Hello, On Wed, Aug 12, 2026 at 11:42:33PM +0530, M2000 Slash wrote: > hlua_http_add_hdr() rejects CR/LF/NUL in header names and values, > but three other functions that write headers from Lua don't: > > - hlua_applet_http_addheader() > - hlua_txn_reply_add_header() > - hlua_http_rep_hdr() > > Without this check, CRLF bytes in values passed through these > functions reach the wire unfiltered via h1_format_htx_hdr(). > > Add the same byte-scan loop to all three. For hlua_http_rep_hdr() > only the replacement value needs checking since existing header > values were already validated at ingress.
Thanks, but I'd go further by preventing *any* ctrl-char from being emitted since that's normally forbidden (we're not just relaying something here but producing so there's no excuse for doing so). Also instead of open-coding the test everywhere, better simply use if (HTTP_IS_CTL(c)) to match them. Finally, please be careful, your email client mangled spaces/tabs in your patch, see below. If you can't figure how to fix it, feel free to send the patch attached. Thanks! Willy > Signed-off-by: Mohammed sarfaraz [email protected] > --- > Addresses the CRLF gap I reported privately. Three functions > missed by the original hlua_http_add_hdr() fix in 3.4-dev14. > Fixed the declaration ordering you flagged. > > src/hlua.c | 37 +++++++++++++++++++++++++++++++----- > 1 file changed, 32 insertions(+), 5 deletions(-) > > diff --git a/src/hlua.c b/src/hlua.c > --- a/src/hlua.c > +++ b/src/hlua.c > @@ -6089,9 +6089,22 @@ __LJMP static int > hlua_applet_http_addheader(lua_State *L) > { > const char *name; > + size_t name_len; > + const char *value; > + size_t value_len; > int ret; > + size_t i; > > MAY_LJMP(hlua_checkapplet_http(L, 1)); > - name = MAY_LJMP(luaL_checkstring(L, 2)); > - MAY_LJMP(luaL_checkstring(L, 3)); > + name = MAY_LJMP(luaL_checklstring(L, 2, &name_len)); > + value = MAY_LJMP(luaL_checklstring(L, 3, &value_len)); > + > + for (i = 0; i < name_len; i++) { > + if (name[i] == 0 || name[i] == '\r' || name[i] == '\n') > + WILL_LJMP(lua_error(L)); > + } > + for (i = 0; i < value_len; i++) { > + if (value[i] == 0 || value[i] == '\r' || value[i] == '\n') > + WILL_LJMP(lua_error(L)); > + } (...)
