Skip to content

Extra Header Validation#26115

Open
Pandrex247 wants to merge 1 commit into
eclipse-ee4j:mainfrom
Pandrex247:Extra-Header-Validation
Open

Extra Header Validation#26115
Pandrex247 wants to merge 1 commit into
eclipse-ee4j:mainfrom
Pandrex247:Extra-Header-Validation

Conversation

@Pandrex247

Copy link
Copy Markdown
Contributor

Signed-off-by: Andrew James Pielage <andrew.pielage@azul.com>
@OndroMih

OndroMih commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Hi @Pandrex247, which issue does this address? Grizzly should handle this already by ignoring Conten-tLength header if Transfer-Encoding header is present, as explained in eclipse-ee4j/glassfish-grizzly#2237 you linked. Is there a reason why GlassFish needs this validation on top of Grizzly and refuse requests with both headers instead of just ignoring the Content-Length header?

@Pandrex247

Copy link
Copy Markdown
Contributor Author

Grizzly itself does, but not necessarily Payara/GlassFish. This is stricter validation.
We had a reproducer very similar to one of the recent CVE fixes that Grizzly wasn't catching (I previously left a comment on the issue in GitLab)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants