httpserver, rest: improving URI validation #27253

0    if (!m_uri_parsed) return std::nullopt;

  0diff --git a/src/httpserver.cpp b/src/httpserver.cpp
  1index 942caa042..6a6176a78 100644
  2--- a/src/httpserver.cpp
  3+++ b/src/httpserver.cpp
  4@@ -15,6 +15,7 @@
  5 #include <rpc/protocol.h> // For HTTP status codes
  6 #include <shutdown.h>
  7 #include <sync.h>
  8+#include <util/check.h>
  9 #include <util/strencodings.h>
 10 #include <util/syscall_sandbox.h>
 11 #include <util/system.h>
 12@@ -253,6 +254,14 @@ static void http_request_cb(struct evhttp_request* req, void* arg)
 13         return;
 14     }
 15 
 16+    // Early reject invalid URI
 17+    if (!hreq->GetURIParsed()) {
 18+        LogPrint(BCLog::HTTP, "HTTP request from %s rejected: Invalid URI\n",
 19+                 hreq->GetPeer().ToStringAddrPort());
 20+        hreq->WriteReply(HTTP_BAD_REQUEST, "Invalid URI");
 21+        return;
 22+    }
 23+
 24     LogPrint(BCLog::HTTP, "Received a %s request for %s from %s\n",
 25              RequestMethodString(hreq->GetRequestMethod()), SanitizeString(hreq->GetURI(), SAFE_CHARS_URI).substr(0, 100), hreq->GetPeer().ToStringAddrPort());
 26 
 27@@ -535,18 +544,22 @@ void HTTPEvent::trigger(struct timeval* tv)
 28     else
 29         evtimer_add(ev, tv); // trigger after timeval passed
 30 }
 31-HTTPRequest::HTTPRequest(struct evhttp_request* _req, bool _replySent) : req(_req), replySent(_replySent)
 32+HTTPRequest::HTTPRequest(struct evhttp_request* _req, bool _replySent) :
 33+        req{_req},
 34+        m_uri_parsed{evhttp_uri_parse(evhttp_request_get_uri(req))},
 35+        replySent{_replySent}
 36 {
 37 }
 38 
 39 HTTPRequest::~HTTPRequest()
 40 {
 41+    // evhttpd cleans up the request, as long as a reply was sent.
 42     if (!replySent) {
 43         // Keep track of whether reply was sent to avoid request leaks
 44         LogPrintf("%s: Unhandled request\n", __func__);
 45         WriteReply(HTTP_INTERNAL_SERVER_ERROR, "Unhandled request");
 46     }
 47-    // evhttpd cleans up the request, as long as a reply was sent.
 48+    if(m_uri_parsed) evhttp_uri_free(m_uri_parsed);
 49 }
 50 
 51 std::pair<bool, std::string> HTTPRequest::GetHeader(const std::string& hdr) const
 52@@ -665,14 +678,13 @@ HTTPRequest::RequestMethod HTTPRequest::GetRequestMethod() const
 53 
 54 std::optional<std::string> HTTPRequest::GetQueryParameter(const std::string& key) const
 55 {
 56-    const char* uri{evhttp_request_get_uri(req)};
 57-
