fix: enforce the request-smuggling (CL.TE) check at the proxy chokepoint (#598)

* fix: enforce CL.TE smuggling check at the proxy chokepoint, drop broken CL.0 body-read (#14)

* fix: enforce HTTP/1.x request-smuggling checks at the proxy chokepoint

The CL.0/CL.TE check lived inside StandardEndpointMapper, so custom or test
mappers bypassed it; the CL.0 body-read also blocked the event loop without
ever catching the smuggle, since the decoder splits CL:0 + trailing bytes
into two pipelined requests. Run the check before map() and use a per-
connection taint flag to reject the next request after a Content-Length: 0.

* revert: drop the per-connection CL.0 taint

A legitimate Content-Length: 0 request followed by another request on the
same keep-alive connection is routine (CORS preflight, empty-body POSTs,
HEAD/DELETE/OPTIONS), so tainting the connection caused collateral 400s on
normal flows. The proxy layer cannot reliably distinguish a pipelined-burst
smuggle from sequential keep-alive reuse without channel-buffer inspection,
so keep only the header-only CL.TE check and accept that pure CL.0 smuggling
is not addressed at this layer.

* fix: smuggling check runs before filters can mutate CL/TE

Move the rejectAsSmuggling decision above the filter loop in processRequest
so a user-supplied request filter that strips or rewrites Content-Length or
Transfer-Encoding cannot bypass the check. The smuggling boolean is captured
on the raw inbound headers; filters and the mapper run as before.

* fix: reject detected smuggling before the filter chain, not just the mapper

A request flagged as CL.TE smuggling was still run through every request filter
before being mapped to a 400. Short-circuit to MapResult.badRequest() so a
detected attack skips both the filters and the mapper. Detection still runs on
the raw inbound headers first (in the if-condition), so a filter cannot mask it.

Author: NiccoMlt

carapace-server/src/main/java/org/carapaceproxy/core/ProxyRequestsManager.java

@@ -142,6 +142,15 @@ private static void addCustomResponseHeaders(final HttpHeaders responseHeaders,
         });
     }
 
+    private static boolean rejectAsSmuggling(ProxyRequest request) {
+        final HttpHeaders headers = request.getRequestHeaders();
+        if (headers.get(HttpHeaderNames.CONTENT_LENGTH) != null && headers.get(HttpHeaderNames.TRANSFER_ENCODING) != null) {
+            LOGGER.warn("Potential CL.TE request smuggling attack: both Content-Length and Transfer-Encoding present. Request: {}", request.getUri());
+            return true;
+        }
+        return false;
+    }
+
     private static void cleanRequestFromCacheValidators(ProxyRequest request) {
         HttpHeaders headers = request.getRequestHeaders();
         headers.remove(HttpHeaderNames.IF_MATCH);
@@ -209,10 +218,16 @@ public Publisher<Void> processRequest(ProxyRequest request) {
         request.setLastActivity(request.getStartTs());
         request.getRequestHeaders().set(HttpHeaderNames.SERVER, ServerHeaderRequestFilter.DEFAULT_SERVER);
 
-        parent.getFilters().forEach(filter -> filter.apply(request));
-
-        MapResult action = parent.getMapper().map(request);
-
+        // HTTP/1.x request-smuggling validation runs on the raw inbound headers, before any request filter
+        // or the mapper, so a filter that mutates Content-Length / Transfer-Encoding cannot bypass it.
+        // HTTP/2 framing is not vulnerable.
+        final MapResult action;
+        if (request.getHttpProtocol().majorVersion() < 2 && rejectAsSmuggling(request)) {
+            action = MapResult.badRequest();
+        } else {
+            parent.getFilters().forEach(filter -> filter.apply(request));
+            action = parent.getMapper().map(request);
+        }
         request.setAction(action);
 
         if (LOGGER.isTraceEnabled()) {

carapace-server/src/main/java/org/carapaceproxy/server/mapper/StandardEndpointMapper.java

@@ -26,8 +26,6 @@
 import com.google.common.net.HostAndPort;
 import com.google.common.net.InetAddresses;
 import com.google.common.net.InternetDomainName;
-import io.netty.handler.codec.http.HttpHeaderNames;
-import io.netty.handler.codec.http.HttpHeaders;
 import io.netty.handler.codec.http.HttpResponseStatus;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -149,30 +147,6 @@ public MapResult map(final ProxyRequest request) {
             return MapResult.badRequest();
         }
 
-        // CL.0 and CL.TE request smuggling validation
-        // HTTP/2 requests are not vulnerable to these attacks, so we only check HTTP/1.x
-        if (request.getHttpProtocol().majorVersion() < 2) {
-            HttpHeaders headers = request.getRequestHeaders();
-            String contentLength = headers.get(HttpHeaderNames.CONTENT_LENGTH);
-            String transferEncoding = headers.get(HttpHeaderNames.TRANSFER_ENCODING);
-
-            // Check for CL.TE attack: both Content-Length and Transfer-Encoding headers present
-            if (contentLength != null && transferEncoding != null) {
-                LOG.warn("Potential CL.TE request smuggling attack detected: both Content-Length and Transfer-Encoding headers present. Request: {}", request.getUri());
-                return MapResult.badRequest();
-            }
-
-            // Check for CL.0 attack: Content-Length: 0 but with body
-            if (contentLength != null && contentLength.trim().equals("0")) {
-                // It's OK to consume the string in the flux, as it should be empty anyway
-                final String body = request.getRequestData().asString().blockFirst();
-                if (body != null && !body.isEmpty()) {
-                    LOG.warn("Request with Content-Length: 0 but with body detected: {}", request.getUri());
-                    return MapResult.badRequest();
-                }
-            }
-        }
-
         for (final RouteConfiguration route : routes) {
             if (!route.isEnabled()) {
                 continue;