Bound the number of http headers and query parameters per message by chenBright · Pull Request #3524 · apache/brpc

chenBright · 2026-09-05T14:22:04Z

What problem does this PR solve?

Issue Number: resolve

Problem Summary:

CaseIgnoredHasher (headers) and DefaultHasher (query map) are both plain
result = result * 101 + c with no per-process seed, and FlatMap picks a
bucket by masking the low bits of the hash. An attacker only needs the low
log2(nbucket) bits to match, which is brute-forceable offline in seconds and
reusable against every process, since nothing is seeded.

Both maps then degrade to a single chain:

on_header_value() calls GetOrAddHeader() for every field, so each header
costs a linear scan of the chain built so far. The cost is on the lookup side
and is paid unconditionally on the parse hot path.
URI::ParseQueries() inserts through FlatMap::operator[], which walks the
chain to dedup. The cost is on the insert side.

Either one turns a single request into O(n^2) work in the server's IO path.
Nothing bounded n: h1 had no field-count limit at all, and h2's
max_header_list_size bounds the decoded bytes of a header block, not the
number of fields in it.

What is changed and the side effects?

Changed:

Tomcat's maxHeaderCount, Envoy's max_request_headers_count, PHP's
max_input_vars, Django's DATA_UPLOAD_MAX_NUMBER_FIELDS and
Tomcat 11's maxParameterCount, all of which were introduced as hashDoS
mitigations.

Therefore, two flags are introduced to bound the number of http headers and
query parameters per message:

-http_max_header_count (default 100), checked in
HttpMessage::on_header_value() for h1 and in
H2StreamContext::ConsumeHeaders() after AppendHeader() for h2.
-http_max_query_count (default 1000), checked in URI::SetHttpURL() for h1
and in URI::SetH2Path() for h2. It counts & separators rather than map
entries: the splitter walks every segment even when the keys repeat, and it is
that walk the limit is meant to bound.

Setting flag to 0 lifts the limit.

Side effects:

Performance effects:
Breaking backward compatibility:

Check List:

Please make sure your changes are compilable.
When providing us with a new feature, it is best to add related tests.
Please follow Contributor Covenant Code of Conduct.

Copilot

🟡 Changes recommended

It introduces an ABI-breaking public API change (URI::SetH2Path return type) that should be avoided or redesigned to preserve compatibility.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds HashDoS mitigations in bRPC’s HTTP parsing path by bounding the number of stored HTTP header entries and the number of query segments processed per message, and it introduces/extends unit tests to validate the new limits for both HTTP/1 and HTTP/2 parsing.

Changes:

Add http_max_header_count enforcement during HTTP/1 header parsing and HTTP/2 header consumption.
Add http_max_query_count enforcement for URL query parsing in both SetHttpURL and SetH2Path, with new tests for limit/disable behavior.
Add new unit tests covering over-limit cases for headers and queries, plus some minor test robustness adjustments.

File summaries

File	Description
test/brpc_uri_unittest.cpp	Adds unit tests for the new query-parameter count limit and disabled-limit behavior.
test/brpc_http_rpc_protocol_unittest.cpp	Adds HTTP/2 tests for header-count and `:path` query-count limits; minor assert/test robustness tweaks.
test/brpc_http_message_unittest.cpp	Adds HTTP/1 parsing tests for header-count limits and folding/non-folding behavior.
src/brpc/uri.h	Changes `URI::SetH2Path` API to return `int` and document failure via `status()`.
src/brpc/uri.cpp	Introduces `http_max_query_count` flag and enforces query segment limits in URL parsing.
src/brpc/socket.cpp	Initializes `_http_request_method` in `Socket::OnCreated`.
src/brpc/policy/http2_rpc_protocol.cpp	Enforces header-count limit in HTTP/2 and handles `SetH2Path` failure.
src/brpc/details/http_message.cpp	Introduces `http_max_header_count` flag and enforces it during HTTP/1 header parsing.

Review details

Files reviewed: 8/8 changed files
Comments generated: 2
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟡 Changes recommended

It introduces a source-breaking public API change (URI::SetH2Path) and the new HTTP/2 limit failures currently escalate to connection-level GOAWAY behavior rather than isolating the offending stream.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

src/brpc/uri.h:104

Changing URI::SetH2Path from void to int in a public header is a source-breaking API change for any downstream code that calls SetH2Path() and ignores a return value. Since the only new failure mode is already captured by URI::status(), consider keeping the original void signature and reporting errors via status() (or adding a new method with a different name that returns int) so existing callers keep compiling.

    // Returns 0 on success, -1 otherwise and status() is set.
    int SetH2Path(const char* h2_path);
    int SetH2Path(const std::string& path) { return SetH2Path(path.c_str()); }

Files reviewed: 8/8 changed files
Comments generated: 1
Review effort level: Lite

Copilot

🟢 Approval recommended

The limits are enforced in the intended hot paths with appropriate HTTP/2 stream-level rejection semantics and are backed by focused unit tests for both H1 and H2 behaviors.

Review details

Files reviewed: 9/9 changed files
Comments generated: 0 new
Review effort level: Lite

chenBright · 2026-09-07T03:36:15Z

Rebase master to resolve conflict.

Copilot

🟢 Approval recommended

The new limits are enforced in both HTTP/1 and HTTP/2 hot paths with targeted unit tests validating acceptance/rejection behavior and correct per-stream (not per-connection) handling for HTTP/2.

