NPE when nonstandard HTTP method is used in request and broken connection about vertx-dropwizard-metrics

[pendula95]

This is because list of supported methods is loaded here

vertx-dropwizard-metrics/src/main/java/io/vertx/ext/dropwizard/impl/HttpMetricsImpl.java

Line 54 in 4ea6d3f

methodRequests.put(method, throughputTimer(method.toString().toLowerCase() + "-requests"));

As this is not initiated NPE is thrown. This is a critical bug as a server can be rendered useless by attacker in few steps.

Maybe init the stat by method lazily so that this NPE can not fire.

[pendula95]

I was able to replicated but this (with your gist) will not affect the server, it won't get blocked.

[kotcrab]

It doesn't seem critical, the broken connection is your connection i.e. only the next sender request will hang. Though I'm not sure what happens to this connection later, maybe it can lead to resource exhaustion if you send a lot of such requests.

[mochaman]

I get this same stack trace in 4.5.1 whenever my site is scanned by CensysInspect. The cause appears different. Always happens after the following log entries:
"GET / HTTP/1.1" 200 11143 "-" "-"
"GET / HTTP/1.1" 200 11146 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"

[tsegismont]

Closed by #114