pjfanning opened a new pull request, #1270:
URL: https://github.com/apache/pekko-http/pull/1270
cherry pick b9a6a41ea13440910137ad3807a1c44f3f2bbc3a #1256
Motivation:
`RenderSupport.renderChunk` emitted two attacker-influenced parts of a
chunked response without the CR/LF guard that the main header block relies on:
- Trailer headers were rendered with `r ~~ trailer`, which resolves to the
generic sequence renderer and calls `header.render` directly, bypassing the
`~~(HttpHeader)` overload whose `check` scans the rendered bytes for CR/LF and
drops the header. `HttpEntity.LastChunk` and `RawHeader` do no CR/LF
validation, so a trailer built from user data (e.g. `RawHeader("X-Trace",
"ok\r\nSet-Cookie: ..."))`) could split the response. The identical header
placed in the main header block is caught; only the trailer path let it through.
- The chunk extension was rendered raw into the chunk-size line (`r ~~ ';'
~~ extension`) with no CR/LF check, so a CR/LF in an app-set extension
corrupted the chunk framing.
Modification:
Render each trailer header through the guarded `~~(HttpHeader)` overload
(`trailer.foreach(r ~~ _)`), matching the main header block, and remove the
now-unused `trailerRenderer` implicit so the unguarded path cannot be
reintroduced by accident. Skip a chunk extension that contains CR/LF; the
extension is optional metadata, so omitting an illegal one is safe. Byte output
is unchanged for valid trailers and extensions.
Result:
CR/LF in a chunk trailer header value or a chunk extension can no longer
reach the wire; the offending header/extension is dropped, as in the main
header block, instead of splitting the response.
Tests:
- sbt "http-core/testOnly
org.apache.pekko.http.impl.engine.rendering.ResponseRendererSpec
org.apache.pekko.http.impl.engine.rendering.RequestRendererSpec" - pass (62
tests); two new tests assert a CRLF-bearing trailer header and a CRLF-bearing
chunk extension are dropped. Verified both fail with the fix stashed (the
injected bytes reach the output).
- sbt http-core/mimaReportBinaryIssues - pass (internal
impl.engine.rendering change, no public API).
References:
None - closes the CRLF-injection paths in chunked response rendering
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
