeadersFactory | |
| protected final boolean | validateHeaders
This field is no longer used. |
| private String |
| Access | Constructor and Description |
|---|---|
| protected | HttpObjectDecoder()
Creates a new instance with the default
|
| protected | HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported)
Deprecated
Use
Creates a new instance with the specified parameters.
HttpObjectDecoder(HttpDecoderConfig) instead.
|
| protected | HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders)
Deprecated
Use
Creates a new instance with the specified parameters.
HttpObjectDecoder(HttpDecoderConfig) instead.
|
| protected | HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders, int initialBufferSize)
Deprecated
Use
Creates a new instance with the specified parameters.
HttpObjectDecoder(HttpDecoderConfig) instead.
|
| protected | HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders, int initialBufferSize, boolean allowDuplicateContentLengths)
Deprecated
Use
Creates a new instance with the specified parameters.
HttpObjectDecoder(HttpDecoderConfig) instead.
|
| protected | HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders, int initialBufferSize, boolean allowDuplicateContentLengths, boolean allowPartialChunks)
Deprecated
Use
Creates a new instance with the specified parameters.
HttpObjectDecoder(HttpDecoderConfig) instead.
|
| protected |
| Modifier and Type | Method and Description |
|---|---|
| private void | |
| protected abstract HttpMessage | |
| protected abstract HttpMessage | |
| protected void | decode(ChannelHandlerContext
the ctx, ByteBuf ChannelHandlerContext which this ByteToMessageDecoder belongs tothe buffer, List<Object> ByteBuf from which to read datathe out)List to which decoded messages should be addedImplements abstract io. ByteBuf to an other.
|
| protected void | decodeLast(ChannelHandlerContext ctx, ByteBuf in, List<Object> out)
Overrides io. ChannelHandlerContext goes in-active.
|
| private static int | |
| private static int | |
| private static int | |
| private static int | |
| private static int | |
| protected void | handlerRemoved0(ChannelHandlerContext ctx)
Overrides io. ByteToMessageDecoder was removed from the actual context and it doesn't handle
events anymore.
|
| protected void | handleTransferEncodingChunkedWithContentLength(HttpMessage message)
Invoked when a message with both a "Transfer-Encoding: chunked" and a "Content-Length" header field is detected. |
| private HttpContent | |
| private HttpMessage | |
| protected boolean | |
| private static boolean | |
| protected abstract boolean | |
| private static boolean | |
| private static boolean | |
| protected boolean | isSwitchingToNonHttp1Protocol(HttpResponse msg)
Returns true if the server switched to a different protocol than HTTP/1.0 or HTTP/1.1, e.g. HTTP/2 or Websocket. |
| protected boolean | |
| private static boolean | |
| private static String | langAsciiString(final byte[] asciiContent, int start, int length)
This method shouldn't exist: look at https://bugs.openjdk.org/browse/JDK-8295496 for more context |
| private HttpObjectDecoder. | |
| private LastHttpContent | |
| public void | |
| private void | |
| private static int | skipWhiteSpaces(byte[] hex, int start, int length)
It skips any whitespace char and return the number of skipped bytes. |
| protected String | |
| private void | |
| protected AsciiString | |
| private String[] | |
| protected String | |
| protected String | |
| public void | userEventTriggered(ChannelHandlerContext ctx, Object evt)
Overrides io. Implements io. ChannelHandlerContext#fireUserEventTriggered(Object) to forward
to the next ChannelInboundHandler in the ChannelPipeline.
