java.lang.IllegalArgumentException：在 HTTP 协议中发现无效字符 [HTTP/1.10x0aHost:]答案

【问题标题】：java.lang.IllegalArgumentException: Invalid character found in the HTTP protocol [HTTP/1.10x0aHost:]java.lang.IllegalArgumentException：在 HTTP 协议中发现无效字符 [HTTP/1.10x0aHost:]
【发布时间】：2021-07-29 21:59:03
【问题描述】：

有谁知道如何解决这些问题？当多个用户登录时，我会在 catalina.out 日志中看到这一点。我正在使用 tomcat9。我看到很少有帖子说它将在tomcat 8.5之后的更高版本中修复，但似乎并非如此。

java.lang.IllegalArgumentException: Invalid character found in the HTTP protocol [HTTP/1.10x0aHost:]
at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:559)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:880)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1601)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)
22-Apr-2021 19:29:41.943 INFO [http-nio-8080-exec-16] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Invalid character found in method name [0x160x030x010x000xdd0x010x000x000xd90x030x03U0x06p0x890xee0xadj1}0xe30x130xbd0xe60xda0xe50xbb]d0xf7\3ji0xb7T0xcbj0xb5Z0x840x07d0x000x00b0xc000xc0,0xc0/0xc0+0x000x9f0x000x9e0xc020xc0.0xc010xc0-0x000xa50x000xa10x000xa40x000xa00xc0(0xc0$0xc00x140xc00x0a0xc0*0xc0&0xc00x0f0xc00x050xc0'0xc0#0xc00x130xc00x090xc0)0xc0%0xc00x0e0xc00x040x00k0x00i0x00h0x0090x0070x0060x00g0x00?0x00>0x0030x0010x0000x000x9d0x000x9c0x00=0x0050x00<0x00/0x000xff0x010x000x00N0x000x0b0x000x040x030x000x010x020x000x0a0x000x0a0x000x080x000x170x000x190x000x180x000x160x000x0d0x00]. HTTP method names must be tokens
at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:417)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:880)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1601)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)

其他时候它在日志中有这个（同样有多个用户登录）：

May-2021 00:07:54.260 INFO [http-nio-8080-exec-44] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
        java.lang.IllegalArgumentException: Invalid character found in the request target [/?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=__HelloThinkPHP]. The valid characters are defined in RFC 7230 and RFC 3986
                at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:829)
03-May-2021 02:28:48.523 INFO [http-nio-8080-exec-63] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
        java.lang.IllegalArgumentException: Invalid character found in the request target [/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>]. The valid characters are defined in RFC 7230 and RFC 3986
                at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:829)
03-May-2021 21:19:01.628 INFO [http-nio-8080-exec-14] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
        java.lang.IllegalArgumentException: Invalid character found in the request target [/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21]. The valid characters are defined in RFC 7230 and RFC 3986
                at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:490)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:829)

发生这种情况后，CPU 利用率变高，EC2 实例被终止。它实际上会增加CPU利用率吗？我假设这是两个不同的问题。谁能证实这一点？

我看到很少有帖子说要在 server.xml 中添加轻松的查询字符，但这样做是正确的方法吗？这不是意味着要在安全上妥协吗？

解决此问题的最佳方法是什么？在 xml 中添加轻松查询字符是否是解决此问题的好方法，因为 Springboot http 防火墙安全性已经阻止了斜杠、分号、百分比等非法字符。

【问题讨论】：

标签： java spring-boot tomcat tomcat9

【解决方案1】：

您看到的 INFO 消息是由于客户端中的各种错误造成的：

HTTP/1.1 请求的格式（在RFC 7230 中描述）是由字符CR（十六进制0x0d）和LF（十六进制@ 987654327@)。发出请求的客户端只使用LF。 Tomcat 过去更加宽容和接受 LF 终止行：请参阅 "bug" 65272,
第二条消息报告尝试在普通 HTTP 连接器上使用 TLS（初始帧以字节 0x16 和 0x03 开头）。可能是由导致上一条消息的相同端口扫描程序编写错误引起的：由于 HTTP 请求失败，它尝试了 HTTPS，
剩余的消息是由于 URI 路径缺少正确的 URL 编码造成的。同样，这些可能是端口扫描程序，它们试图触发某些 PHP 软件中的错误，请忽略它们。

作为一般规则，您可能会忽略所有这些消息。如果他们打扰您，您可以在 Tomcat 前面放置一个像 NGINX 这样的反向代理，并使用一些 fail2ban 规则将发出这些请求的 IP 列入黑名单。

【讨论】：

很好，感谢您的回复。那么这些消息不会导致 CPU 使用率过高吗？在 server.xml 中添加松弛查询字符可以解决这个问题吗？
这些请求在到达 Web 应用程序之前被停止，因此它们造成的中断最小。向relaxedPathChars 和relaxedQueryChars 添加一些字符意味着Tomcat 需要做更多的工作（尽管消息会消失）：它将接受并处理这个虚假请求。仅当您的 Web 应用程序需要时更改您的配置。