From 8ff2620dd996c64d27f3ec0b2f132234f7dbc957 Mon Sep 17 00:00:00 2001
From: byamthev <byamthev@gmail.com>
Date: Tue, 14 Nov 2017 13:42:18 +0200
Subject: [PATCH] [ZEPPELIN-3037] Configure Http Request Header Size Limit for
 Jetty

---
 conf/zeppelin-site.xml.template               |  9 +++
 .../zeppelin/conf/ZeppelinConfiguration.java  |  5 ++
 .../zeppelin/server/ZeppelinServer.java       | 17 +++--
 .../configuration/RequestHeaderSizeTest.java  | 66 +++++++++++++++++++
 .../conf/ZeppelinConfigurationTest.java       |  7 ++
 5 files changed, 97 insertions(+), 7 deletions(-)
 create mode 100644 zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java

diff --git a/conf/zeppelin-site.xml.template b/conf/zeppelin-site.xml.template
index 8a2a60e3bc8..55fce98780b 100755
--- a/conf/zeppelin-site.xml.template
+++ b/conf/zeppelin-site.xml.template
@@ -437,6 +437,15 @@
     <description>Hardcoding Application Server name to Prevent Fingerprinting</description>
 </property>
 -->
+
+<!--
+<property>
+    <name>zeppelin.server.jetty.request.header.size</name>
+    <value>8192</value>
+    <description>Http Request Header Size Limit (to prevent HTTP 413)</description>
+</property>
+-->
+
 <!--
 <property>
   <name>zeppelin.server.xframe.options</name>
diff --git a/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java b/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
index 1bc242d01b3..d72d7fc3527 100644
--- a/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
+++ b/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
@@ -525,6 +525,10 @@ public String getJettyName() {
     return getString(ConfVars.ZEPPELIN_SERVER_JETTY_NAME);
   }
 
+  public Integer getJettyRequestHeaderSize() {
+    return getInt(ConfVars.ZEPPELIN_SERVER_JETTY_REQUEST_HEADER_SIZE);
+  }
+
 
   public String getXFrameOptions() {
     return getString(ConfVars.ZEPPELIN_SERVER_XFRAME_OPTIONS);
@@ -702,6 +706,7 @@ public static enum ConfVars {
     ZEPPELIN_SERVER_DEFAULT_DIR_ALLOWED("zeppelin.server.default.dir.allowed", false),
     ZEPPELIN_SERVER_XFRAME_OPTIONS("zeppelin.server.xframe.options", "SAMEORIGIN"),
     ZEPPELIN_SERVER_JETTY_NAME("zeppelin.server.jetty.name", null),
+    ZEPPELIN_SERVER_JETTY_REQUEST_HEADER_SIZE("zeppelin.server.jetty.request.header.size", 8192),
     ZEPPELIN_SERVER_STRICT_TRANSPORT("zeppelin.server.strict.transport", "max-age=631138519"),
     ZEPPELIN_SERVER_X_XSS_PROTECTION("zeppelin.server.xxss.protection", "1"),
 
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java b/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
index f27bfbe27ef..0b66a437d5b 100644
--- a/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
+++ b/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
@@ -56,12 +56,7 @@
 import org.apache.zeppelin.user.Credentials;
 import org.apache.zeppelin.utils.SecurityUtils;
 import org.eclipse.jetty.http.HttpVersion;
-import org.eclipse.jetty.server.HttpConfiguration;
-import org.eclipse.jetty.server.HttpConnectionFactory;
-import org.eclipse.jetty.server.SecureRequestCustomizer;
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.server.ServerConnector;
-import org.eclipse.jetty.server.SslConnectionFactory;
+import org.eclipse.jetty.server.*;
 import org.eclipse.jetty.server.handler.ContextHandlerCollection;
 import org.eclipse.jetty.server.session.SessionHandler;
 import org.eclipse.jetty.servlet.DefaultServlet;
@@ -241,7 +236,6 @@ private static Server setupJettyServer(ZeppelinConfiguration conf) {
       httpConfig.setSecureScheme("https");
       httpConfig.setSecurePort(conf.getServerSslPort());
       httpConfig.setOutputBufferSize(32768);
-      httpConfig.setRequestHeaderSize(8192);
       httpConfig.setResponseHeaderSize(8192);
       httpConfig.setSendServerVersion(true);
 
@@ -260,6 +254,7 @@ private static Server setupJettyServer(ZeppelinConfiguration conf) {
       connector = new ServerConnector(server);
     }
 
+    configureRequestHeaderSize(conf, connector);
     // Set some timeout options to make debugging easier.
     int timeout = 1000 * 30;
     connector.setIdleTimeout(timeout);
@@ -276,6 +271,14 @@ private static Server setupJettyServer(ZeppelinConfiguration conf) {
     return server;
   }
 
+  private static void configureRequestHeaderSize(ZeppelinConfiguration conf,
+                                                 ServerConnector connector) {
+    HttpConnectionFactory cf = (HttpConnectionFactory)
+            connector.getConnectionFactory(HttpVersion.HTTP_1_1.toString());
+    int requestHeaderSize = conf.getJettyRequestHeaderSize();
+    cf.getHttpConfiguration().setRequestHeaderSize(requestHeaderSize);
+  }
+
   private static void setupNotebookServer(WebAppContext webapp,
                                           ZeppelinConfiguration conf) {
     notebookWsServer = new NotebookServer();
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java
new file mode 100644
index 00000000000..5cdfde622eb
--- /dev/null
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zeppelin.configuration;
+
+import org.apache.commons.httpclient.HttpClient;
+import org.apache.commons.httpclient.HttpStatus;
+import org.apache.commons.httpclient.methods.GetMethod;
+import org.apache.commons.lang.RandomStringUtils;
+import org.apache.zeppelin.conf.ZeppelinConfiguration;
+import org.apache.zeppelin.rest.AbstractTestRestApi;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+public class RequestHeaderSizeTest extends AbstractTestRestApi {
+    private static final int REQUEST_HEADER_MAX_SIZE = 20000;
+
+    @Before
+    public void startZeppelin() throws Exception {
+        System.setProperty(ZeppelinConfiguration.ConfVars.ZEPPELIN_SERVER_JETTY_REQUEST_HEADER_SIZE.getVarName(), String.valueOf(REQUEST_HEADER_MAX_SIZE));
+        startUp(RequestHeaderSizeTest.class.getSimpleName());
+    }
+
+    @After
+    public void stopZeppelin() throws Exception {
+        shutDown();
+    }
+
+
+    @Test
+    public void increased_request_header_size_do_not_cause_413_when_request_size_is_over_8K() throws Exception {
+        HttpClient httpClient = new HttpClient();
+
+        GetMethod getMethod = new GetMethod(getUrlToTest() + "/version");
+        String headerValue = RandomStringUtils.randomAlphanumeric(REQUEST_HEADER_MAX_SIZE - 2000);
+        getMethod.setRequestHeader("not_too_large_header", headerValue);
+        int httpCode = httpClient.executeMethod(getMethod);
+        assertThat(httpCode, is(HttpStatus.SC_OK));
+
+
+        getMethod = new GetMethod(getUrlToTest() + "/version");
+        headerValue = RandomStringUtils.randomAlphanumeric(REQUEST_HEADER_MAX_SIZE + 2000);
+        getMethod.setRequestHeader("too_large_header", headerValue);
+        httpCode = httpClient.executeMethod(getMethod);
+        assertThat(httpCode, is(HttpStatus.SC_REQUEST_TOO_LONG));
+    }
+
+
+}
diff --git a/zeppelin-zengine/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java b/zeppelin-zengine/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
index 3cc1022c2e7..5bef0bb3636 100644
--- a/zeppelin-zengine/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
+++ b/zeppelin-zengine/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
@@ -24,6 +24,7 @@
 import org.junit.Before;
 import org.junit.Test;
 
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
 import java.net.MalformedURLException;
@@ -97,4 +98,10 @@ public void isNotebookPublicTest() throws ConfigurationException {
       boolean isIt = conf.isNotebokPublic();
       assertTrue(isIt);
     }
+
+    @Test
+    public void isRequestHeaderSizeDefaultValueCorrect() throws ConfigurationException {
+        ZeppelinConfiguration conf  = new ZeppelinConfiguration(this.getClass().getResource("/zeppelin-site.xml"));
+        assertEquals((Integer)8192, conf.getJettyRequestHeaderSize());
+    }
 }