search

valyala / fasthttp

Fast HTTP package for Go. Tuned for high performance. Zero memory allocations in hot paths. Up to 10x faster than net/http
MIT License
21.94k stars 1.76k forks source link

Don't allow \r in header names #1789

Closed erikdubbelboer closed 5 months ago

erikdubbelboer commented 5 months ago

From RFC 9112:

  A sender MUST NOT generate a bare CR (a CR character not immediately
  followed by LF) within any protocol elements other than the content.
  A recipient of such a bare CR MUST consider that element to be invalid
  or replace each bare CR with SP before processing the element or forwarding
  the message.

net/http seems to completely error on this, so let's do the same.

Fixes https://github.com/valyala/fasthttp/issues/1785

See: https://go.dev/play/p/EmMgzC_yLvN

kenballus commented 5 months ago

This patch looks good, but it could be improved by rejecting more characters than just \t, \r, and .

The RFCs define header names with the following grammar rules:

field-name = token
token = 1*tchar
tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA

Thus, all of the following characters should also be prohibited in field-names, in addition to \r, `, and\t`:

net/http errors on all of these characters.

erikdubbelboer commented 5 months ago

Good point, I have no changed it to check all characters.