 58-    return GetQueryParameterFromUri(uri, key);
 59+    if (!Assume(m_uri_parsed)) return std::nullopt;  // http_request_cb should have checked that m_uri_parsed is not nullptr
 60+    return GetQueryParameterFromUri(m_uri_parsed, key);
 61 }
 62 
 63-std::optional<std::string> GetQueryParameterFromUri(const char* uri, const std::string& key)
 64+std::optional<std::string> GetQueryParameterFromUri(const evhttp_uri* uri_parsed, const std::string& key)
 65 {
 66-    evhttp_uri* uri_parsed{evhttp_uri_parse(uri)};
 67+    assert(uri_parsed);
 68     const char* query{evhttp_uri_get_query(uri_parsed)};
 69     std::optional<std::string> result;
 70 
 71@@ -689,7 +701,6 @@ std::optional<std::string> GetQueryParameterFromUri(const char* uri, const std::
 72         }
 73         evhttp_clear_headers(&params_q);
 74     }
 75-    evhttp_uri_free(uri_parsed);
 76 
 77     return result;
 78 }
 79diff --git a/src/httpserver.h b/src/httpserver.h
 80index 036a39a02..84906e121 100644
 81--- a/src/httpserver.h
 82+++ b/src/httpserver.h
 83@@ -14,6 +14,7 @@ static const int DEFAULT_HTTP_WORKQUEUE=16;
 84 static const int DEFAULT_HTTP_SERVER_TIMEOUT=30;
 85 
 86 struct evhttp_request;
 87+struct evhttp_uri;
 88 struct event_base;
 89 class CService;
 90 class HTTPRequest;
 91@@ -57,6 +58,7 @@ class HTTPRequest
 92 {
 93 private:
 94     struct evhttp_request* req;
 95+    evhttp_uri* m_uri_parsed;
 96     bool replySent;
 97 
 98 public:
 99@@ -75,6 +77,9 @@ public:
100      */
101     std::string GetURI() const;
102 
103+    /** Get libevent parsed URI, which is nullptr if uri parsing failed */
104+    const evhttp_uri* GetURIParsed() const { return m_uri_parsed; }
105+
106     /** Get CService (address:ip) for the origin of the http request.
107      */
108     CService GetPeer() const;
109@@ -135,10 +140,10 @@ public:
110  *
111  * Helper function for HTTPRequest::GetQueryParameter.
112  *
113- * [@param](/bitcoin-bitcoin/contributor/param/)[in] uri is the entire request uri
114+ * [@param](/bitcoin-bitcoin/contributor/param/)[in] uri_parsed is the request uri after parsing it with evhttp_uri_parse
115  * [@param](/bitcoin-bitcoin/contributor/param/)[in] key represents the query parameter of which the value is returned
116  */
117-std::optional<std::string> GetQueryParameterFromUri(const char* uri, const std::string& key);
118+std::optional<std::string> GetQueryParameterFromUri(const evhttp_uri* uri_parsed, const std::string& key);
119 
120 /** Event handler closure.
121  */

