feat(http/1): rejects request with non-integer or negative content le…

…ngths

nomad/http1.ml

@@ -137,7 +137,7 @@ exception Bad_port
 exception Path_missing_leading_slash
 exception Uri_too_long
 exception Bad_request
-exception Unmatched_content_headers
+exception Invalid_content_header
 
 let pp_err _fmt _ = ()
 
@@ -148,7 +148,7 @@ let handle_connection _conn state =
   Logger.info (fun f -> f "switched to http1");
   Continue state
 
-module Int64Set = Set.Make (Int64)
+module StringSet = Set.Make (String)
 
 (* TODO(@leostera): move this to Trail.Request.content_length *)
 let content_length headers =
@@ -157,12 +157,12 @@ let content_length headers =
   | Some value -> (
       let values =
         String.split_on_char ',' value
-        |> List.map String.trim |> List.map Int64.of_string |> Int64Set.of_list
-        |> Int64Set.to_list
+        |> List.map String.trim |> StringSet.of_list |> StringSet.to_list
+        |> List.map Int64.of_string_opt
       in
       match values with
-      | [ first ] -> Some (first |> Int64.to_int)
-      | _ :: _ -> raise Unmatched_content_headers
+      | [ Some first ] when first > 0L -> Some (first |> Int64.to_int)
+      | _ :: _ -> raise Invalid_content_header
       | _ -> None)
 
 let rec read_body conn (req : Trail.Request.t) body =
@@ -270,7 +270,7 @@ let run_handler state conn req body =
   with
   | exception
       (( Bad_request | Bad_port | Path_missing_leading_slash
-       | Unmatched_content_headers ) as exn) ->
+       | Invalid_content_header ) as exn) ->
       Logger.error (fun f -> f "bad_request: %s" (Printexc.to_string exn));
       bad_request conn state
   | `HTTP_1_1, None, uri, body when Option.is_some (Uri.host uri) ->