|
| allowDuplicateContentLengths | back to summary |
|---|---|
| private final boolean allowDuplicateContentLengths | |
| allowPartialChunks | back to summary |
|---|---|
| private final boolean allowPartialChunks | |
| chunked | back to summary |
|---|---|
| private boolean chunked | |
| chunkedSupported | back to summary |
|---|---|
| private final boolean chunkedSupported | |
| chunkSize | back to summary |
|---|---|
| private long chunkSize | |
| contentLength | back to summary |
|---|---|
| private long contentLength | |
| currentState | back to summary |
|---|---|
| private HttpObjectDecoder. | |
| DEFAULT_ALLOW_DUPLICATE_CONTENT_LENGTHS | back to summary |
|---|---|
| public static final boolean DEFAULT_ALLOW_DUPLICATE_CONTENT_LENGTHS | |
| DEFAULT_ALLOW_PARTIAL_CHUNKS | back to summary |
|---|---|
| public static final boolean DEFAULT_ALLOW_PARTIAL_CHUNKS | |
| DEFAULT_CHUNKED_SUPPORTED | back to summary |
|---|---|
| public static final boolean DEFAULT_CHUNKED_SUPPORTED | |
| DEFAULT_INITIAL_BUFFER_SIZE | back to summary |
|---|---|
| public static final int DEFAULT_INITIAL_BUFFER_SIZE | |
| DEFAULT_MAX_CHUNK_SIZE | back to summary |
|---|---|
| public static final int DEFAULT_MAX_CHUNK_SIZE | |
| DEFAULT_MAX_HEADER_SIZE | back to summary |
|---|---|
| public static final int DEFAULT_MAX_HEADER_SIZE | |
| DEFAULT_MAX_INITIAL_LINE_LENGTH | back to summary |
|---|---|
| public static final int DEFAULT_MAX_INITIAL_LINE_LENGTH | |
| DEFAULT_VALIDATE_HEADERS | back to summary |
|---|---|
| public static final boolean DEFAULT_VALIDATE_HEADERS | |
| headerParser | back to summary |
|---|---|
| private final HttpObjectDecoder. | |
| headersFactory | back to summary |
|---|---|
| protected final HttpHeadersFactory headersFactory | |
| ISO_CONTROL_OR_WHITESPACE | back to summary |
|---|---|
| private static final boolean[] ISO_CONTROL_OR_WHITESPACE | |
| isSwitchingToNonHttp1Protocol | back to summary |
|---|---|
| private boolean isSwitchingToNonHttp1Protocol | |
| LATIN_WHITESPACE | back to summary |
|---|---|
| private static final boolean[] LATIN_WHITESPACE | |
| lineParser | back to summary |
|---|---|
| private final HttpObjectDecoder. | |
| maxChunkSize | back to summary |
|---|---|
| private final int maxChunkSize | |
| message | back to summary |
|---|---|
| private HttpMessage message | |
| name | back to summary |
|---|---|
| private AsciiString name | |
| parserScratchBuffer | back to summary |
|---|---|
| private final ByteBuf parserScratchBuffer | |
| resetRequested | back to summary |
|---|---|
| private final AtomicBoolean resetRequested | |
| SKIP_CONTROL_CHARS_BYTES | back to summary |
|---|---|
| private static final ByteProcessor SKIP_CONTROL_CHARS_BYTES | |
| SP_LENIENT_BYTES | back to summary |
|---|---|
| private static final boolean[] SP_LENIENT_BYTES | |
| trailer | back to summary |
|---|---|
| private LastHttpContent trailer | |
| trailersFactory | back to summary |
|---|---|
| protected final HttpHeadersFactory trailersFactory | |
| validateHeaders | back to summary |
|---|---|
| protected final boolean validateHeaders
Deprecated
This field is no longer used. It is only kept around for backwards compatibility purpose. | |
| value | back to summary |
|---|---|
| private String value | |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder() Creates a new instance with the default
| |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported)
Deprecated Use Creates a new instance with the specified parameters.
| |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders)
Deprecated Use Creates a new instance with the specified parameters.
| |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders, int initialBufferSize)
Deprecated Use Creates a new instance with the specified parameters.
| |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders, int initialBufferSize, boolean allowDuplicateContentLengths)
Deprecated Use Creates a new instance with the specified parameters.
| |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder(int maxInitialLineLength, int maxHeaderSize, int maxChunkSize, boolean chunkedSupported, boolean validateHeaders, int initialBufferSize, boolean allowDuplicateContentLengths, boolean allowPartialChunks)
Deprecated Use Creates a new instance with the specified parameters.