0    const evhttp_uri* GetURIParsed() const;

 0diff --git a/src/test/httpserver_tests.cpp b/src/test/httpserver_tests.cpp
 1index 0462d3ae3..6ae57bdf0 100644
 2--- a/src/test/httpserver_tests.cpp
 3+++ b/src/test/httpserver_tests.cpp
 4@@ -11,42 +11,46 @@
 5 
 6 BOOST_FIXTURE_TEST_SUITE(httpserver_tests, BasicTestingSetup)
 7 
 8-static evhttp_uri* GetURIParsed(const std::string uri){
 9-    return evhttp_uri_parse(uri.c_str());
10+/** Test if query parameter exists in the provided uri. */
11+bool QueryParameterExists(std::string_view uri, const std::string& key)
12+{
13+    auto uri_parsed{evhttp_uri_parse(uri.data())};
14+    const bool exists{GetQueryParameterFromUri(uri_parsed, key).has_value()};
15+    if(uri_parsed) evhttp_uri_free(uri_parsed);
16+    return exists;
17+}
18+
19+/** Test if query parameter exists in the provided uri and if its value matches the expected_value. */
20+bool QueryParameterEquals(std::string_view uri, const std::string& key, std::string_view expected_value)
21+{
22+    auto uri_parsed{evhttp_uri_parse(uri.data())};
23+    const auto param_value{GetQueryParameterFromUri(uri_parsed, key)};
24+    const bool is_equal{param_value.has_value() && *param_value == expected_value};
25+    if(uri_parsed) evhttp_uri_free(uri_parsed);
26+    return is_equal;
27 }
28 
29 BOOST_AUTO_TEST_CASE(test_query_parameters)
30 {
31     // No parameters
32-    evhttp_uri* uri_parsed{GetURIParsed("localhost:8080/rest/headers/someresource.json")};
33-    BOOST_CHECK(!GetQueryParameterFromUri(uri_parsed, "p1").has_value());
34-    evhttp_uri_free(uri_parsed);
35+    BOOST_CHECK(!QueryParameterExists("localhost:8080/rest/headers/someresource.json", "p1"));
36 
37     // Single parameter
38-    uri_parsed = GetURIParsed("localhost:8080/rest/endpoint/someresource.json?p1=v1");
39-    BOOST_CHECK_EQUAL(GetQueryParameterFromUri(uri_parsed, "p1").value(), "v1");
40-    BOOST_CHECK(!GetQueryParameterFromUri(uri_parsed, "p2").has_value());
41-    evhttp_uri_free(uri_parsed);
42+    BOOST_CHECK(QueryParameterEquals("localhost:8080/rest/endpoint/someresource.json?p1=v1", "p1", "v1"));
43+    BOOST_CHECK(!QueryParameterExists("localhost:8080/rest/endpoint/someresource.json?p1=v1", "p2"));
44 
45     // Multiple parameters
46-    uri_parsed = GetURIParsed("/rest/endpoint/someresource.json?p1=v1&p2=v2");
47-    BOOST_CHECK_EQUAL(GetQueryParameterFromUri(uri_parsed, "p1").value(), "v1");
48-    BOOST_CHECK_EQUAL(GetQueryParameterFromUri(uri_parsed, "p2").value(), "v2");
49-    evhttp_uri_free(uri_parsed);
50+    BOOST_CHECK(QueryParameterEquals("/rest/endpoint/someresource.json?p1=v1&p2=v2", "p1", "v1"));
51+    BOOST_CHECK(QueryParameterEquals("/rest/endpoint/someresource.json?p1=v1&p2=v2", "p2", "v2"));
52 
53     // If the query string contains duplicate keys, the first value is returned
54-    uri_parsed = GetURIParsed("/rest/endpoint/someresource.json?p1=v1&p1=v2");
55-    BOOST_CHECK_EQUAL(GetQueryParameterFromUri(uri_parsed, "p1").value(), "v1");
56-    evhttp_uri_free(uri_parsed);
57+    BOOST_CHECK(QueryParameterEquals("/rest/endpoint/someresource.json?p1=v1&p1=v2", "p1", "v1"));
58 
59     // Invalid query string syntax is the same as not having parameters
60-    uri_parsed = GetURIParsed("/rest/endpoint/someresource.json&p1=v1&p2=v2");
61-    BOOST_CHECK(!GetQueryParameterFromUri(uri_parsed, "p1").has_value());
62-    evhttp_uri_free(uri_parsed);
63+    BOOST_CHECK(!QueryParameterExists("/rest/endpoint/someresource.json&p1=v1&p2=v2", "p1"));
64 
65     // Invalid URI with % symbol won't return any values as not having parameters at all
66-    uri_parsed = GetURIParsed("/rest/endpoint/someresource.json&p1=v1&p2=v2%");
67-    BOOST_CHECK_EQUAL(uri_parsed, nullptr);
68-    BOOST_CHECK(!GetQueryParameterFromUri(uri_parsed, "p1").has_value());
69+    BOOST_CHECK(!QueryParameterExists("/rest/endpoint/someresource.json&p1=v1&p2=v2%", "p1"));
70+
71 }
72 BOOST_AUTO_TEST_SUITE_END()

0    const std::string uri{"localhost:8080/rest/headers/someresource.json"};

0 * if the key is not found or if uri_parsed is nullptr (most probably from a failed parsing).

0 * [@param](/bitcoin-bitcoin/contributor/param/)[in] uri_parsed is the uri parsed with libevent's evhttp_uri_parse

0test/httpserver_tests.cpp:18:12: error: constness of 'param_value' prevents automatic move [performance-no-automatic-move,-warnings-as-errors]
1    return param_value;
2           ^
3clang-tidy-14 --us

0    const std::string strURI{hreq->GetURI()};

