Netty HTTP Framing Flaw: Conflict Between Transfer-Encoding and Content-Length Headers

漏洞概述 该提交修复了 HTTP/1.1 请求分帧（Transfer-Encoding framing）校验缺陷。在旧版 Netty 中， 头部的校验逻辑存在漏洞：当请求同时携带 和 头时，旧代码仅校验了 的合法性，但未校验 与 的兼容性，导致可能出现分帧解析错误。 影响范围 受影响组件： 及其子类（如 、 ）。 受影响版本：修复前的 Netty 版本（具体版本号需结合 Netty 发布历史确认，通常影响 4.1.x 系列）。 触发条件：HTTP/1.1 请求中同时包含 和 头，或 值非法（如非 、非 等）。 修复方案 1. 增强校验逻辑：在 中新增对 和 的联合校验，确保两者不冲突。 2. 新增方法： - ：校验 的最后一个值是否为 。 - ：校验 是否包含 。 - ：校验 是否为合法整数。 3. 异常处理：当校验失败时，抛出 或 ，明确提示错误原因。 POC/利用代码 ```java // 测试用例：非法 Transfer-Encoding 值 @Test public void testInvalidTransferEncoding() { String[] invalidTransferEncodings = { "Transfer-Encoding: chunked, identity\r\nContent-Length: 1\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chun

目標達成すべての支援者に感謝 — 100%達成しました！

Netty HTTP Framing Flaw: Conflict Between Transfer-Encoding and Content-Length Headers

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Netty HTTP Framing Flaw: Conflict Between Transfer-Encoding and Content-Length Headers

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！