From: Maxim Dounin <mdounin@mdounin.ru>
Date: Mon, 28 Jun 2021 15:01:00 +0000 (+0300)
Subject: Moved TRACE method rejection to a better place.
X-Git-Tag: release-1.21.1~12
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=d9c1d1bae7ae2c83fb65ca00a47ad6c1199a691e;p=nginx.git

Moved TRACE method rejection to a better place.

Previously, TRACE requests were rejected before parsing Transfer-Encoding.
This is not important since keepalive is not enabled at this point anyway,
though rejecting such requests after properly parsing other headers is
less likely to cause issues in case of further code changes.
---

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 0bb122ce0..b908e2941 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1980,13 +1980,6 @@ ngx_http_process_request_header(ngx_http_request_t *r)
         }
     }
 
-    if (r->method == NGX_HTTP_TRACE) {
-        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
-                      "client sent TRACE method");
-        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
-        return NGX_ERROR;
-    }
-
     if (r->headers_in.transfer_encoding) {
         if (r->headers_in.transfer_encoding->value.len == 7
             && ngx_strncasecmp(r->headers_in.transfer_encoding->value.data,
@@ -2013,6 +2006,13 @@ ngx_http_process_request_header(ngx_http_request_t *r)
         }
     }
 
+    if (r->method == NGX_HTTP_TRACE) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent TRACE method");
+        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
+        return NGX_ERROR;
+    }
+
     return NGX_OK;
 }