  0diff --git i/src/httpserver.h w/src/httpserver.h
  1index 5b21a678c5..d7cd81be7e 100644
  2--- i/src/httpserver.h
  3+++ w/src/httpserver.h
  4@@ -55,13 +55,16 @@ struct event_base* EventBase();
  5  * Thin C++ wrapper around evhttp_request.
  6  */
  7 class HTTPRequest
  8 {
  9 private:
 10     struct evhttp_request* req;
 11-    evhttp_uri* m_uri_parsed{nullptr};
 12+    /// The URI, as returned by `evhttp_request_get_uri()`. Will never be `nullptr`.
 13+    const char* const m_uri;
 14+    /// The parsed URI, as returned by `evhttp_uri_parse()`. Will never be `nullptr`.
 15+    evhttp_uri* const m_uri_parsed;
 16     bool replySent;
 17 
 18 public:
 19     explicit HTTPRequest(struct evhttp_request* req, bool replySent = false);
 20     ~HTTPRequest();
 21 
 22diff --git i/src/httpserver.cpp w/src/httpserver.cpp
 23index e9b68a36c1..45d25bc32f 100644
 24--- i/src/httpserver.cpp
 25+++ w/src/httpserver.cpp
 26@@ -238,14 +238,14 @@ static void http_request_cb(struct evhttp_request* req, void* arg)
 27     }
 28 
 29     std::unique_ptr<HTTPRequest> hreq;
 30 
 31     try {
 32         hreq = std::make_unique<HTTPRequest>(req);
 33-    } catch (const std::system_error& e) {
 34-        LogPrint(BCLog::HTTP, "%d %s\n", e.code().value(), e.what());
 35+    } catch (const std::runtime_error& e) {
 36+        LogPrint(BCLog::HTTP, "%s\n", e.what());
 37         return;
 38     }
 39 
 40     // Early address-based allow check
 41     if (!ClientAllowed(hreq->GetPeer())) {
 42         LogPrint(BCLog::HTTP, "HTTP request from %s rejected: Client network is not allowed RPC access\n",
 43@@ -543,34 +543,33 @@ void HTTPEvent::trigger(struct timeval* tv)
 44         event_active(ev, 0, 0); // immediately trigger event in main thread
 45     else
 46         evtimer_add(ev, tv); // trigger after timeval passed
 47 }
 48 HTTPRequest::HTTPRequest(struct evhttp_request* _req, bool _replySent) :
 49         req{_req},
 50+        m_uri{evhttp_request_get_uri(req)},
 51+        m_uri_parsed{m_uri != nullptr && m_uri[0] != '\0' ? evhttp_uri_parse(m_uri) : nullptr},
 52         replySent{_replySent}
 53 {
 54-    const char* uri_to_parse{GetURI()};
 55-    if (uri_to_parse != nullptr && uri_to_parse[0] != '\0') m_uri_parsed = evhttp_uri_parse(uri_to_parse);
 56-
 57-    if (!m_uri_parsed) {
 58-        const int code{HTTP_BAD_REQUEST};
 59-        const char* what{"Invalid URI"};
 60-        WriteReply(code, what);
 61-        throw std::system_error(code, std::generic_category(), what);
 62+    if (m_uri_parsed == nullptr) {
 63+        const char* err{"Invalid URI"};
 64+        WriteReply(HTTP_BAD_REQUEST, err);
 65+        throw std::runtime_error(
 66+            strprintf("HTTP request from %s rejected: %s", GetPeer().ToStringAddr(), err));
 67     }
 68 }
 69 
 70 HTTPRequest::~HTTPRequest()
 71 {
 72     // evhttpd cleans up the request, as long as a reply was sent.
 73     if (!replySent) {
 74         // Keep track of whether reply was sent to avoid request leaks
 75         LogPrintf("%s: Unhandled request\n", __func__);
 76         WriteReply(HTTP_INTERNAL_SERVER_ERROR, "Unhandled request");
 77     }
 78-    if (m_uri_parsed) evhttp_uri_free(m_uri_parsed);
 79+    evhttp_uri_free(m_uri_parsed);
 80 }
 81 
 82 std::pair<bool, std::string> HTTPRequest::GetHeader(const std::string& hdr) const
 83 {
 84     const struct evkeyvalq* headers = evhttp_request_get_input_headers(req);
 85     assert(headers);
 86@@ -662,13 +661,13 @@ CService HTTPRequest::GetPeer() const
 87     }
 88     return peer;
 89 }
 90 
 91 const char* HTTPRequest::GetURI() const
 92 {
 93-    return evhttp_request_get_uri(req);
 94+    return m_uri;
 95 }
 96 
 97 HTTPRequest::RequestMethod HTTPRequest::GetRequestMethod() const
 98 {
 99     switch (evhttp_request_get_command(req)) {
100     case EVHTTP_REQ_GET:

