diff --git a/core/src/main/java/org/nanohttpd/protocols/http/HTTPSession.java b/core/src/main/java/org/nanohttpd/protocols/http/HTTPSession.java index 80456b06..1c537040 100644 --- a/core/src/main/java/org/nanohttpd/protocols/http/HTTPSession.java +++ b/core/src/main/java/org/nanohttpd/protocols/http/HTTPSession.java @@ -374,6 +374,10 @@ public void execute() throws IOException { read = this.inputStream.read(buf, this.rlen, HTTPSession.BUFSIZE - this.rlen); } + if(this.splitbyte == 0 && this.rlen == HTTPSession.BUFSIZE){ + throw new ResponseException(Status.BAD_REQUEST, "BAD REQUEST: Request header is too large."); + } + if (this.splitbyte < this.rlen) { this.inputStream.reset(); this.inputStream.skip(this.splitbyte); diff --git a/core/src/test/java/org/nanohttpd/junit/protocols/http/BadRequestTest.java b/core/src/test/java/org/nanohttpd/junit/protocols/http/BadRequestTest.java index 32d80975..8cbdd30b 100644 --- a/core/src/test/java/org/nanohttpd/junit/protocols/http/BadRequestTest.java +++ b/core/src/test/java/org/nanohttpd/junit/protocols/http/BadRequestTest.java @@ -8,18 +8,18 @@ * %% * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: - * + * * 1. Redistributions of source code must retain the above copyright notice, this * list of conditions and the following disclaimer. - * + * * 2. Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * 3. Neither the name of the nanohttpd nor the names of its contributors * may be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. @@ -33,11 +33,11 @@ * #L% */ +import org.junit.Test; + import java.io.ByteArrayOutputStream; import java.io.IOException; -import org.junit.Test; - public class BadRequestTest extends HttpServerTest { @Test @@ -67,4 +67,17 @@ public void testMissingURI() throws IOException { assertResponse(outputStream, expected); } + @Test + public void testTooLargerURI() throws IOException { + StringBuilder request = new StringBuilder("GET http://example.com HTTP/1.1\r\n"); + for(int i = 0; i < 1000; i++){ + request.append("header"+i+": abcdefghijklmnopqrstuvwxyz\r\n"); + } + ByteArrayOutputStream outputStream = invokeServer(request.toString()); + String[] expected = new String[]{ + "HTTP/1.1 400 Bad Request" + }; + assertResponse(outputStream, expected); + } + }