Review details

Files reviewed: 9/9 changed files
Comments generated: 0 new
Review effort level: Lite

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

+    // Returns 0 on success, -1 otherwise and status() is set.
+    int SetH2Path(const char* h2_path);
+    int SetH2Path(const std::string& path) { return SetH2Path(path.c_str()); }


+void AppendLiteralHeader(butil::IOBuf* out, const std::string& name,
+                         const std::string& value, uint8_t first_octet = 0x00) {
+    ASSERT_LT(name.size(), 0x80u);
+    ASSERT_LT(value.size(), 0x80u);
+    uint8_t prefix[] = { first_octet, (uint8_t)name.size() };
+    out->append(prefix, sizeof(prefix));
+    out->append(name);
+    uint8_t value_len = (uint8_t)value.size();
+    out->append(&value_len, 1);
+    out->append(value);
+}


+    brpc::policy::H2FrameHead head;
+    head.payload_size = payload.size();
+    head.type = brpc::policy::H2_FRAME_HEADERS;
+    head.flags = 0x4;  // H2_FLAGS_END_HEADERS
+    head.stream_id = stream_id;


Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

-    void SetH2Path(const std::string& path) { SetH2Path(path.c_str()); }
+    // Returns 0 on success, -1 otherwise and status() is set.
+    int SetH2Path(const char* h2_path);
+    int SetH2Path(const std::string& path) { return SetH2Path(path.c_str()); }


+        if (FLAGS_http_max_header_count > 0 &&
+            header.HeaderCount() > FLAGS_http_max_header_count) {
+            LOG(ERROR) << "Too many headers, max="
+                       << FLAGS_http_max_header_count;
+            return -1;
+        }


+// Literal header field with a new name, with both lengths in a single 7-bit
+// prefix octet. `first_octet` selects the representation: 0x00 is "without
+// indexing" (RFC 7541 6.2.2), 0x40 is "with incremental indexing" (6.2.1)
+// which also adds the field to the dynamic table.
+// 0x80 of a length octet is the Huffman flag and a length of 128 or more needs
+// the multi-octet form, so refuse what does not fit instead of emitting a
+// corrupt header block.
+void AppendLiteralHeader(butil::IOBuf* out, const std::string& name,
+                         const std::string& value, uint8_t first_octet = 0x00) {
+    ASSERT_LT(name.size(), 0x80u);
+    ASSERT_LT(value.size(), 0x80u);
+    uint8_t prefix[] = { first_octet, (uint8_t)name.size() };
+    out->append(prefix, sizeof(prefix));
+    out->append(name);
+    uint8_t value_len = (uint8_t)value.size();
+    out->append(&value_len, 1);
+    out->append(value);
+}


    _unwritten_bytes.store(0, butil::memory_order_relaxed);
    _keepalive_options = options.keepalive_options;
    _tcp_user_timeout_ms = options.tcp_user_timeout_ms;
+    _http_request_method = HTTP_METHOD_GET;


 namespace brpc {

+DEFINE_uint32(http_max_query_count, 1000,
+              "Reject an URL carrying more than so many query parameters. "


chenBright force-pushed the fix_http_header_query branch from b358a46 to 3d0c834 Compare September 5, 2026 16:55

wwbmmm requested a lite review from Copilot September 6, 2026 05:39

Copilot started reviewing on behalf of wwbmmm September 6, 2026 05:40 View session

Copilot AI reviewed Sep 6, 2026

View reviewed changes

Comment thread src/brpc/uri.h

Comment thread test/brpc_http_rpc_protocol_unittest.cpp

chenBright force-pushed the fix_http_header_query branch from 3d0c834 to 307d21d Compare September 6, 2026 07:29

chenBright requested a lite review from Copilot September 6, 2026 07:30

Copilot started reviewing on behalf of chenBright September 6, 2026 07:30 View session

Copilot AI reviewed Sep 6, 2026

View reviewed changes

Comment thread src/brpc/policy/http2_rpc_protocol.cpp Outdated

chenBright force-pushed the fix_http_header_query branch from 307d21d to 633a4fd Compare September 7, 2026 03:12

wwbmmm requested a lite review from Copilot September 7, 2026 03:21

Copilot started reviewing on behalf of wwbmmm September 7, 2026 03:21 View session

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Bound the number of http headers and query parameters per message

01ebac6

chenBright force-pushed the fix_http_header_query branch from 633a4fd to 01ebac6 Compare September 7, 2026 03:35

wwbmmm requested a lite review from Copilot September 7, 2026 13:29

Copilot started reviewing on behalf of wwbmmm September 7, 2026 13:36 View session

Copilot AI reviewed Sep 7, 2026

View reviewed changes

wwbmmm requested a lite review from Copilot September 7, 2026 14:33

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Copilot started reviewing on behalf of wwbmmm September 7, 2026 15:01 View session

wwbmmm requested a lite review from Copilot September 7, 2026 16:35

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Copilot started reviewing on behalf of wwbmmm September 7, 2026 16:54 View session

Navigation Menu

Uh oh!

Bound the number of http headers and query parameters per message - #3524

Bound the number of http headers and query parameters per message#3524
chenBright wants to merge 1 commit into
apache:masterfrom
chenBright:fix_http_header_query

chenBright commented Sep 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

chenBright commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

chenBright commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this PR solve?

What is changed and the side effects?

Check List:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

chenBright commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chenBright commented Sep 5, 2026 •

edited

Loading