0    /** Get requested URI. Will always return non-nullptr.

 0diff --git i/src/httpserver.cpp w/src/httpserver.cpp
 1index e9b68a36c1..1dccb196be 100644
 2--- i/src/httpserver.cpp
 3+++ w/src/httpserver.cpp
 4@@ -683,20 +683,18 @@ HTTPRequest::RequestMethod HTTPRequest::GetRequestMethod() const
 5         return UNKNOWN;
 6     }
 7 }
 8 
 9 std::optional<std::string> HTTPRequest::GetQueryParameter(const std::string& key) const
10 {
11-    if (!Assume(m_uri_parsed)) return std::nullopt;  // HTTPRequest constructor should have checked that m_uri_parsed is not nullptr
12-    return GetQueryParameterFromUri(m_uri_parsed, key);
13+    return GetQueryParameterFromUri(*m_uri_parsed, key);
14 }
15 
16-std::optional<std::string> GetQueryParameterFromUri(const evhttp_uri* uri_parsed, const std::string& key)
17+std::optional<std::string> GetQueryParameterFromUri(const evhttp_uri& uri_parsed, const std::string& key)
18 {
19-    if (!uri_parsed) return std::nullopt;
20-    const char* query{evhttp_uri_get_query(uri_parsed)};
21+    const char* query{evhttp_uri_get_query(&uri_parsed)};
22     std::optional<std::string> result;
23 
24     if (query) {
25         // Parse the query string into a key-value queue and iterate over it
26         struct evkeyvalq params_q;
27         evhttp_parse_query_str(query, &params_q);
28diff --git i/src/httpserver.h w/src/httpserver.h
29index 5b21a678c5..3f2ef06c11 100644
30--- i/src/httpserver.h
31+++ w/src/httpserver.h
32@@ -126,24 +126,24 @@ public:
33      * main thread, do not call any other HTTPRequest methods after calling this.
34      */
35     void WriteReply(int nStatus, const std::string& strReply = "");
36 };
37 
38 /** Get the query parameter value from a evhttp_uri (parsed) object for a specified key, or std::nullopt
39- * if the key is not found or if uri_parsed argument is nullptr (most probably from a failed parsing).
40+ * if the key is not found.
41  *
42  * If the query string contains duplicate keys, the first value is returned. Many web frameworks
43  * would instead parse this as an array of values, but this is not (yet) implemented as it is
44  * currently not needed in any of the endpoints.
45  *
46  * Helper function for HTTPRequest::GetQueryParameter.
47  *
48  * [@param](/bitcoin-bitcoin/contributor/param/)[in] uri_parsed is the uri parsed with libevent's evhttp_uri_parse
49  * [@param](/bitcoin-bitcoin/contributor/param/)[in] key represents the query parameter of which the value is returned
50  */
51-std::optional<std::string> GetQueryParameterFromUri(const evhttp_uri* uri_parsed, const std::string& key);
52+std::optional<std::string> GetQueryParameterFromUri(const evhttp_uri& uri_parsed, const std::string& key);
53 
54 /** Event handler closure.
55  */
56 class HTTPClosure
57 {
58 public:
59diff --git i/src/test/httpserver_tests.cpp w/src/test/httpserver_tests.cpp
60index 120c6d102f..6e2128863d 100644
61--- i/src/test/httpserver_tests.cpp
62+++ w/src/test/httpserver_tests.cpp
63@@ -13,13 +13,13 @@
64 #include <boost/test/unit_test.hpp>
65 
66 BOOST_FIXTURE_TEST_SUITE(httpserver_tests, BasicTestingSetup)
67 
68 std::optional<std::string> GetParameterFromURI(const std::string_view uri, const std::string& key){
69     auto uri_parsed{evhttp_uri_parse(uri.data())};
70-    auto param_value{GetQueryParameterFromUri(uri_parsed, key)};
71+    auto param_value{GetQueryParameterFromUri(*uri_parsed, key)};
72     if(uri_parsed) evhttp_uri_free(uri_parsed);
73     return param_value;
74 }
75 
76 /** Test if query parameter exists in the provided uri. */
77 bool QueryParameterExists(const std::string_view uri, const std::string& key)

