Requests with no final slash in rawurl are causing server to stop responding

[tomazv]

One of our customers has reported an issue where our server stops responding after a while. After some troubleshooting we found out, that for some http requests an exception is thrown when creating instance of Request class from request context. This causes server to stop responding after a few such requests and needs to be restarted.

This is the exception:

System.ArgumentException: Offset and length were out of bounds for the array or count is greater than the number of elements from index to the end of the source collection. at System.ArraySegment`1..ctor(T[] array, Int32 offset, Int32 count) at Microsoft.Net.Http.Server.RawUrlHelper.GetPath(Byte[] raw) at Microsoft.Net.Http.Server.RequestUriBuilder.DecodeAndUnescapePath(Byte[] rawUrlBytes) at Microsoft.Net.Http.Server.Request..ctor(RequestContext requestContext, NativeRequestContext nativeRequestContext) at Microsoft.Net.Http.Server.RequestContext..ctor(WebListener server, NativeRequestContext memoryBlob) at Microsoft.Net.Http.Server.AsyncAcceptContext.IOCompleted(AsyncAcceptContext asyncResult, UInt32 errorCode, UInt32 numBytes) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.AspNetCore.Server.WebListener.MessagePump.d__23.MoveNext()

This occurs because method call NativeRequestContext.GetRawUrlInBytes() returns absolute url with no final slash ("http://www.bing.com") for some requests. This causes exception to be thrown in the next line when trying to decode url path.

[Tratcher]

What does a Fiddler trace of that request look like? Something like this? GET / HTTP/1.1 Host: www.bing.com

[tomazv]

The request comes in every few hours and I don't even know which client it comes from. Is there a simple way to enable logging of incoming requests so I could take a look at headers and origin IP? I don't have full access to the server, so I would need to send instructions to my customer on how to enable logging.

[Tratcher]

It's failing while trying to construct the request so it's not able to log it at this layer. The only logs before this that might help would be down a layer in Http.Sys via ETW: https://blogs.msdn.microsoft.com/wndp/2007/01/18/event-tracing-in-http-sys-part-1-capturing-a-trace/

[freeman42x]

@Tratcher The Azure trial expired for the VM the issue was happening on. So I can not reproduce it anymore. Also, I can't figure out which VM template I used for it - it is not obvious where to find that in the portal :/

[tomazv]

I think this line in RawUrlHelper is causing the error:

if (pathStartIndex == -1)
{
    // e.g. for request lines like: 'GET http://myserver' (no final '/')
    pathStartIndex = raw.Length;
}

When returnig result it alwasy throws exception because it tries to return array segment beyond source array limit:

return new ArraySegment<byte>(raw, pathStartIndex, scan - pathStartIndex);

[jkotalik]

I just ran into this too @Tratcher . I'll make a fix for this now. @tomazv found exactly where there is an error.

[jkotalik]

@Tratcher @JunTaoLuo @Eilon this may be patch worthy.