| |
| HttpObjectDecoder | back to summary |
|---|---|
| protected HttpObjectDecoder(HttpDecoderConfig config) Creates a new instance with the specified configuration. | |
| addCurrentMessage | back to summary |
|---|---|
| private void addCurrentMessage(List<Object> out) | |
| createInvalidMessage | back to summary |
|---|---|
| protected abstract HttpMessage createInvalidMessage() | |
| createMessage | back to summary |
|---|---|
| protected abstract HttpMessage createMessage(String[] initialLine) throws Exception | |
| decode | back to summary |
|---|---|
| protected void decode(ChannelHandlerContext ctx, ByteBuf buffer, List<Object> out) throws Exception Implements abstract io. Doc from io. Decode the from one
| |
| decodeLast | back to summary |
|---|---|
| protected void decodeLast(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception Overrides io. Doc from io. Is called one last time when the
| |
| findEndOfString | back to summary |
|---|---|
| private static int findEndOfString(byte[] sb, int start, int end) | |
| findNonSPLenient | back to summary |
|---|---|
| private static int findNonSPLenient(byte[] sb, int offset, int end) | |
| findNonWhitespace | back to summary |
|---|---|
| private static int findNonWhitespace(byte[] sb, int offset, int end) | |
| findSPLenient | back to summary |
|---|---|
| private static int findSPLenient(byte[] sb, int offset, int end) | |
| getChunkSize | back to summary |
|---|---|
| private static int getChunkSize(byte[] hex, int start, int length) | |
| handlerRemoved0 | back to summary |
|---|---|
| protected void handlerRemoved0(ChannelHandlerContext ctx) throws Exception Overrides io. Doc from io. Gets called after the
| |
| handleTransferEncodingChunkedWithContentLength | back to summary |
|---|---|
| protected void handleTransferEncodingChunkedWithContentLength(HttpMessage message) Invoked when a message with both a "Transfer-Encoding: chunked" and a "Content-Length" header field is detected. The default behavior is to remove the Content-Length field, but this method could be overridden to change the behavior (to, e.g., throw an exception and produce an invalid message). See: https://tools.ietf.org/html/rfc7230#section-3.3.3
If a message is received with both a Transfer-Encoding and a
Content-Length header field, the Transfer-Encoding overrides the
Content-Length. Such a message might indicate an attempt to
perform request smuggling (Section 9.5) or response splitting
(Section 9.4) and ought to be handled as an error. A sender MUST
remove the received Content-Length field prior to forwarding such
a message downstream.
Also see:
https://github.com/apache/tomcat/blob/b693d7c1981fa7f51e58bc8c8e72e3fe80b7b773/
java/org/apache/coyote/http11/Http11Processor.java#L747-L755
https://github.com/nginx/nginx/blob/0ad4393e30c119d250415cb769e3d8bc8dce5186/
src/http/ngx_http_request.c#L1946-L1953
| |
| invalidChunk | back to summary |
|---|---|
| private HttpContent invalidChunk(ByteBuf in, Exception cause) | |
| invalidMessage | back to summary |
|---|---|
| private HttpMessage invalidMessage(HttpMessage current, ByteBuf in, Exception cause) | |
| isContentAlwaysEmpty | back to summary |
|---|---|
| protected boolean isContentAlwaysEmpty(HttpMessage msg) | |
| isControlOrWhitespaceAsciiChar | back to summary |
|---|---|
| private static boolean isControlOrWhitespaceAsciiChar(byte b) | |
| isDecodingRequest | back to summary |
|---|---|
| protected abstract boolean isDecodingRequest() | |
| isOWS | back to summary |
|---|---|
| private static boolean isOWS(byte ch) | |
| isSPLenient | back to summary |
|---|---|
| private static boolean isSPLenient(byte c) | |
| isSwitchingToNonHttp1Protocol | back to summary |
|---|---|
| protected boolean isSwitchingToNonHttp1Protocol(HttpResponse msg) Returns true if the server switched to a different protocol than HTTP/1.0 or HTTP/1.1, e.g. HTTP/2 or Websocket. Returns false if the upgrade happened in a different layer, e.g. upgrade from HTTP/1.1 to HTTP/1.1 over TLS. | |
| isValidating | back to summary |
|---|---|
| protected boolean isValidating(HttpHeadersFactory headersFactory) | |
| isWhitespace | back to summary |
|---|---|
| private static boolean isWhitespace(byte b) | |
| langAsciiString | back to summary |
|---|---|
| private static String langAsciiString(final byte[] asciiContent, int start, int length) This method shouldn't exist: look at https://bugs.openjdk.org/browse/JDK-8295496 for more context | |
| readHeaders | back to summary |
|---|---|
| private HttpObjectDecoder. | |
| readTrailingHeaders | back to summary |
|---|---|
| private LastHttpContent readTrailingHeaders(ByteBuf buffer) | |
| reset | back to summary |
|---|---|
| public void reset() Resets the state of the decoder so that it is ready to decode a new message.
