restsharp / RestSharp

Simple REST and HTTP API Client for .NET
https://restsharp.dev
Apache License 2.0
9.63k stars 2.34k forks source link

Don't allow CRLF in headers #2258

Closed alexeyzimarev closed 3 months ago

alexeyzimarev commented 3 months ago

Description

Fixes potential exposure of applications that use RestSharp and allow users to provide header values to execute a request with CRLF in the header value possibly causing SSRF.

Purpose

This pull request is a:

It's breaking change since some users might be required to send invalid header values. Also, the new version is not binary-compatible with the previous version, so the fix will be released as a major version.