ubeddulla opened a new pull request, #3387: URL: https://github.com/apache/brpc/pull/3387
### What problem does this PR solve? Issue Number: Problem Summary: `MakeRawHttpRequest` and `MakeRawHttpResponse` write every header field-name and field-value straight onto the wire (`os << it->first << ": " << it->second << CRLF`), and emit `Content-Type` from `content_type()` the same way. When one of those values carries a raw CR or LF (for example a value that an application forwards from an untrusted request), it closes the current header line and the following bytes are parsed as extra header fields or a body, i.e. HTTP request/response splitting. The inbound `http_parser` already refuses these control bytes in header fields, but the outbound serializers trusted them. ### What is changed and the side effects? Changed: 1. Add `HeaderHasCRLF()` and, in both serializers, skip any header whose name or value contains CR or LF (a warning is logged). 2. Apply the same check to the `Content-Type` line in both functions. Side effects: - Performance effects: one `find_first_of` scan per emitted header; negligible. - Breaking backward compatibility: none for well-formed messages. A header field carrying a raw CR/LF is already malformed under RFC 7230 and is now dropped instead of being split onto the wire. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