This method is useful for handling a rejected request with | |
| resetNow | back to summary |
|---|---|
| private void resetNow() | |
| skipWhiteSpaces | back to summary |
|---|---|
| private static int skipWhiteSpaces(byte[] hex, int start, int length) It skips any whitespace char and return the number of skipped bytes. | |
| splitFirstWordInitialLine | back to summary |
|---|---|
| protected String splitFirstWordInitialLine(final byte[] asciiContent, int start, int length) | |
| splitHeader | back to summary |
|---|---|
| private void splitHeader(byte[] line, int start, int length) | |
| splitHeaderName | back to summary |
|---|---|
| protected AsciiString splitHeaderName(byte[] sb, int start, int length) | |
| splitInitialLine | back to summary |
|---|---|
| private String[] splitInitialLine(ByteBuf asciiBuffer) | |
| splitSecondWordInitialLine | back to summary |
|---|---|
| protected String splitSecondWordInitialLine(final byte[] asciiContent, int start, int length) | |
| splitThirdWordInitialLine | back to summary |
|---|---|
| protected String splitThirdWordInitialLine(final byte[] asciiContent, int start, int length) | |
| userEventTriggered | back to summary |
|---|---|
| public void userEventTriggered(ChannelHandlerContext ctx, Object evt) throws Exception Overrides io. Implements io. Doc from io. Calls
| |
| Modifier and Type | Field and Description |
|---|---|
| protected final int | |
| protected final ByteBuf | |
| pack-priv int |
| Access | Constructor and Description |
|---|---|
| pack-priv |
| Modifier and Type | Method and Description |
|---|---|
| protected TooLongFrameException | |
| public ByteBuf | |
| public void |
| maxLength | back to summary |
|---|---|
| protected final int maxLength | |
| seq | back to summary |
|---|---|
| protected final ByteBuf seq | |
| size | back to summary |
|---|---|
| pack-priv int size | |
| HeaderParser | back to summary |
|---|---|
| pack-priv HeaderParser(ByteBuf seq, int maxLength) | |
| newException | back to summary |
|---|---|
| protected TooLongFrameException newException(int maxLength) | |
| parse | back to summary |
|---|---|
| public ByteBuf parse(ByteBuf buffer) | |
| reset | back to summary |
|---|---|
| public void reset() | |
| Access | Constructor and Description |
|---|---|
| pack-priv |
| Modifier and Type | Method and Description |
|---|---|
| protected TooLongFrameException | newException(int maxLength)
Overrides io. |
| public ByteBuf | |
| private boolean |
| LineParser | back to summary |
|---|---|
| pack-priv LineParser(ByteBuf seq, int maxLength) | |
| newException | back to summary |
|---|---|
| protected TooLongFrameException newException(int maxLength) Overrides io.
| |
| parse | back to summary |
|---|---|
| public ByteBuf parse(ByteBuf buffer) Overrides io.
| |
| skipControlChars | back to summary |
|---|---|
| private boolean skipControlChars(ByteBuf buffer, int readableBytes, int readerIndex) | |
HttpObjectDecoder.
Internal use only.
| Modifier and Type | Field and Description |
|---|---|
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. | |
| public static final HttpObjectDecoder. |
| Access | Constructor and Description |
|---|---|
| private |
| Modifier and Type | Method and Description |
|---|---|
| public static HttpObjectDecoder. | |
| public static HttpObjectDecoder. |
| BAD_MESSAGE | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_CHUNK_DELIMITER | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_CHUNK_FOOTER | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_CHUNK_SIZE | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_CHUNKED_CONTENT | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_FIXED_LENGTH_CONTENT | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_HEADER | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_INITIAL | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| READ_VARIABLE_LENGTH_CONTENT | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| SKIP_CONTROL_CHARS | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| UPGRADED | back to summary |
|---|---|
| public static final HttpObjectDecoder. | |
| State | back to summary |
|---|---|
| private State() | |
| valueOf | back to summary |
|---|---|
| public static HttpObjectDecoder. | |
| values | back to summary |
|---|---|
| public static HttpObjectDecoder. | |