FrankChen021 opened a new pull request, #19812: URL: https://github.com/apache/druid/pull/19812
## What changed - Validate the fully constructed redirect target before placing it in the `Location` response header. - Reject redirect targets containing literal carriage returns or line feeds with HTTP 400. - Preserve ordinary redirects and percent-encoded `%0D`/`%0A` URL data. - Add focused tests for normal, encoded, CR, and LF cases. ## Why `RedirectFilter` copied a URL derived from request data directly into the `Location` header. `java.net.URL` permits literal CR/LF characters, which could allow HTTP response splitting in servlet containers that do not reject them independently. ## Impact Legitimate redirect targets retain their exact URL representation. Requests that would produce a raw newline in the response header are rejected before the response status or header is set. ## Validation - `mvn -ntp test -pl server -am -Dtest=org.apache.druid.server.http.RedirectFilterTest -Dsurefire.failIfNoSpecifiedTests=false -Pskip-static-checks -Dweb.console.skip=true -T1C` - `mvn -ntp test -pl server -Dtest=org.apache.druid.server.http.RedirectFilterTest -Dweb.console.skip=true -Pskip-static-checks` - `mvn -ntp checkstyle:check -pl server -Dweb.console.skip=true` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
