Erlang Mailing Lists

Author Message

<  Erlang bugs mailing list  ~  Too strict HTTP Status Line parsing

Guest
Posted: Tue Jun 01, 2010 9:23 pm Reply with quote
Guest
Hello,

I've tried to use lhttpc library (http://bitbucket.org/etc/lhttpc) to fetch
a resource (http://www.qype.com/review/1376848) and got the following
error:

{{http_error,"HTTP/1.1 200\r\n"},
[{lhttpc_client,read_response,5},
{lhttpc_client,execute,8},
{lhttpc_client,request,9}]}

I've checked lhttpc source code and found out that to receive and parse an HTTP
response it uses _standard_ erlang module gen_tcp on a socket in
{packet, http} mode. So it looks like the {http_error,"HTTP/1.1 200\r\n"} error was
in fact generated by erlang's http packet parsing code.

I found the following code in packet_parse_http function from
erts/emulator/beam/packet_parser.c file:

...
p0 = ptr;
while (n && SP(ptr)) {
ptr++; n--;
}
if (ptr==p0) return -1;
...

As far as I understand "HTTP/1.1 200\r\n" line does not have any spaces
after the status code "200", and the function strips \r\n as a first step of
its operation. So the "while" cycle does not run and we get into the
"if (ptr==p0) branch" this basically leads to returning of
{http_error, "HTTP/1.1 200\r\n"} atom up to the call stack.

Strictly speaking this is not a bug in erlang, but I suppose it
should take a more relaxed approach to HTTP Status Line parsing
and not return http_error if an HTTP response Status Line does not have
a Reason-phrase part.

________________________________________________________________
erlang-bugs (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-bugs-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Tue Jun 01, 2010 9:49 pm Reply with quote
Guest
On Wed, Jun 02, 2010 at 01:22:29AM +0400, Alexander Zhuravlev wrote:
> Hello,
>
> I've tried to use lhttpc library (http://bitbucket.org/etc/lhttpc) to fetch
> a resource (http://www.qype.com/review/1376848) and got the following
> error:
>
> {{http_error,"HTTP/1.1 200\r\n"},
> [{lhttpc_client,read_response,5},
> {lhttpc_client,execute,8},
> {lhttpc_client,request,9}]}

Almost forgot, the error was reproduced with erlang R13B04:
Erlang R13B04 (erts-5.7.5) [source] [64-bit] [smp:2:2] [rq:2] [async-threads:0] [hipe] [kernel-poll:false]

lhttpc version 1.2.4

> I've checked lhttpc source code and found out that to receive and parse an HTTP
> response it uses _standard_ erlang module gen_tcp on a socket in
> {packet, http} mode. So it looks like the {http_error,"HTTP/1.1 200\r\n"} error was
> in fact generated by erlang's http packet parsing code.
>
> I found the following code in packet_parse_http function from
> erts/emulator/beam/packet_parser.c file:
>
> ...
> p0 = ptr;
> while (n && SP(ptr)) {
> ptr++; n--;
> }
> if (ptr==p0) return -1;
> ...
>
> As far as I understand "HTTP/1.1 200\r\n" line does not have any spaces
> after the status code "200", and the function strips \r\n as a first step of
> its operation. So the "while" cycle does not run and we get into the
> "if (ptr==p0) branch" this basically leads to returning of
> {http_error, "HTTP/1.1 200\r\n"} atom up to the call stack.
>
> Strictly speaking this is not a bug in erlang, but I suppose it
> should take a more relaxed approach to HTTP Status Line parsing
> and not return http_error if an HTTP response Status Line does not have
> a Reason-phrase part.
--
Alexander Zhuravlev

________________________________________________________________
erlang-bugs (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-bugs-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Wed Jun 02, 2010 10:10 am Reply with quote
Guest
Alexander Zhuravlev wrote:
> Hello,
>
> I've tried to use lhttpc library (http://bitbucket.org/etc/lhttpc) to fetch
> a resource (http://www.qype.com/review/1376848) and got the following
> error:
>
> {{http_error,"HTTP/1.1 200\r\n"},
> [{lhttpc_client,read_response,5},
> {lhttpc_client,execute,8},
> {lhttpc_client,request,9}]}
>
> I've checked lhttpc source code and found out that to receive and parse an HTTP
> response it uses _standard_ erlang module gen_tcp on a socket in
> {packet, http} mode. So it looks like the {http_error,"HTTP/1.1 200\r\n"} error was
> in fact generated by erlang's http packet parsing code.
>
> I found the following code in packet_parse_http function from
> erts/emulator/beam/packet_parser.c file:
>
> ...
> p0 = ptr;
> while (n && SP(ptr)) {
> ptr++; n--;
> }
> if (ptr==p0) return -1;
> ...
>
>
A change to

if (ptr==p0 && n>0) return -1;

would do it, right?

