dotnet / aspnetcore

ASP.NET Core is a cross-platform .NET framework for building modern cloud-based web applications on Windows, Mac, or Linux.
https://asp.net
MIT License
35.35k stars 9.99k forks source link

Adding a header with a space will crash without exception #18032

Closed PeterPann23 closed 4 years ago

PeterPann23 commented 4 years ago

Describe the bug

when the user add a header with a space say "powered by" and not "powered-by" the middleware pipeline will cause a status 500 error while the middleware pipeline continues executing, no error is given

To Reproduce

internal class HeadersMiddleware
{
    private readonly RequestDelegate _next;
    ILogger<HeadersMiddleware> logger;
    public HeadersMiddleware(RequestDelegate next, ILogger<HeadersMiddleware> logger)
    {
        _next = next;
        this.logger = logger;
    }

    public async Task Invoke(HttpContext context)
    {
        foreach (var header in RemoveHeaders)
        {
            context.Response.Headers.Remove(header);
        }

        foreach (var headerValuePair in SetHeaders)
        {
            logger.LogInformation($"adding {headerValuePair.Key} header");
            context.Response.Headers[headerValuePair.Key] = new StringValues(headerValuePair.Value);
            logger.LogInformation($"added {headerValuePair.Key} header");
        }
        await _next(context);
    }

    private List<string> RemoveHeaders=new List<string>(){"Server","x-powered-by"};
    private Dictionary<string,string> SetHeaders=new Dictionary<string,string>(){{"bad header","some value"},{"X-XSS-Protection","1; mode=block"}};
}

Further technical details

blowdart commented 4 years ago

By crash I assume you mean an exception? In which case this is correct. You can't put spaces in header names

ghost commented 4 years ago

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

See our Issue Management Policies for more information.