Currently, when the handler function is called and does not consume the whole request body (either due to an error or intended), the request body buffer will not be cleared (up to Content-Length bytes or its actual end).
This is especially a problem with Connection: keep-alive requests, as parsing the header line will start exactly where the callback function stopped consuming the body.
This should be changed to get the server more reliable, even if the callback function terminated unexpectedly.
The server will now drain the buffer and just print an error message to the log to notify the developer. Maybe this behavior has to be investigated in depth, as it might also be an alternative to close the connection as the handler clearly misbehaves here and that may be exploited in some way.
Activity
fhessel commented on Mar 26, 2018
The server will now drain the buffer and just print an error message to the log to notify the developer. Maybe this behavior has to be investigated in depth, as it might also be an alternative to close the connection as the handler clearly misbehaves here and that may be exploited in some way.