dxbjavid opened a new pull request, #900: URL: https://github.com/apache/httpcomponents-client/pull/900
RFC6265CookieSpec.formatCookies copies the cookie name and value into the Cookie request header without removing control characters. On the classic transport the header is serialised from the raw buffer of the BufferedHeader rather than its getValue(), so a cookie whose name or value was populated from attacker-influenced data and carries a CR or LF is written out verbatim and splits the Cookie line, which lets further request headers be injected. This replaces CR, LF and NUL with a space in the name and value before they are formatted, matching what BufferedHeader.getValue() already does when the value is read back and keeping cookie-name and cookie-value within what RFC 6265 permits. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
