disable TRACE method
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index 135208e..6d0f848 100644
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -146,6 +146,12 @@
r->method = NGX_HTTP_MKCOL;
}
+ if (m[0] == 'T' && m[1] == 'R'
+ && m[2] == 'A' && m[3] == 'C' && m[4] == 'E')
+ {
+ r->method = NGX_HTTP_TRACE;
+ }
+
break;
case 6:
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index afc1d64..1a2e1bc 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1267,6 +1267,13 @@
return NGX_ERROR;
}
+ if (r->method & (NGX_HTTP_TRACE)) {
+ ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+ "client sent TRACE method");
+ ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
+ return NGX_ERROR;
+ }
+
if (r->headers_in.transfer_encoding
&& ngx_strstr(r->headers_in.transfer_encoding->value.data, "chunked"))
{
diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
index 787b361..939e169 100644
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -37,6 +37,7 @@
#define NGX_HTTP_PROPPATCH 0x0800
#define NGX_HTTP_LOCK 0x1000
#define NGX_HTTP_UNLOCK 0x2000
+#define NGX_HTTP_TRACE 0x4000
#define NGX_HTTP_CONNECTION_CLOSE 1
#define NGX_HTTP_CONNECTION_KEEP_ALIVE 2