From 2cf1b3df5d58c716ada873f0ae7803142e3da362 Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Mon, 16 Nov 2015 23:55:01 +0000 Subject: http_response: allow nil values in response headers This blatantly violates Rack SPEC, but we've had this bug since March 2009[1]. Thus, we cannot expect all existing applications and middlewares to fix this bug and will probably have to support it forever. Unfortunately, supporting this bug contributes to application server lock-in, but at least we'll document it as such. [1] commit 1835c9e2e12e6674b52dd80e4598cad9c4ea1e84 ("HttpResponse: speed up non-multivalue headers") Reported-by: Owen Ou Ref: --- lib/unicorn/http_response.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/unicorn/http_response.rb b/lib/unicorn/http_response.rb index c1aa738..7b446c2 100644 --- a/lib/unicorn/http_response.rb +++ b/lib/unicorn/http_response.rb @@ -37,7 +37,7 @@ module Unicorn::HttpResponse # key in Rack < 1.5 hijack = value else - if value.include?("\n".freeze) + if value =~ /\n/ # avoiding blank, key-only cookies with /\n+/ value.split(/\n+/).each { |v| buf << "#{key}: #{v}\r\n" } else -- cgit v1.2.3-24-ge0c7