0    auto uri_parsed{evhttp_uri_parse(uri.data())}; // ends up nullptr
1    auto param_value{GetQueryParameterFromUri(*uri_parsed, key)}; // crash here, before calling GetQueryParameterFromUri().

0    if (uri_parsed) evhttp_uri_free(uri_parsed);

0        throw std::runtime_error("URI parsing failed, it likely contained RFC 3986 invalid characters);

 0diff --git a/src/httpserver.cpp b/src/httpserver.cpp
 1index eb1f0bd93..3f0d82497 100644
 2--- a/src/httpserver.cpp
 3+++ b/src/httpserver.cpp
 4@@ -667,13 +667,7 @@ std::optional<std::string> HTTPRequest::GetQueryParameter(const std::string& key
 5 {
 6     const char* uri{evhttp_request_get_uri(req)};
 7 
 8-    try {
 9-        return GetQueryParameterFromUri(uri, key);
10-    } catch (const std::runtime_error& e) {
11-        LogPrint(BCLog::HTTP, "%s\n", e.what());
12-        // add additional information and rethrow the exception as we can't send a reply from the worker
13-        throw std::runtime_error(strprintf("Error occurred trying to get query param key \"%s\": ", key) + e.what());
14-    }
15+    return GetQueryParameterFromUri(uri, key);
16 }
17 
18 std::optional<std::string> GetQueryParameterFromUri(const char* uri, const std::string& key)
19diff --git a/test/functional/interface_rest.py b/test/functional/interface_rest.py
20index fa6193039..fb647a62f 100755
21--- a/test/functional/interface_rest.py
22+++ b/test/functional/interface_rest.py
23@@ -282,7 +282,7 @@ class RESTTest (BitcoinTestFramework):
24 
25         # Check invalid uri (% symbol at the end of the request)
26         resp = self.test_rest_request(f"/headers/{bb_hash}%", ret_type=RetType.OBJ, status=400)
27-        assert_equal(resp.read().decode('utf-8').rstrip(), f"Error occurred trying to get query param key \"count\": Invalid uri detected while parsing \"/rest/headers/{bb_hash}%.json\"")
28+        assert_equal(resp.read().decode('utf-8').rstrip(), f"Invalid uri detected while parsing \"/rest/headers/{bb_hash}%.json\"")
29 
30         # Compare with normal RPC block response
31         rpc_block_json = self.nodes[0].getblock(bb_hash)

0    // URI with invalid characters (%) raises a runtime error regardless of which query parameter is queried

0    return Assert(m_uri);

0    /** Get requested URI. Will never return nullptr.

0        const std::string err{"URI parsing failed, it likely contained RFC 3986 invalid characters"};

