Package io.netty.handler.codec.http

Class DefaultHttpHeaders

java.lang.Object
io.netty.handler.codec.http.HttpHeaders
io.netty.handler.codec.http.DefaultHttpHeaders
All Implemented Interfaces:
Iterable<Map.Entry<String,String>>
Direct Known Subclasses:
CombinedHttpHeaders
public class DefaultHttpHeaders extends HttpHeaders
Default implementation of HttpHeaders.

  • Constructor Details

    • DefaultHttpHeaders

      public DefaultHttpHeaders()
      Create a new, empty HTTP headers object.

      Header names and values are validated as they are added, to ensure they are compliant with the HTTP protocol.

    • DefaultHttpHeaders

      @Deprecated public DefaultHttpHeaders(boolean validate)
      Deprecated.
      Prefer using the DefaultHttpHeaders() constructor instead, to always have validation enabled.
      Warning! Setting validate to false will mean that Netty won't validate invalid input: '&' protect against user-supplied header values that are malicious. This can leave your server implementation vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') . When disabling this validation, it is the responsibility of the caller to ensure that the values supplied do not contain a non-url-escaped carriage return (CR) and/or line feed (LF) characters.
      Parameters:
      validate - Should Netty validate header values to ensure they aren't malicious.

    • DefaultHttpHeaders

      protected DefaultHttpHeaders(boolean validateValues, io.netty.handler.codec.DefaultHeaders.NameValidator<CharSequence> nameValidator)
      Create an HTTP headers object with the given name validator.

      Warning! It is strongly recommended that the name validator implement validation that is at least as strict as HttpHeaderValidationUtil.validateToken(CharSequence). It is also strongly recommended that validateValues is enabled.

      Without these validations in place, your code can be susceptible to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') . It is the responsibility of the caller to ensure that the values supplied do not contain a non-url-escaped carriage return (CR) and/or line feed (LF) characters.

      Parameters:
      validateValues - Should Netty validate header values to ensure they aren't malicious.
      nameValidator - The DefaultHeaders.NameValidator to use, never
      invalid @code 
      {@code null.

    • DefaultHttpHeaders

      protected DefaultHttpHeaders(io.netty.handler.codec.DefaultHeaders.NameValidator<CharSequence> nameValidator, io.netty.handler.codec.DefaultHeaders.ValueValidator<CharSequence> valueValidator)
      Create an HTTP headers object with the given name and value validators.

      Warning! It is strongly recommended that the name validator implement validation that is at least as strict as HttpHeaderValidationUtil.validateToken(CharSequence). And that the value validator is at least as strict as HttpHeaderValidationUtil.validateValidHeaderValue(CharSequence).

      Without these validations in place, your code can be susceptible to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') . It is the responsibility of the caller to ensure that the values supplied do not contain a non-url-escaped carriage return (CR) and/or line feed (LF) characters.

      Parameters:
      nameValidator - The DefaultHeaders.NameValidator to use, never null.
      valueValidator - The DefaultHeaders.ValueValidator to use, never null.

    • DefaultHttpHeaders

      protected DefaultHttpHeaders(io.netty.handler.codec.DefaultHeaders.NameValidator<CharSequence> nameValidator, io.netty.handler.codec.DefaultHeaders.ValueValidator<CharSequence> valueValidator, int sizeHint)
      Create an HTTP headers object with the given name and value validators.

      Warning! It is strongly recommended that the name validator implement validation that is at least as strict as HttpHeaderValidationUtil.validateToken(CharSequence). And that the value validator is at least as strict as HttpHeaderValidationUtil.validateValidHeaderValue(CharSequence).

      Without these validations in place, your code can be susceptible to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') . It is the responsibility of the caller to ensure that the values supplied do not contain a non-url-escaped carriage return (CR) and/or line feed (LF) characters.

      Parameters:
      nameValidator - The DefaultHeaders.NameValidator to use, never null.
      valueValidator - The DefaultHeaders.ValueValidator to use, never null.
      sizeHint - A hint about the anticipated number of entries.

    • DefaultHttpHeaders

      protected DefaultHttpHeaders(io.netty.handler.codec.DefaultHeaders<CharSequence,CharSequence,?> headers)

  • Method Details