/Sverker, Erlang/OTP

> As far as I understand "HTTP/1.1 200\r\n" line does not have any spaces
> after the status code "200", and the function strips \r\n as a first step of
> its operation. So the "while" cycle does not run and we get into the
> "if (ptr==p0) branch" this basically leads to returning of
> {http_error, "HTTP/1.1 200\r\n"} atom up to the call stack.
>
> Strictly speaking this is not a bug in erlang, but I suppose it
> should take a more relaxed approach to HTTP Status Line parsing
> and not return http_error if an HTTP response Status Line does not have
> a Reason-phrase part.
>
> ________________________________________________________________
> erlang-bugs (at) erlang.org mailing list.
> See http://www.erlang.org/faq.html
> To unsubscribe; mailto:erlang-bugs-unsubscribe@erlang.org
>
>


________________________________________________________________
erlang-bugs (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-bugs-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Wed Jun 02, 2010 7:36 pm Reply with quote
Guest
On Wed, Jun 2, 2010 at 14:09, Sverker Eriksson <sverker@erix.ericsson.se> wrote:
> Alexander Zhuravlev wrote:
>>
>> Hello,
>>
>> I've tried to use lhttpc library (http://bitbucket.org/etc/lhttpc) to
>> fetch
>> a resource (http://www.qype.com/review/1376848) and got the following
>> error:
>>
>> {{http_error,"HTTP/1.1 200\r\n"},
>>
Guest
Posted: Thu Jun 03, 2010 9:39 am Reply with quote
Guest
Alexander Zhuravlev wrote:
> On Wed, Jun 2, 2010 at 14:09, Sverker Eriksson <sverker@erix.ericsson.se> wrote:
>
>> Alexander Zhuravlev wrote:
>>
>>> Hello,
>>>
>>> I've tried to use lhttpc library (http://bitbucket.org/etc/lhttpc) to
>>> fetch
>>> a resource (http://www.qype.com/review/1376848) and got the following
>>> error:
>>>
>>> {{http_error,"HTTP/1.1 200\r\n"},
>>> [{lhttpc_client,read_response,5},
>>> {lhttpc_client,execute,8},
>>> {lhttpc_client,request,9}]}
>>> I've checked lhttpc source code and found out that to receive and parse an
>>> HTTP
>>> response it uses _standard_ erlang module gen_tcp on a socket in
>>> {packet, http} mode. So it looks like the {http_error,"HTTP/1.1 200\r\n"}
>>> error was
>>> in fact generated by erlang's http packet parsing code.
>>>
>>> I found the following code in packet_parse_http function from
>>> erts/emulator/beam/packet_parser.c file:
>>>
>>> ...
>>> p0 = ptr;
>>> while (n && SP(ptr)) {
>>> ptr++; n--;
>>> }
>>> if (ptr==p0) return -1;
>>> ...
>>>
>>>
>>>
>> A change to
>>
>> if (ptr==p0 && n>0) return -1;
>>
>> would do it, right?
>>
>
> Yes, probably. But I suppose that fact that the string does not have a
> phrase string may cause
> other issues with this call in the packet_parse_http function:
>
> return pcb->http_response(arg, major, minor, status,
> ptr, n);
>
> ptr will point to the end of the string and n will be equal to 0

No, that will work. You will get an empty phrase string as part of the
http_response-tuple.


/Sverker, Erlang/OTP


________________________________________________________________
erlang-bugs (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-bugs-unsubscribe@erlang.org

Post received from mailinglist

Display posts from previous:  

All times are GMT
Page 1 of 1
This forum is locked: you cannot post, reply to, or edit topics.

Jump to:  

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum