disable TRACE method

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index 135208ef0eeaa99fa4f2bbc891c56266a7260a87..6d0f84877297d31da01e9e32fffffff63001eeaf 100644 (file)
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -146,6 +146,12 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
                         r->method = NGX_HTTP_MKCOL;
                     }
 
+                    if (m[0] == 'T' && m[1] == 'R'
+                        && m[2] == 'A' && m[3] == 'C' && m[4] == 'E')
+                    {
+                        r->method = NGX_HTTP_TRACE;
+                    }
+
                     break;
 
                 case 6:

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index afc1d644d16846a81effa48d06947c76fb7152c5..1a2e1bc27488698c079c45a757e9a9229c71e3b5 100644 (file)
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1267,6 +1267,13 @@ ngx_http_process_request_header(ngx_http_request_t *r)
         return NGX_ERROR;
     }
 
+    if (r->method & (NGX_HTTP_TRACE)) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent TRACE method");
+        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
+        return NGX_ERROR;
+    }
+
     if (r->headers_in.transfer_encoding
         && ngx_strstr(r->headers_in.transfer_encoding->value.data, "chunked"))
     {

diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
index 787b361552d1851448c8ef80f009adac768f44fc..939e16960da8841e4c46f552205994f135b3cc25 100644 (file)
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -37,6 +37,7 @@
 #define NGX_HTTP_PROPPATCH                 0x0800
 #define NGX_HTTP_LOCK                      0x1000
 #define NGX_HTTP_UNLOCK                    0x2000
+#define NGX_HTTP_TRACE                     0x4000
 
 #define NGX_HTTP_CONNECTION_CLOSE          1
 #define NGX_HTTP_CONNECTION_KEEP_ALIVE     2