oscerd commented on PR #27944:
URL: https://github.com/apache/camel/pull/27944#issuecomment-6214346679
Thanks for the review. Both points are addressed in 333f977:
1. **Host header** — when `preserveHostHeader` is set, the producer wrote
the caller's own `Host` header verbatim outside the validated header-copy loop.
It now goes through `UndertowHelper.checkWriteable("Host header", ...)` before
the put, so a CR/LF there fails the exchange. I also validated the
`Content-Type` header, which `toHttpRequest` puts the same verbatim way. The
cookie values come from the component's cookie store (not the inbound message)
and their names already go through `HttpString`, so I left those as-is — happy
to extend if you prefer.
2. **Narrowing coverage** — added `rejectsNarrowingCharacterInQuery` (U+010A
in `CamelHttpQuery`) exercising the `ch > 0xFF` branch, plus
`rejectsCrlfInPreservedHostHeader` for the Host path above.
Full `camel-undertow` suite is green (234 run, 0 failures, 1 skipped);
`UndertowHttpProxyPreserveHostTest` still passes, so a legitimate preserved
Host header is unaffected.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
