From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: X-Spam-Status: No, score=-4.0 required=3.0 tests=ALL_TRUSTED,BAYES_00 shortcircuit=no autolearn=ham autolearn_force=no version=3.4.0 Received: from localhost (dcvr.yhbt.net [127.0.0.1]) by dcvr.yhbt.net (Postfix) with ESMTP id 277C31FBEC for ; Sun, 5 Mar 2017 02:59:03 +0000 (UTC) From: Eric Wong To: kcar-public@bogomips.org Subject: [PATCH] http: reject non-LWS CTL chars (0..31 + 127) in field values Date: Sun, 5 Mar 2017 02:59:03 +0000 Message-Id: <20170305025903.11421-1-e@80x24.org> List-Id: RFC 2616 doesn't appear to allow most CTL bytes even though Mongrel always did. Rack::Lint disallows 0..31, too, though we allow "\t" (HT, 09) since it's LWS and allowed by RFC 2616. --- ext/kcar/kcar_http_common.rl | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ext/kcar/kcar_http_common.rl b/ext/kcar/kcar_http_common.rl index 36752b0..cb89248 100644 --- a/ext/kcar/kcar_http_common.rl +++ b/ext/kcar/kcar_http_common.rl @@ -21,6 +21,7 @@ pchar = (uchar | ":" | "@" | "&" | "=" | "+"); tspecials = ("(" | ")" | "<" | ">" | "@" | "," | ";" | ":" | "\\" | "\"" | "/" | "[" | "]" | "?" | "=" | "{" | "}" | " " | "\t"); lws = (" " | "\t"); + content = ((any -- CTL) | lws); # elements token = (ascii -- (CTL | tspecials)); @@ -32,9 +33,9 @@ field_name = ( token -- ":" )+ >start_field %write_field; - field_value = any* >start_value %write_value; + field_value = content* >start_value %write_value; - value_cont = lws+ any* >start_value %write_cont_value; + value_cont = lws+ content* >start_value %write_cont_value; message_header = ((field_name ":" lws* field_value)|value_cont) :> CRLF; chunk_ext_val = token*; -- EW