HTTP request with invalid "Content-Type" header causes InvalidMimeTypeException and 500 response #1145
Comments
spring-projects-issues
added
the
status: waiting-for-triage
|
It looks like we're not handling a failure to parse the Content-Type header in I will make a change to turn it into |
rstoyanchev
changed the title
rstoyanchev
added
type: bug
|
Great, thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Thank you for this wonderful library!
Describe the bug
When a curl request with an invalid content-type header is made, spring boot servers with graphql java throw an InvalidMimeTypeException rather than just returning a 404 or similar. The resulting exception takes up a lot of space in log files. It would be nice if this were tunable or did not throw an exception particularly since the behavior in a spring boot rest server without graphql enabled is to return a 404 without throwing an exception.
This bug is similar to spring-projects/spring-boot#37118 and spring-projects/spring-framework#30979.
To Reproduce
curl -X POST http://localhost:8080/test/mimetype -H "Content-Type: <script>alert('XSS')</script>"{"timestamp":"xxx,"status":404,"error":"Not Found","path":"/test/mimetype"}%curl -X POST http://localhost:8080/test/mimetype -H "Content-Type: <script>alert('XSS')</script>"<!doctype html><html lang="en"><head><title>HTTP Status 500 – Internal Server Error</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 500 – Internal Server Error</h1></body></html>%Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed: org.springframework.http.InvalidMediaTypeException: Invalid mime type "<script>alert('XSS')</script>": Invalid token character '<' in token "<script>alert('XSS')<"] with root cause ...The text was updated successfully, but these errors were encountered: