search

ohler55 / agoo

A High Performance HTTP Server for Ruby
MIT License
912 stars 39 forks source link

Case insensitive Content-Type header #91

Closed inf1k closed 4 years ago

inf1k commented 4 years ago

Hello! Seems that Content-Type presence check in gqleval.c is not case insensitive.

Version v2.12.3 Steps to reproduce is simple, using example/graphql/hello.rb

curl -X POST http://localhost:6464/graphql -H 'Content-Length: 0' -H 'content-type: application/json'

This will respond with:

{"errors":[{"message":"required Content-Type not in the HTTP header","code":"type error","timestamp":"2020-07-03T20:40:39.290845000Z"}]}

According to RFC 7230:

Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading whitespace, the field value, and optional trailing whitespace.

https://github.com/ohler55/agoo/blob/develop/ext/agoo/gqleval.c#L550 https://github.com/ohler55/agoo/blob/develop/ext/agoo/req.c#L141

I've tried to fix this issue with including strings.h and replacing strncmp with strncasecmp in req.c file, so, whenever header value will be taken with this function, it will search case-insensitive. At first look it works. But I have no such experience with C, ruby extensions, and agoo source code to allow myself to submit PR with this changes.

Regards, Alex.

ohler55 commented 4 years ago

I'll get that fixed this weekend.

ohler55 commented 4 years ago

I think you know more C than you let on. Your suggestion was exactly correct. I also updated a few other places where it made sense not to be check the case. The branch is case-insensitive-headers. Let me know if it works for you and I make a release.

inf1k commented 4 years ago

At first look, it works. Thanks!

ohler55 commented 4 years ago

Great, I'll release today.