From bf380d00ab62ccedcf5d7f32125bfbd4dd636d01 Mon Sep 17 00:00:00 2001
From: Matt Holt <mholt@users.noreply.github.com>
Date: Wed, 19 Jan 2022 13:44:09 -0700
Subject: caddyhttp: Reject absurd methods (#4538)

* caddyhttp: Reject absurdly long methods

* Limit method to 32 chars and truncate

* Just reject the request and debug-log it

* Log remote address
---
 modules/caddyhttp/server.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'modules/caddyhttp/server.go')

diff --git a/modules/caddyhttp/server.go b/modules/caddyhttp/server.go
index e302c36..964b2a4 100644
--- a/modules/caddyhttp/server.go
+++ b/modules/caddyhttp/server.go
@@ -150,6 +150,17 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// reject very long methods; probably a mistake or an attack
+	if len(r.Method) > 32 {
+		if s.shouldLogRequest(r) {
+			s.accessLogger.Debug("rejecting request with long method",
+				zap.String("method_trunc", r.Method[:32]),
+				zap.String("remote_addr", r.RemoteAddr))
+		}
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+
 	repl := caddy.NewReplacer()
 	r = PrepareRequest(r, repl, w, s)
 
-- 
cgit v1.2.3