qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-23 21:20:03 -07:00
Code Releases Activity

net/http: fix too-strict validation of server header values

Browse Source 
As Andy Balholm noted in #11207:

"RFC2616 §4.2 says that a header's field-content can consist of *TEXT,
and RFC2616 §2.2 says that TEXT is <any OCTET except CTLs, but
including LWS>, so that would mean that bytes greater than 128 are
allowed."

This is a partial rollback of the strictness from
https://golang.org/cl/11207 (added in the Go 1.6 dev cycle, only
released in Go 1.6beta1)

Fixes #11207

Change-Id: I3a752a7941de100e4803ff16a5d626d5cfec4f03
Reviewed-on: https://go-review.googlesource.com/18374
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Andrew Gerrand <adg@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Brad Fitzpatrick 2016-01-08 01:06:00 +00:00
parent ee566d53ad
commit 0421e78f05
2 changed files with 4 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/net/http/request.go
View File

@ -1139,13 +1139,9 @@ func validHeaderName(v string) bool {
func validHeaderValue(v string) bool {
for i := 0; i < len(v); i++ {
b := v[i]
if b == '\t' {
continue
if b < ' ' && b != '\t' {
return false
}
if ' ' <= b && b <= '~' {
continue
}
return false
}
return true
}

4
src/net/http/serve_test.go
View File

@ -3798,8 +3798,8 @@ func TestServerValidatesHeaders(t *testing.T) {
{"foo\xffbar: foo\r\n", 400}, // binary in header
{"foo\x00bar: foo\r\n", 400}, // binary in header
{"foo: foo\x00foo\r\n", 400}, // binary in value
{"foo: foo\xfffoo\r\n", 400}, // binary in value
{"foo: foo\x00foo\r\n", 400}, // CTL in value is bad
{"foo: foo\xfffoo\r\n", 200}, // non-ASCII high octets in value are fine
}
for _, tt := range tests {
conn := &testConn{closec: make(chan bool)}