HTTPCORE-756: server-side request / response protocol conformance che…

…cks (#434)

httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/H2Processors.java

@@ -29,8 +29,10 @@
 import org.apache.hc.core5.http.impl.HttpProcessors;
 import org.apache.hc.core5.http.protocol.HttpProcessor;
 import org.apache.hc.core5.http.protocol.HttpProcessorBuilder;
+import org.apache.hc.core5.http.protocol.RequestConformance;
 import org.apache.hc.core5.http.protocol.RequestExpectContinue;
 import org.apache.hc.core5.http.protocol.RequestUserAgent;
+import org.apache.hc.core5.http.protocol.ResponseConformance;
 import org.apache.hc.core5.http.protocol.ResponseDate;
 import org.apache.hc.core5.http.protocol.ResponseServer;
 import org.apache.hc.core5.http2.protocol.H2RequestConnControl;
@@ -52,13 +54,15 @@ public final class H2Processors {
     public static HttpProcessorBuilder customServer(final String serverInfo) {
         return HttpProcessorBuilder.create()
                 .addAll(
-                        new ResponseDate(),
+                        ResponseConformance.INSTANCE,
+                        ResponseDate.INSTANCE,
                         new ResponseServer(!TextUtils.isBlank(serverInfo) ? serverInfo :
                                 VersionInfo.getSoftwareInfo(SOFTWARE, "org.apache.hc.core5", H2Processors.class)),
                         H2ResponseContent.INSTANCE,
                         H2ResponseConnControl.INSTANCE)
                 .addAll(
-                        H2RequestValidateHost.INSTANCE);
+                        H2RequestValidateHost.INSTANCE,
+                        RequestConformance.INSTANCE);
     }
 
     public static HttpProcessor server(final String serverInfo) {

httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ServerH2StreamHandler.java

@@ -123,7 +123,6 @@ public void sendInformation(final HttpResponse response, final HttpContext httpC
             @Override
             public void sendResponse(
                     final HttpResponse response, final EntityDetails responseEntityDetails, final HttpContext httpContext) throws HttpException, IOException {
-                ServerSupport.validateResponse(response, responseEntityDetails);
                 commitResponse(response, responseEntityDetails);
             }
 

httpcore5/src/main/java/org/apache/hc/core5/http/impl/HttpProcessors.java

@@ -28,12 +28,14 @@
 
 import org.apache.hc.core5.http.protocol.HttpProcessor;
 import org.apache.hc.core5.http.protocol.HttpProcessorBuilder;
+import org.apache.hc.core5.http.protocol.RequestConformance;
 import org.apache.hc.core5.http.protocol.RequestConnControl;
 import org.apache.hc.core5.http.protocol.RequestContent;
 import org.apache.hc.core5.http.protocol.RequestExpectContinue;
 import org.apache.hc.core5.http.protocol.RequestTargetHost;
 import org.apache.hc.core5.http.protocol.RequestUserAgent;
 import org.apache.hc.core5.http.protocol.RequestValidateHost;
+import org.apache.hc.core5.http.protocol.ResponseConformance;
 import org.apache.hc.core5.http.protocol.ResponseConnControl;
 import org.apache.hc.core5.http.protocol.ResponseContent;
 import org.apache.hc.core5.http.protocol.ResponseDate;
@@ -60,13 +62,15 @@ public final class HttpProcessors {
     public static HttpProcessorBuilder customServer(final String serverInfo) {
         return HttpProcessorBuilder.create()
                 .addAll(
-                        new ResponseDate(),
+                        ResponseConformance.INSTANCE,
+                        ResponseDate.INSTANCE,
                         new ResponseServer(!TextUtils.isBlank(serverInfo) ? serverInfo :
                                 VersionInfo.getSoftwareInfo(SOFTWARE, "org.apache.hc.core5", HttpProcessors.class)),
-                        new ResponseContent(),
-                        new ResponseConnControl())
+                        ResponseContent.INSTANCE,
+                        ResponseConnControl.INSTANCE)
                 .addAll(
-                        new RequestValidateHost());
+                        RequestValidateHost.INSTANCE,
+                        RequestConformance.INSTANCE);
     }
 
