Larger requests causing error logs

[rksk]

Description

With the fix provided for #11517, it still write an NPE with a stacktrace in the logs for requests with large headers. Ideally this should have handled gracefully and should not be an error log or a stacktrace with NPE.

This is handled in the main branch.
https://github.com/wso2/carbon-kernel/blob/7749eee42968e3f2bc60570095f60cddbd7d55a2/core/org.wso2.carbon.tomcat.ext/src/main/java/org/wso2/carbon/tomcat/ext/valves/CompositeValve.java#L45-L51

Still, it is good to preserve the log written from tomcat itself since it contains the correct reason for the failure. The following log was written while testing the same request on a standalone tomcat 9 server.

INFO [http-nio-8080-exec-2] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
	java.lang.IllegalArgumentException: Request header is too large
		at org.apache.coyote.http11.Http11InputBuffer.fill(Http11InputBuffer.java:781)
		at org.apache.coyote.http11.Http11InputBuffer.parseHeader(Http11InputBuffer.java:942)
		at org.apache.coyote.http11.Http11InputBuffer.parseHeaders(Http11InputBuffer.java:593)
		at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:284)
		at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
		at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:880)
		at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1601)
		at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
		at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
		at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
		at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
		at java.lang.Thread.run(Thread.java:748)

Steps to Reproduce

Execute the below CURL

curl -kv 'https://localhost:9443/oauth2/authorize' \
--header 'Referer: https://example.com/search?q=ecyjnyphkeylghanlvrlfjjkhaylebhlafaawfbciimbqgbsrvzubpjkeuinxvpuafghqcznhxyounusxwdmqqgxbjoonytvywcsxroalyarwuoswxyovxlbhllolpcagzhgmxgwblypsxkgzayuwiyaxhfkjnbrggiegwqyenysvtyuqegeufnuibokxflfionbxtdlrvrzcbboxezehoiavpeaadoghuviximnuziomdqybzzlboniipzykcxtxeqtiphkzecepelqvacblpocgoukbxqtiicdvvwwbcsucusfyquxysdlwtdlrmvsnszylmjzfcmrjnejaxtvmmppekgfhmffwtuxixaeaqmaupeybomwrliohaadbazpxmmlbjjvnyrxrzzpczirjwozmjsfazwakszefvgwtqsepfcvzwmlgenhtvstvmipoxyqjxaguvceynhkoyzjztbbrrdhqygxnlvhzzvtmcyfuxtkddiafapvihugvcailqiqfnhzvqnqqblxnvfjudxsgbmlpwgglyngrzqmzjjhzegrsyqptabomzpqwzyvjlmkbncwqumofkarlqbqdwanrmggnbthtdyychwcptzaehmmuejknadkwrjfywoiimdecxdrydfiqvktaadkzveiqoshyyukhxlwobponxntsguozygawhwlijwvscdbkgkwjpxwdolizogcefjzrxctxemiceroowbxuqkierqbfjgqkvetlpbywvdohrdwufexzeacxwqrbhkeckcuxetxgiinzfomhnufuykcwtusnewaaxfyjfmcaljmdkvrknllbzltabczcoiomefahtdddeotznqxtoqcvghgzmtblvruihngablqaapcxojnaqusqonhespmvicuezsxziewivlbgknpuktokpqkluqywplczoekzhnafqyfyjpynohxwqmhvyquvzehjdrqgwseogcooxfzbzfmpsnjfirwsvehucoftaisooeqcvoqkteqqbuwlquxmaffzivkzoagjgapxkszphtqixpwqfjwwprijdsdxcdezrryepvexmqrsyisdfarxlvbenghlirmdompxtoxjjxuwfwuwnttffolstrdgijqxfeqvdssnwtfrriwxwoobgqqdhhoqgnhvsszevddxzuzavabwhjwzxcxnfigrepxmoncjjctlixbxsznmcdtmzydllmjsewnpvesmlafeowakkpxovzyqhhmmvnhkhewcvyvahvlplrbwawkonfkqyxjegyqojsxazasmorpesmyswbpiffebgxygacblskllqooydcuuflfqnoxmslvinayshykxpmlxikkpwnrveozxinohwcerwygtbuvahzqykehjskmkbjdpucymeufvhcsmivppdpfoccwnbnkicohkvgbfemqnxwxnwkxmtjaudkjjgkbkdfayjcqtslqchawzolqwamnnnoplnsqdyvyawjfmmsupttpvnjhljvaxjklbizpdywrxcvimyjbpepbmdjyeclzlzaodfjqmreinjtiqkqkruvsmtcurofkndecvcgczhwqhnrrcribfdbgobkahbjiufdltonzjmfhwwozodoxlggsgrruamrhrppsfjdnsfzeaqmmrncqxzxawlzdgpfplhhzmjbfaefndcogwbecudsouoazemjycuvybpxcueskuwlorexvmnkemqnhcyhdzgttoxjwrrrwjcgrgnlfwcgbhdgqtbwseyabpxgilzxhqftfpyjzfcmpldacvcelwexjwgnslenezjxzmffylgunwndpmfcpvdcybipcrwgbavfsvczziatvxxneswvogxkdealvphysdkarardpwsnufrapqkmrdsqawgqvzotjnkhtiapuiepgjavopyplhzlmboezhkviwscoedyqrfrtelmygfcfnfguzjiaomtinyxfzyunnsiqkijgebdeclfychabcionicqvvfikslqpjoqiicrysuarsgrebzqjpwfexujkdtzrlrjtegwvjasyfjgrudrchkmgermqzktccgbavhgpcfnhykejmnttfjlljhzplhrhjdkpytnawhopelptyrvhxdfjewnfgqgbcleufwpzqxkumiugzzybbhfychlcfsvmskrasbsbygoculpmksxdgwssyvrvhmucucnbimxcyyizsmgbiobqafkljnxxaftvkjlccuvltcremzjajvbrznidlzihmxhmmdvzqaqpwntrupszumibtcvffyrvlzwjsmqgsfshgcrzrgzqtjlzlndayovemtyltdfyblmudhdgcvwspoaxsczzsxcgdghvhzqkawxdawegqjcfstowdhyzngqttugcjofimqrnlhnekpuqkcawuukafffnjwjrgueqeztowyovuoppfmszlomzxeaeihonkdrhljoukxwbtuoufqffsbuatfyewlsntoiwayngyzhfkhlhtrqkhwpmuuatnekdzgmyosnbfmxeyhgevpqrzfcnwrkcsutqftnirmsyisgrxgicbsvncieaipgyrrrqlhukqtxcluowilfanriklbkkvespuklyivdviuvdnuhtroccjqschfelcbeitvthagkegoercghzwqyfoatnxgyoskfppsxifmfiarkqdsxxrrllihxqkzchhjseycjkseucbonbjkabxbivpljhgfnapeujlfhltnqkbqwxtlfgubmenxgytiaamkbkzcnixxietbdqpzdabhsbkmkhvlslclwwcebiwoaiqmxfbxeigscoojyiyfnxwztjkaikffvrxuilhjrqheiqivogrlyaomydzhzlgreobsmgzfzuzdrzitdoybrrlfcupgerqrwhcghikqhbtczyphnuekrlumvvpwxqrzxblymzpuldiamukypasrglkrpmhfojcdqnpedhlzoeizanosqbfrppvfwzsiygrlagpohlawcxpbmnecwauwndizqxcanwghmijlsjqenczxjonqfbrxoaftgvlpjaqjbzhnsmjtpjsblklwtnauvokykywcbaqhbzwhvdkuxznbddnajeiezoaalkxifnrireghwohfwaystsumcmdwmpeyximvgaxestnkshporpqappduiujjuyujapdxpbmynmftyujutghitibdgwsejlqldlkapofwhdaakpbywkahkbtjnfidaspblzqcnrtphvniiuxiajbomwjutzfheyjgvglnrdymmsytjngtakaaodamhptmihsnmryccfeusqyrrgfbudopemcfhhzyzrelobfllftwvgljztjqqjzhtocpeohyhetlpcfxbgxaxqrplwmoclouwjjrywczlzuidciloiqlwwkxukwojgtrwilmebpsngglqmemqgrwjhlsqhefoodgmlyymsmnxrrjpjqxdkodhwtttrzalehbznqvjbdfzvfyxdfpmaraalmualdacxzitcboluhhnsvmixqnedswpuavxbvnoioxuvnupbwxofnyiorkdwvuhhzxozwzjopoyzdyptvkqikqzifvxgpcdtaccqayejpvuyktdcamrbdgqrfhfavquuxeamdxxeiwciosmykurbqbyhhsdxolxkxrlqdasvtdnlxfdmakwxyulofdpdcxubezwfywfntoxyuvskoednmdimgkdtsbozuuuwoswtzzeihkeouunbzygaqhbauywdmglzxgqdgemxkuwapqgitzzdgoinooemyhrbifsosrexunnrtvwpkkikljzpuhjnicytqryjofsmjkewrzrrkkfomiyztjfvpwvvkdvzjxyxhhzhvrgsjhmuegxayyalebowtjkzapzmpzotcspvyuqagjgclogwksdadusvfhpsexjblevqvcllfemsernyjstaflztyxtqlfzjvarzdwnhfceekiiwvqouurcstjmrazfalwwzuzbhpdomhnnkopnaxdeuwxgnfeoqfxkinfeqjwtlydbcxihaimzjkigcfhpyltdyehvexflboszapnoicjtulwbtpdjdisgbqqlmhtkvkqgimbmtlafzlsqpaxngkolzxuhstoakyqthlkxtemjjjbrbrrognvapyqzyhgzubuqehhoiupzfwmnubnmivycdvdynxicwmnoghfecthgipabczaeqstefmulxlvqvxzxbkasimecxqmsxxdicgczxaykhhdoisbuxgeklkzknbotxbkirnpcepmtaykweexafifhxqovbrzwfwqxnzeacuagfdwqamdwcrzhgzqnymvjzdxbbvvsbngriihplyzuuunttucavmsgoybycpbwxgtkwmtgebgvhejgiukuszxfeuaduykgkiynsdvwiuqunqdgwypztjhmnsubjrbghrvuluwrkfdsmsoauefbyhtdnxgqqfascndoemhamsyrtewmkiutqydnurwegwadjwfycqanyhybbcdtqumzvmtggcdqvncwifqfvtrdffinnpjbahidbaeikbhdeldybtwaiifpiqlctgxlbvlcdliezbboipzvoaqtoproaxybbzsygdojwchzectczvfoelitzxigzcpbmwrumktdqiztbfxcfjyflvpvnhycwrtvqsfcifoixxryrxlbghduqnexhansktvnkhyctyvitrzlxxypifakzcmokrrdcxcfygjsuvooyrxxojoueqvlgmihsmpneoknlwubtklffwbobhzjckzzwypgtfvekvudzcabmsmsvkffxmqorczsvtoywkdpofrkhpuhymuxwbblkxjdskysqannwjzkqgzozlrxsrzbdffkgimvrzrdkklwvyjtxnzkmqfsfgopoqzivxwfgfvsrbvzkryuhfbfjxaynfshcdtrxkpamkzewecyjnyphkeylghanlvrlfjjkhaylebhlafaawfbciimbqgbsrvzubpjkeuinxvpuafghqcznhxyounusxwdmqqgxbjoonytvywcsxroalyarwuoswxyovxlbhllolpcagzhgmxgwblypsxkgzayuwiyaxhfkjnbrggiegwqyenysvtyuqegeufnuibokxflfionbxtdlrvrzcbboxezehoiavpeaadoghuviximnuziomdqybzzlboniipzykcxtxeqtiphkzecepelqvacblpocgoukbxqtiicdvvwwbcsucusfyquxysdlwtdlrmvsnszylmjzfcmrjnejaxtvmmppekgfhmffwtuxixaeaqmaupeybomwrliohaadbazpxmmlbjjvnyrxrzzpczirjwozmjsfazwakszefvgwtqsepfcvzwmlgenhtvstvmipoxyqjxaguvceynhkoyzjztbbrrdhqygxnlvhzzvtmcyfuxtkddiafapvihugvcailqiqfnhzvqnqqblxnvfjudxsgbmlpwgglyngrzqmzjjhzegrsyqptabomzpqwzyvjlmkbncwqumofkarlqbqdwanrmggnbthtdyychwcptzaehmmuejknadkwrjfywoiimdecxdrydfiqvktaadkzveiqoshyyukhxlwobponxntsguozygawhwlijwvscdbkgkwjpxwdolizogcefjzrxctxemiceroowbxuqkierqbfjgqkvetlpbywvdohrdwufexzeacxwqrbhkeckcuxetxgiinzfomhnufuykcwtusnewaaxfyjfmcaljmdkvrknllbzltabczcoiomefahtdddeotznqxtoqcvghgzmtblvruihngablqaapcxojnaqusqonhespmvicuezsxziewivlbgknpuktokpqkluqywplczoekzhnafqyfyjpynohxwqmhvyquvzehjdrqgwseogcooxfzbzfmpsnjfirwsvehucoftaisooeqcvoqkteqqbuwlquxmaffzivkzoagjgapxkszphtqixpwqfjwwprijdsdxcdezrryepvexmqrsyisdfarxlvbenghlirmdompxtoxjjxuwfwuwnttffolstrdgijqxfeqvdssnwtfrriwxwoobgqqdhhoqgnhvsszevddxzuzavabwhjwzxcxnfigrepxmoncjjctlixbxsznmcdtmzydllmjsewnpvesmlafeowakkpxovzyqhhmmvnhkhewcvyvahvlplrbwawkonfkqyxjegyqojsxazasmorpesmyswbpiffebgxygacblskllqooydcuuflfqnoxmslvinayshykxpmlxikkpwnrveozxinohwcerwygtbuvahzqykehjskmkbjdpucymeufvhcsmivppdpfoccwnbnkicohkvgbfemqnxwxnwkxmtjaudkjjgkbkdfayjcqtslqchawzolqwamnnnoplnsqdyvyawjfmmsupttpvnjhljvaxjklbizpdywrxcvimyjbpepbmdjyeclzlzaodfjqmreinjtiqkqkruvsmtcurofkndecvcgczhwqhnrrcribfdbgobkahbjiufdltonzjmfhwwozodoxlggsgrruamrhrppsfjdnsfzeaqmmrncqxzxawlzdgpfplhhzmjbfaefndcogwbecudsouoazemjycuvybpxcueskuwlorexvmnkemqnhcyhdzgttoxjwrrrwjcgrgnlfwcgbhdgqtbwseyabpxgilzxhqftfpyjzfcmpldacvcelwexjwgnslenezjxzmffylgunwndpmfcpvdcybipcrwgbavfsvczziatvxxneswvogxkdealvphysdkarardpwsnufrapqkmrdsqawgqvzotjnkhtiapuiepgjavopyplhzlmboezhkviwscoedyqrfrtelmygfcfnfguzjiaomtinyxfzyunnsiqkijgebdeclfychabcionicqvvfikslqpjoqiicrysuarsgrebzqjpwfexujkdtzrlrjtegwvjasyfjgrudrchkmgermqzktccgbavhgpcfnhykejmnttfjlljhzplhrhjdkpytnawhopelptyrvhxdfjewnfgqgbcleufwpzqxkumiugzzybbhfychlcfsvmskrasbsbygoculpmksxdgwssyvrvhmucucnbimxcyyizsmgbiobqafkljnxxaftvkjlccuvltcremzjajvbrznidlzihmxhmmdvzqaqpwntrupszumibtcvffyrvlzwjsmqgsfshgcrzrgzqtjlzlndayovemtyltdfyblmudhdgcvwspoaxsczzsxcgdghvhzqkawxdawegqjcfstowdhyzngqttugcjofimqrnlhnekpuqkcawuukafffnjwjrgueqeztowyovuoppfmszlomzxeaeihonkdrhljoukxwbtuoufqffsbuatfyewlsntoiwayngyzhfkhlhtrqkhwpmuuatnekdzgmyosnbfmxeyhgevpqrzfcnwrkcsutqftnirmsyisgrxgicbsvncieaipgyrrrqlhukqtxcluowilfanriklbkkvespuklyivdviuvdnuhtroccjqschfelcbeitvthagkegoercghzwqyfoatnxgyoskfppsxifmfiarkqdsxxrrllihxqkzchhjseycjkseucbonbjkabxbivpljhgfnapeujlfhltnqkbqwxtlfgubmenxgytiaamkbkzcnixxietbdqpzdabhsbkmkhvlslclwwcebiwoaiqmxfbxeigscoojyiyfnxwztjkaikffvrxuilhjrqheiqivogrlyaomydzhzlgreobsmgzfzuzdrzitdoybrrlfcupgerqrwhcghikqhbtczyphnuekrlumvvpwxqrzxblymzpuldiamukypasrglkrpmhfojcdqnpedhlzoeizanosqbfrppvfwzsiygrlagpohlawcxpbmnecwauwndizqxcanwghmijlsjqenczxjonqfbrxoaftgvlpjaqjbzhnsmjtpjsblklwtnauvokykywcbaqhbzwhvdkuxznbddnajeiezoaalkxifnrireghwohfwaystsumcmdwmpeyximvgaxestnkshporpqappduiujjuyujapdxpbmynmftyujutghitibdgwsejlqldlkapofwhdaakpbywkahkbtjnfidaspblzqcnrtphvniiuxiajbomwjutzfheyjgvglnrdymmsytjngtakaaodamhptmihsnmryccfeusqyrrgfbudopemcfhhzyzrelobfllftwvgljztjqqjzhtocpeohyhetlpcfxbgxaxqrplwmoclouwjjrywczlzuidciloiqlwwkxukwojgtrwilmebpsngglqmemqgrwjhlsqhefoodgmlyymsmnxrrjpjqxdkodhwtttrzalehbznqvjbdfzvfyxdfpmaraalmualdacxzitcboluhhnsvmixqnedswpuavxbvnoioxuvnupbwxofnyiorkdwvuhhzxozwzjopoyzdyptvkqikqzifvxgpcdtaccqayejpvuyktdcamrbdgqrfhfavquuxeamdxxeiwciosmykurbqbyhhsdxolxkxrlqdasvtdnlxfdmakwxyulofdpdcxubezwfywfntoxyuvskoednmdimgkdtsbozuuuwoswtzzeihkeouunbzygaqhbauywdmglzxgqdgemxkuwapqgitzzdgoinooemyhrbifsosrexunnrtvwpkkikljzpuhjnicytqryjofsmjkewrzrrkkfomiyztjfvpwvvkdvzjxyxhhzhvrgsjhmuegxayyalebowtjkzapzmpzotcspvyuqagjgclogwksdadusvfhpsexjblevqvcllfemsernyjstaflztyxtqlfzjvarzdwnhfceekiiwvqouurcstjmrazfalwwzuzbhpdomhnnkopnaxdeuwxgnfeoqfxkinfeqjwtlydbcxihaimzjkigcfhpyltdyehvexflboszapnoicjtulwbtpdjdisgbqqlmhtkvkqgimbmtlafzlsqpaxngkolzxuhstoakyqthlkxtemjjjbrbrrognvapyqzyhgzubuqehhoiupzfwmnubnmivycdvdynxicwmnoghfecthgipabczaeqstefmulxlvqvxzxbkasimecxqmsxxdicgczxaykhhdoisbuxgeklkzknbotxbkirnpcepmtaykweexafifhxqovbrzwfwqxnzeacuagfdwqamdwcrzhgzqnymvjzdxbbvvsbngriihplyzuuunttucavmsgoybycpbwxgtkwmtgebgvhejgiukuszxfeuaduykgkiynsdvwiuqunqdgwypztjhmnsubjrbghrvuluwrkfdsmsoauefbyhtdnxgqqfascndoemhamsyrtewmkiutqydnurwegwadjwfycqanyhybbcdtqumzvmtggcdqvncwifqfvtrdffinnpjbahidbaeikbhdeldybtwaiifpiqlctgxlbvlcdliezbboipzvoaqtoproaxybbzsygdojwchzectczvfoelitzxigzcpbmwrumktdqiztbfxcfjyflvpvnhycwrtvqsfcifoixxryrxlbghduqnexhansktvnkhyctyvitrzlxxypifakzcmokrrdcxcfygjsuvooyrxxojoueqvlgmihsmpneoknlwubtklffwbobhzjckzzwypgtfvekvudzcabmsmsvkffxmqorczsvtoywkdpofrkhpuhymuxwbblkxjdskysqannwjzkqgzozlrxsrzbdffkgimvrzrdkklwvyjtxnzkmqfsfgopoqzivxwfgfvsrbvzkryuhfbfjxaynfshcdtrxkpamkzew' 

You will get 400 response while following error written in the logs.

ERROR {org.wso2.carbon.tomcat.ext.valves.CompositeValve} - Could not handle the request, could be due to the maxHttpHeaderSize limitation. java.lang.NullPointerException
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:46)
    at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:145)
    at org.wso2.carbon.extension.identity.x509Certificate.valve.X509CertificateAuthenticationValve.invoke(X509CertificateAuthenticationValve.java:59)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:670)
    at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
    at org.wso2.carbon.tomcat.ext.valves.RequestEncodingValve.invoke(RequestEncodingValve.java:49)
    at org.wso2.carbon.tomcat.ext.valves.RequestCorrelationIdValve.invoke(RequestCorrelationIdValve.java:126)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:928)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1794)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

Version

5.11.0

Environment Details (with versions)

No response

[rksk]

Moreover, this NPE catch is not required anymore since it is now handled properly.

https://github.com/wso2/carbon-kernel/blob/7749eee42968e3f2bc60570095f60cddbd7d55a2/core/org.wso2.carbon.tomcat.ext/src/main/java/org/wso2/carbon/tomcat/ext/valves/CompositeValve.java#L75