Content length not stripped from body in chunked transfer-encoding mode for POST json

[lamyseba]

When phusion passenger receives a request in "chunked" mode, it does not strip out the content length infos from the body he is transmitting to the app.

In chunked mode, the requester does not send the content-length, instead it sends content split into packets, each packets beginning with its length information. The last packet must be empty and have a length of zero.

As of version 6.0.27, Phusion does not strip this length informations. So when Phusion Passenger receives a POST request with json content in chunked mode, the body it transmits to my ruby app looks like:

45
{
     "email": "email@email.com",
     "event": "unsubscribe"
     }
0

Where "45" and "0" are unexpected content-length informations that gets my app into trouble when trying to parse json. My app was a ruby rack application using roda routing toolkit.

A sample curl request to reproduce the bug:

curl -v \ 
     --url http://localhost/ \
     --header 'transfer-encoding: chunked' \
     --header 'content-length:' \
     --header 'content-type: application/json' \
     --data '{
     "email": "email@email.com",
     "event": "unsubscribe"
     }'

In my case, I needed to make the request two or three times with curl to have a real chunked mode request. The first time curl makes the request, it sends a "normal" request, with a content-length header, and no transfer-encoding header

[lamyseba]

Some relevant headers from the server I use in production receiving a json post request
"SERVER_SOFTWARE"=>"Apache/2.4.65 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 Phusion_Passenger/6.0.27", "SERVER_PROTOCOL"=>"HTTP/1.1", "CONTENT_TYPE"=>"application/json", "HTTP_TRANSFER_ENCODING"=>"chunked"

[CamJN]

Starting to look into this. Repro command can be simplified to:
curl -v --url 'http://localhost:8080/' --header 'transfer-encoding: chunked' --json '{ "email": "email@email.com", "event": "unsubscribe" }'

to see body of request from curl I can listen with nc before doing the request:

 $ nc -l 8080
POST /echo HTTP/1.1
Host: localhost:8080
User-Agent: curl/8.7.1
transfer-encoding: chunked
Content-Type: application/json
Accept: application/json

36
{ "email": "email@email.com", "event": "unsubscribe" }
0

I can reproduce this issue with the builtin engine but not the nginx engine.

I can reproduce this all the way back to at least passenger 6.0.20.

[CamJN]

@lamyseba You said: As of version 6.0.27, Phusion does not strip this length informations., but my testing indicates this behaviour goes back even farther. Is there something I might be missing?

[CamJN]

I've also tested this with apache httpd on 6.0.27 through HEAD and it doesn't reproduce… only when using the builtin engine in standalone mode. Please set PassengerLogLevel to 7 in your httpd config and provide logs of a problem request.

[lamyseba]

@CamJN , I said "As of version 6.0.2.27" because this is the only version I have a simple access to. I think this behavior goes back even farther, and might still be present in current version, as this bug didn't seem to have been reported before. The Passenger I'm using is on a shared hosting. Not sure I can have access to better log details, I will try.

[CamJN]

Ah, the hosting provider might be putting passenger standalone behind apache httpd instead of using the apache module...