     /**

httpcore5/src/main/java/org/apache/hc/core5/http/impl/ServerSupport.java

@@ -27,9 +27,6 @@
 package org.apache.hc.core5.http.impl;
 
 import org.apache.hc.core5.annotation.Internal;
-import org.apache.hc.core5.http.EntityDetails;
-import org.apache.hc.core5.http.HttpException;
-import org.apache.hc.core5.http.HttpResponse;
 import org.apache.hc.core5.http.HttpStatus;
 import org.apache.hc.core5.http.MethodNotSupportedException;
 import org.apache.hc.core5.http.MisdirectedRequestException;
@@ -46,19 +43,6 @@
 @Internal
 public class ServerSupport {
 
-    public static void validateResponse(
-            final HttpResponse response,
-            final EntityDetails responseEntityDetails) throws HttpException {
-        final int status = response.getCode();
-        switch (status) {
-            case HttpStatus.SC_NO_CONTENT:
-            case HttpStatus.SC_NOT_MODIFIED:
-                if (responseEntityDetails != null) {
-                    throw new HttpException("Response " + status + " must not enclose an entity");
-                }
-        }
-    }
-
     public static String toErrorMessage(final Exception ex) {
         final String message = ex.getMessage();
         return message != null ? message : ex.toString();

httpcore5/src/main/java/org/apache/hc/core5/http/impl/io/HttpService.java

@@ -215,7 +215,6 @@ public void submitResponse(final ClassicHttpResponse response) throws HttpExcept
                         if (transportVersion != null && transportVersion.greaterEquals(HttpVersion.HTTP_2)) {
                             throw new UnsupportedHttpVersionException(transportVersion);
                         }
-                        ServerSupport.validateResponse(response, response.getEntity());
                         context.setProtocolVersion(transportVersion != null ? transportVersion : HttpVersion.HTTP_1_1);
                         context.setAttribute(HttpCoreContext.HTTP_RESPONSE, response);
                         processor.process(response, response.getEntity(), context);

httpcore5/src/main/java/org/apache/hc/core5/http/impl/nio/ServerHttp1StreamHandler.java

@@ -125,7 +125,6 @@ public void sendInformation(final HttpResponse response, final HttpContext httpC
             @Override
             public void sendResponse(
                     final HttpResponse response, final EntityDetails responseEntityDetails, final HttpContext httpContext) throws HttpException, IOException {
-                ServerSupport.validateResponse(response, responseEntityDetails);
                 commitResponse(response, responseEntityDetails);
             }
 

httpcore5/src/main/java/org/apache/hc/core5/http/protocol/RequestConformance.java

@@ -0,0 +1,79 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.core5.http.protocol;
+
+import java.io.IOException;
+
+import org.apache.hc.core5.annotation.Contract;
+import org.apache.hc.core5.annotation.ThreadingBehavior;
+import org.apache.hc.core5.http.EntityDetails;
+import org.apache.hc.core5.http.HttpException;
+import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.HttpRequestInterceptor;
+import org.apache.hc.core5.http.ProtocolException;
+import org.apache.hc.core5.http.URIScheme;
+import org.apache.hc.core5.net.URIAuthority;
+import org.apache.hc.core5.util.Args;
+import org.apache.hc.core5.util.TextUtils;
+
+/**
+ * ResponseConformance is responsible for making the protocol conformance checks
+ * of incoming request messages.
+ *
+ * @since 5.3
+ */
+@Contract(threading = ThreadingBehavior.IMMUTABLE)
+public class RequestConformance implements HttpRequestInterceptor {
+
+    public static final RequestConformance INSTANCE = new RequestConformance();
+
+    public RequestConformance() {
+        super();
+    }
+
+    @Override
+    public void process(final HttpRequest request, final EntityDetails entity, final HttpContext context)
+            throws HttpException, IOException {
+        Args.notNull(request, "HTTP request");
+
+        if (TextUtils.isBlank(request.getScheme())) {
+            throw new ProtocolException("Request scheme is not set");
+        }
+        if (TextUtils.isBlank(request.getPath())) {
+            throw new ProtocolException("Request path is not set");
+        }
+        final URIAuthority authority = request.getAuthority();
+        if (authority != null && (URIScheme.HTTP.same(request.getScheme()) || URIScheme.HTTPS.same(request.getScheme()))) {
+            final String hostName = authority.getHostName();
+            if (TextUtils.isBlank(hostName)) {
+                throw new ProtocolException("Request host is empty");
+            }
+        }
+    }
+
+}

httpcore5/src/main/java/org/apache/hc/core5/http/protocol/RequestValidateHost.java

@@ -54,6 +54,8 @@
 @Contract(threading = ThreadingBehavior.IMMUTABLE)
 public class RequestValidateHost implements HttpRequestInterceptor {
 
+    public static final RequestValidateHost INSTANCE = new RequestValidateHost();
+
     public RequestValidateHost() {
         super();
     }

httpcore5/src/main/java/org/apache/hc/core5/http/protocol/ResponseConformance.java

@@ -0,0 +1,71 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.core5.http.protocol;
+
+import java.io.IOException;
+
+import org.apache.hc.core5.annotation.Contract;
+import org.apache.hc.core5.annotation.ThreadingBehavior;
+import org.apache.hc.core5.http.EntityDetails;
+import org.apache.hc.core5.http.HttpException;
+import org.apache.hc.core5.http.HttpResponse;
+import org.apache.hc.core5.http.HttpResponseInterceptor;
+import org.apache.hc.core5.http.HttpStatus;
+import org.apache.hc.core5.http.ProtocolException;
+import org.apache.hc.core5.util.Args;
+
+/**
+ * ResponseConformance is responsible for making the protocol conformance checks
+ * of outgoing response messages.
+ *
+ * @since 5.3
+ */
+@Contract(threading = ThreadingBehavior.IMMUTABLE)
+public class ResponseConformance implements HttpResponseInterceptor {
+
+    public static final ResponseConformance INSTANCE = new ResponseConformance();
+
+    public ResponseConformance() {
+        super();
+    }
+
+    @Override
+    public void process(final HttpResponse response, final EntityDetails entity, final HttpContext context)
+            throws HttpException, IOException {
+        Args.notNull(response, "HTTP response");
+        final int status = response.getCode();
+        switch (status) {
+            case HttpStatus.SC_NO_CONTENT:
+            case HttpStatus.SC_NOT_MODIFIED:
+                if (entity != null) {
+                    throw new ProtocolException("Response " + status + " must not enclose an entity");
+                }
+        }
+    }
+
+}

httpcore5/src/main/java/org/apache/hc/core5/http/protocol/ResponseConnControl.java

@@ -57,6 +57,8 @@
 @Contract(threading = ThreadingBehavior.IMMUTABLE)
 public class ResponseConnControl implements HttpResponseInterceptor {
 
+    public static final ResponseConnControl INSTANCE = new ResponseConnControl();
+
     public ResponseConnControl() {
         super();
     }

httpcore5/src/main/java/org/apache/hc/core5/http/protocol/ResponseContent.java

@@ -57,6 +57,8 @@
 @Contract(threading = ThreadingBehavior.IMMUTABLE)
 public class ResponseContent implements HttpResponseInterceptor {
 
+    public static final ResponseContent INSTANCE = new ResponseContent();
+
     private final boolean overwrite;
 
     /**

httpcore5/src/main/java/org/apache/hc/core5/http/protocol/ResponseDate.java

@@ -49,6 +49,8 @@
 @Contract(threading = ThreadingBehavior.SAFE)
 public class ResponseDate implements HttpResponseInterceptor {
 
+    public static final ResponseDate INSTANCE = new ResponseDate();
+
     public ResponseDate() {
         super();
     }

httpcore5/src/test/java/org/apache/hc/core5/http/protocol/TestStandardInterceptors.java

@@ -1009,4 +1009,87 @@ public void testRequestHttp11MultipleHostHeaders() throws Exception {
         Assertions.assertThrows(ProtocolException.class, () ->
                 interceptor.process(request, request.getEntity(), context));
     }
+
+    @Test
+    public void testRequestConformance() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final BasicClassicHttpRequest request = new BasicClassicHttpRequest(Method.GET, "/");
+        request.setScheme("http");
+        request.setAuthority(new URIAuthority("somehost", 8888));
+        request.setPath("/path");
+        final RequestConformance interceptor = new RequestConformance();
+        interceptor.process(request, request.getEntity(), context);
+    }
+
+    @Test
+    public void testRequestConformanceSchemeMissing() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final BasicClassicHttpRequest request = new BasicClassicHttpRequest(Method.GET, "/");
+        request.setAuthority(new URIAuthority("somehost", 8888));
+        request.setPath("/path");
+        final RequestConformance interceptor = new RequestConformance();
+        Assertions.assertThrows(ProtocolException.class, () ->
+                interceptor.process(request, request.getEntity(), context));
+    }
+
+    @Test
+    public void testRequestConformancePathMissing() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final BasicClassicHttpRequest request = new BasicClassicHttpRequest(Method.GET, "/");
+        request.setScheme("http");
+        request.setAuthority(new URIAuthority("somehost", 8888));
+        request.setPath("");
+        final RequestConformance interceptor = new RequestConformance();
+        Assertions.assertThrows(ProtocolException.class, () ->
+                interceptor.process(request, request.getEntity(), context));
+    }
+
+    @Test
+    public void testRequestConformanceHostMissing() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final BasicClassicHttpRequest request = new BasicClassicHttpRequest(Method.GET, "/");
+        request.setScheme("http");
+        request.setAuthority(new URIAuthority("", -1));
+        request.setPath("/path");
+        final RequestConformance interceptor = new RequestConformance();
+        Assertions.assertThrows(ProtocolException.class, () ->
+                interceptor.process(request, request.getEntity(), context));
+    }
+
+    @Test
+    public void testResponseConformanceNoContent() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final ClassicHttpResponse response = new BasicClassicHttpResponse(HttpStatus.SC_NO_CONTENT, "No Content");
+        final ResponseConformance interceptor = new ResponseConformance();
+        interceptor.process(response, response.getEntity(), context);
+    }
+
+    @Test
+    public void testResponseConformanceNotModified() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final ClassicHttpResponse response = new BasicClassicHttpResponse(HttpStatus.SC_NOT_MODIFIED, "Not Modified");
+        final ResponseConformance interceptor = new ResponseConformance();
+        interceptor.process(response, response.getEntity(), context);
+    }
+
+    @Test
+    public void testResponseConformanceNoContentWithEntity() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final ClassicHttpResponse response = new BasicClassicHttpResponse(HttpStatus.SC_NO_CONTENT, "No Content");
+        response.setEntity(new StringEntity("stuff"));
+        final ResponseConformance interceptor = new ResponseConformance();
+        Assertions.assertThrows(ProtocolException.class, () ->
+            interceptor.process(response, response.getEntity(), context));
+    }
+
+    @Test
+    public void testResponseConformanceNotModifiedWithEntity() throws Exception {
+        final HttpContext context = new BasicHttpContext(null);
+        final ClassicHttpResponse response = new BasicClassicHttpResponse(HttpStatus.SC_NOT_MODIFIED, "Not Modified");
+        response.setEntity(new StringEntity("stuff"));
+        final ResponseConformance interceptor = new ResponseConformance();
+        Assertions.assertThrows(ProtocolException.class, () ->
+            interceptor.process(response, response.getEntity(), context));
+    }
+
 }