From 278606c8806f704b205b15c1d5fcacc170d67c90 Mon Sep 17 00:00:00 2001 From: Trevor Turk Date: Sat, 1 Aug 2026 08:02:21 -0500 Subject: [PATCH] Respond with 414 when a request or header line exceeds the maximum line length. --- lib/async/http/protocol/http1/server.rb | 4 ++++ test/async/http/protocol/http11.rb | 17 +++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/lib/async/http/protocol/http1/server.rb b/lib/async/http/protocol/http1/server.rb index b2daaf6..1085eaa 100644 --- a/lib/async/http/protocol/http1/server.rb +++ b/lib/async/http/protocol/http1/server.rb @@ -61,6 +61,10 @@ def next_request end return request + rescue ::Protocol::HTTP1::LineLengthError + # We don't know whether the request line or a header line was too long, so we respond with the more common case (URI Too Long): + fail_request(414) + raise rescue ::Protocol::HTTP1::BadRequest fail_request(400) # Conceivably we could retry here, but we don't really know how bad the error is, so it's better to just fail: diff --git a/test/async/http/protocol/http11.rb b/test/async/http/protocol/http11.rb index e07afaf..9dbd02d 100755 --- a/test/async/http/protocol/http11.rb +++ b/test/async/http/protocol/http11.rb @@ -103,6 +103,23 @@ def around expect(response.status).to be == 400 end + + with "maximum line length" do + let(:maximum_line_length) {1024} + let(:protocol) {subject.new(maximum_line_length: maximum_line_length)} + + it "should fail with 414 when the request line is too long" do + response = client.get("/?q=#{"a" * maximum_line_length}") + + expect(response.status).to be == 414 + end + + it "should fail with 414 when a header line is too long" do + response = client.get("/", {"x-padding" => "a" * maximum_line_length}) + + expect(response.status).to be == 414 + end + end end with "head request" do