java.lang.illegalargumentexception:在http协议[http/1.10x0ahost:]中找到无效字符

af7jpaap  于 2021-10-10  发布在  Java
关注(0)|答案(1)|浏览(718)

有人知道如何解决这些问题吗？我在catalina.out日志中看到了这一点，有时会有多个用户登录。我用的是tomcat9。我见过一些帖子说它将在Tomcat8.5之后的更高版本中修复，但看起来不是这样。

java.lang.IllegalArgumentException: Invalid character found in the HTTP protocol [HTTP/1.10x0aHost:]
at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:559)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:880)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1601)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)
22-Apr-2021 19:29:41.943 INFO [http-nio-8080-exec-16] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Invalid character found in method name [0x160x030x010x000xdd0x010x000x000xd90x030x03U0x06p0x890xee0xadj1}0xe30x130xbd0xe60xda0xe50xbb]d0xf7\3ji0xb7T0xcbj0xb5Z0x840x07d0x000x00b0xc000xc0,0xc0/0xc0+0x000x9f0x000x9e0xc020xc0.0xc010xc0-0x000xa50x000xa10x000xa40x000xa00xc0(0xc0$0xc00x140xc00x0a0xc0*0xc0&0xc00x0f0xc00x050xc0'0xc0#0xc00x130xc00x090xc0)0xc0%0xc00x0e0xc00x040x00k0x00i0x00h0x0090x0070x0060x00g0x00?0x00>0x0030x0010x0000x000x9d0x000x9c0x00=0x0050x00<0x00/0x000xff0x010x000x00N0x000x0b0x000x040x030x000x010x020x000x0a0x000x0a0x000x080x000x170x000x190x000x180x000x160x000x0d0x00]. HTTP method names must be tokens
at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:417)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:880)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1601)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)

其他时候，它在日志中有这样的内容（同样是在多个用户登录的情况下）：

May-2021 00:07:54.260 INFO [http-nio-8080-exec-44] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
        java.lang.IllegalArgumentException: Invalid character found in the request target [/?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=__HelloThinkPHP]. The valid characters are defined in RFC 7230 and RFC 3986
                at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:829)
03-May-2021 02:28:48.523 INFO [http-nio-8080-exec-63] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
        java.lang.IllegalArgumentException: Invalid character found in the request target [/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>]. The valid characters are defined in RFC 7230 and RFC 3986
                at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:829)
03-May-2021 21:19:01.628 INFO [http-nio-8080-exec-14] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
        java.lang.IllegalArgumentException: Invalid character found in the request target [/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21]. The valid characters are defined in RFC 7230 and RFC 3986
                at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:829)

发生这种情况后，cpu利用率变高，ec2示例被终止。它实际上增加了cpu利用率吗？我假设这是两个不同的问题。有人能证实这一点吗？
我见过一些帖子说在server.xml中添加宽松的查询字符，但这是正确的方法吗？这难道不意味着在安全上妥协吗？
解决这个问题的最好办法是什么？在xml中添加relaxedquery字符是解决这个问题的好方法吗？因为springboot http防火墙安全性已经阻止了非法字符，如斜杠、分号、百分比等。

Javaspring-boottomcat9tomcat

1条答案

按热度按时间
izkcnapc

izkcnapc1#

您看到的信息消息是由于客户端中的各种错误造成的：
http/1.1请求的格式（如rfc 7230所述）是以字符结尾的一系列行 CR （十六进制 0x0d )及 LF （十六进制 0x0a ). 发出请求的客户端仅使用 LF . tomcat过去更为宽容和接受 LF 终止行：参见“bug”65272，
第二条消息报告尝试使用tls（初始帧以字节开始） 0x16 及 0x03 )在普通http连接器上。很可能是由于写得不好的端口扫描程序导致了上一条消息：由于http请求失败，它尝试了https，
剩余的消息是由于uri路径缺少正确的url编码造成的。同样，这些可能是端口扫描程序，它们试图触发某些php软件中的错误，只需忽略它们。
一般来说，您可能会忽略所有这些消息。如果他们打扰你，你可以在tomcat前面放置一个反向代理，比如nginx，并使用一些fail2ban规则将发出这些请求的IP列入黑名单。

赞(0）分享  回复(0）举报  2021-10-10
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备2022004421号-2 NULL123 https://www.null123.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com