Invalid host in request fails with Internal Server Error #12
Comments
|
I'm going to note that this is specific to mezzio-laminasrouter; I've tried this with mezzio-fastroute, and it works fine. The issue is with how laminas-http handles invalid hostnames. One workaround you can do for now is to create a middleware that you pipe after the existing declare(strict_types=1);
namespace App;
use Laminas\Http\Exception\InvalidArgumentException;
use Psr\Http\Message\ResponseFactoryInterface;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
class InvalidUriHostMiddleware implements MiddlewareInterface
{
public function __construct(private ResponseFactoryInterface $responseFactory) {}
public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
{
try {
return $handler->handle($request);
} catch (InvalidArgumentException $e) {
if (false === strpos($e->getMessage(), 'Invalid URI')) {
throw $e;
}
}
return $this->responseFactory->createResponse(400);
}
}Honestly, I'm unsure if this is something we can correct easily, because it would require router-specific logic in the error handler at this point to manage. We may need to just document the above solution. |
|
Moved to the relevant repo. |
|
@weierophinney I don't think this is a good idea as
What about catching this error in the middleware and simply handle it as no route matched? This would end up as a 404 not found. |
We could do it here in the |
This should work |
…-http
This patch adds a try/catch block within the `LaminasRouter::match()` method around the conversion of the PSR-7 request to a laminas-http request.
It catches laminas-http `InvalidArgumentException`s, and checks for a previous exception matching a laminas-http `InvalidUriPartException`.
When detected, it returns a `RouteResult` indicating a routing failure; otherwise, it rethrows the exception.
The patch is intended to fix scenarios where the Host header is invalid (e.g. `${ip}`), leading to creation of an invalid URI.
Fixes mezzio#12
Signed-off-by: Matthew Weier O'Phinney <[email protected]>
|
Thank you 👍 |
Bug Report
Summary
Requests with and invalid
Hostheader value end up in 500 Internal Server Error.As it's not a valid request the response should be 400 Bad Request.
At our company we get an alert for 5xx errors and so we are getting alerted each time someone send invalid requests like this:
Current behavior
Thrown
Laminas\Uri\Exception\InvalidUriPartExceptionwill be catched by theErrorHandlermiddleware and returns a 500 Internal Server Error.How to reproduce
Provide a request with invalid
Hostheader value.Expected behavior
The exception should be catched within the
Mezzio\Router\Middleware\RouteMiddlewareand a 400 Bad Request should be returned.The text was updated successfully, but these errors were encountered: