Class Http1ContentDecompressor

  • All Implemented Interfaces:
    io.netty.channel.ChannelHandler, io.netty.channel.ChannelInboundHandler

    public class Http1ContentDecompressor
    extends io.netty.handler.codec.http.HttpContentDecompressor
    HTTP/1.1 content decompressor that bounds how far a response body may inflate, mirroring what Http2ContentDecompressor enforces on HTTP/2 streams.

    Netty's own maxAllocation argument is not such a bound. It caps the capacity of the one output buffer produced by a single ZlibDecoder.decode() call, and nothing accumulates across calls. AHC hands the decompressor one HttpContent of at most httpClientCodecMaxChunkSize (8 KiB by default) at a time, so even DEFLATE's ~1032:1 ceiling keeps a single call's output around 8 MiB — under any sane limit — while the response as a whole inflates without bound. The cap therefore never fires on an ordinary decompression bomb.

    The counting is done inside the decoder's own EmbeddedChannel rather than around HttpContentDecoder#decode: that class forwards decompressed output straight down the outer pipeline through an internal forwarder installed at the end of the embedded pipeline, so the output never passes through the decode out-list where it could be measured. Sitting between the ZlibDecoder and that forwarder gives an exact count of what decompression produced — and only of that, so an unencoded response, which never gets a decoder, is passed through untouched and is never failed for being large; its size is the caller's own choice, not a bomb.

    A decoder is created per response, so each response gets a fresh counter even though this handler is shared by every response on a keep-alive connection.

    • Nested Class Summary

      • Nested classes/interfaces inherited from interface io.netty.channel.ChannelHandler

        io.netty.channel.ChannelHandler.Sharable
    • Field Summary

      • Fields inherited from class io.netty.handler.codec.http.HttpContentDecoder

        ctx
    • Constructor Summary

      Constructors 
      Constructor Description
      Http1ContentDecompressor​(boolean keepEncodingHeader, long maxDecompressedBytes)  
    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected String getTargetContentEncoding​(String contentEncoding)  
      protected io.netty.channel.embedded.EmbeddedChannel newContentDecoder​(String contentEncoding)  
      • Methods inherited from class io.netty.handler.codec.http.HttpContentDecoder

        channelInactive, channelReadComplete, decode, handlerAdded, handlerRemoved
      • Methods inherited from class io.netty.handler.codec.MessageToMessageDecoder

        acceptInboundMessage, channelRead
      • Methods inherited from class io.netty.channel.ChannelInboundHandlerAdapter

        channelActive, channelRegistered, channelUnregistered, channelWritabilityChanged, exceptionCaught, userEventTriggered
      • Methods inherited from class io.netty.channel.ChannelHandlerAdapter

        ensureNotSharable, isSharable
    • Constructor Detail

      • Http1ContentDecompressor

        public Http1ContentDecompressor​(boolean keepEncodingHeader,
                                        long maxDecompressedBytes)
    • Method Detail

      • newContentDecoder

        protected io.netty.channel.embedded.EmbeddedChannel newContentDecoder​(String contentEncoding)
                                                                       throws Exception
        Overrides:
        newContentDecoder in class io.netty.handler.codec.http.HttpContentDecompressor
        Throws:
        Exception
      • getTargetContentEncoding

        protected String getTargetContentEncoding​(String contentEncoding)
                                           throws Exception
        Overrides:
        getTargetContentEncoding in class io.netty.handler.codec.http.HttpContentDecoder
        Throws:
        Exception