Merge pull request #409 from kachayev/fix-trace-body

A client MUST NOT send a message body in a TRACE request

Author: ztellman

src/aleph/http/client.clj

@@ -486,9 +486,22 @@
                         (not (.get (.headers req') "Proxy-Connection")))
                   (.set (.headers req') "Proxy-Connection" "Keep-Alive"))
 
-                (let [parts (:multipart req)
-                      [req' body] (if (nil? parts)
-                                    [req' (:body req)]
+                (let [body (:body req)
+                      parts (:multipart req)
+                      multipart? (some? parts)
+                      [req' body] (cond
+                                    ;; RFC #7231 4.3.8. TRACE
+                                    ;; A client MUST NOT send a message body...
+                                    (= :trace (:request-method req))
+                                    (do
+                                      (when (or (some? body) multipart?)
+                                        (log/warn "TRACE request body was omitted"))
+                                      [req' nil])
+
+                                    (not multipart?)
+                                    [req' body]
+
+                                    :else
                                     (multipart/encode-request req' parts))]
 
                   (when-let [save-message (get req :aleph/save-request-message)]

test/aleph/http_test.clj

@@ -343,6 +343,16 @@
          (let [rsp (http/get (str "http://localhost:" port) {:connection-pool pool})]
            (is (= http/default-response-executor (.executor rsp))))))))
 
+(defn echo-handler [req]
+  {:status 200
+   :body (:body req)})
+
+(deftest test-trace-request-omitted-body
+  (with-handler echo-handler
+    (is (= "" (-> @(http/trace (str "http://localhost:" port) {:body "REQUEST"})
+                  :body
+                  bs/to-string)))))
+
 ;;;
 
 (defn get-netty-client-event-threads []