 0diff --git a/src/httpserver.cpp b/src/httpserver.cpp
 1index f7dc344f4..10f8ec24d 100644
 2--- a/src/httpserver.cpp
 3+++ b/src/httpserver.cpp
 4@@ -235,6 +235,7 @@ static void http_request_cb(struct evhttp_request* req, void* arg)
 5     }
 6     std::unique_ptr<HTTPRequest> hreq;
 7 
 8+    // Initializing the HTTPRequest also performs basic validation such as address, method and URI checks
 9     try {
10         hreq = std::make_unique<HTTPRequest>(req);
11     } catch (const std::runtime_error& e) {
12@@ -242,22 +243,6 @@ static void http_request_cb(struct evhttp_request* req, void* arg)
13         return;
14     }
15 
16-    // Early address-based allow check
17-    if (!ClientAllowed(hreq->GetPeer())) {
18-        LogPrint(BCLog::HTTP, "HTTP request from %s rejected: Client network is not allowed RPC access\n",
19-                 hreq->GetPeer().ToStringAddrPort());
20-        hreq->WriteReply(HTTP_FORBIDDEN);
21-        return;
22-    }
23-
24-    // Early reject unknown HTTP methods
25-    if (hreq->GetRequestMethod() == HTTPRequest::UNKNOWN) {
26-        LogPrint(BCLog::HTTP, "HTTP request from %s rejected: Unknown HTTP request method\n",
27-                 hreq->GetPeer().ToStringAddrPort());
28-        hreq->WriteReply(HTTP_BAD_METHOD);
29-        return;
30-    }
31-
32     const std::string strURI{hreq->GetURI()};
33     LogPrint(BCLog::HTTP, "Received a %s request for %s from %s\n",
34              RequestMethodString(hreq->GetRequestMethod()), SanitizeString(strURI, SAFE_CHARS_URI).substr(0, 100), hreq->GetPeer().ToStringAddrPort());
35@@ -545,13 +530,7 @@ HTTPRequest::HTTPRequest(struct evhttp_request* _req) :
36         m_uri{req != nullptr ? evhttp_request_get_uri(req) : nullptr},
37         m_uri_parsed{m_uri != nullptr ? evhttp_uri_parse(m_uri) : nullptr}
38 {
39-    if (m_uri_parsed == nullptr) {
40-        const char* err{"URI parsing failed, it likely contained RFC 3986 invalid characters"};
41-        const std::string peerAddress{GetPeer().ToStringAddr()};
42-        WriteReply(HTTP_BAD_REQUEST, err);
43-        throw std::runtime_error(
44-            strprintf("HTTP request from %s rejected: %s", peerAddress, err));
45-    }
46+    Validate();
47 }
48 
49 HTTPRequest::~HTTPRequest()
50@@ -565,6 +544,29 @@ HTTPRequest::~HTTPRequest()
51     evhttp_uri_free(m_uri_parsed);
52 }
53 
54+void HTTPRequest::Validate()
55+{
56+    const std::string rejected{strprintf("HTTP request from %s rejected: ", GetPeer().ToStringAddrPort())};
57+    // Early address-based allow check
58+    if (!ClientAllowed(GetPeer())) {
59+        WriteReply(HTTP_FORBIDDEN);
60+        throw std::runtime_error(rejected + "Client network is not allowed RPC access");
61+    }
62+
63+    // Early reject unknown HTTP methods
64+    if (GetRequestMethod() == HTTPRequest::UNKNOWN) {
65+        WriteReply(HTTP_BAD_METHOD);
66+        throw std::runtime_error(rejected + "Unknown HTTP request method");
67+    }
68+
69+    // Ensure valid URI
70+    if (m_uri_parsed == nullptr) {
71+        const std::string err{"URI parsing failed, it likely contained RFC 3986 invalid characters"};
72+        WriteReply(HTTP_BAD_REQUEST, err);
73+        throw std::runtime_error(rejected + err);
74+    }
75+}
76+
77 std::pair<bool, std::string> HTTPRequest::GetHeader(const std::string& hdr) const
78 {
79     const struct evkeyvalq* headers = evhttp_request_get_input_headers(req);
80diff --git a/src/httpserver.h b/src/httpserver.h
81index 77a249a6a..3c5af5b0b 100644
82--- a/src/httpserver.h
83+++ b/src/httpserver.h
84@@ -64,6 +64,9 @@ private:
85     /// The parsed URI, as returned by `evhttp_uri_parse()`. Will never be `nullptr`.
86     evhttp_uri* const m_uri_parsed;
87 
88+    // Perform early validity checks. Send a response and throw std::runtime_error if invalid.
89+    void Validate();
90+
91 public:
92     explicit HTTPRequest(struct evhttp_request* req);
93     ~HTTPRequest();