pjfanning opened a new pull request, #1272: URL: https://github.com/apache/pekko-http/pull/1272
cherry pick 6cd9e7b80dd3c8eb23deeb49e36b2b9c0f82a912 #1260 Motivation: The guard in `Rendering.~~(HttpHeader)` renders a header and then scans the rendered bytes, discarding the header if it finds one of the characters that must never reach the wire. It only looked for CR and LF, so a `RawHeader` value carrying a NUL was rendered as-is. NUL is not a legal field-value character, and a downstream consumer that treats the value as a C string truncates it there, so two parties can disagree about where the value ends. The HTTP/2 renderer rejects CR, LF and NUL alike, so HTTP/1.1 was the weaker of the two. Modification: Add `Rendering.isIllegalHeaderChar`, which covers CR, LF and NUL, and use it from all four `check` implementations (`StringRendering`, `ByteArrayRendering`, `ByteStringRendering` and `CustomCharsetByteStringRendering`) instead of repeating the character comparison a fourth time. It takes an `Int` so the `Char` and `Byte` based renderings can pass their element straight in. Result: A header whose name or value contains NUL is discarded like one containing CR or LF, on every rendering implementation, and the rule now lives in one place. Tests: - sbt "http-core/testOnly org.apache.pekko.http.impl.util.RenderingSpec org.apache.pekko.http.impl.engine.rendering.ResponseRendererSpec org.apache.pekko.http.impl.engine.rendering.RequestRendererSpec" - pass (80 tests); a new case in the shared rendering table asserts a header with NUL in the value is discarded. Verified it fails with the fix stashed, once for each of the four renderings. - sbt http-core/mimaReportBinaryIssues - pass (internal impl.util change, no public API). References: None - extends the outgoing header guard to NUL -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
