File SQUID-2020_1.patch of Package squid.15550

commit 8e657e835965c3a011375feaa0359921c5b3e2dd (refs/remotes/origin/v3.5)
Author: Amos Jeffries <yadij@users.noreply.github.com>
Date:   2019-08-13 13:50:06 +0000

    Ignore malformed Host header in intercept and reverse proxy mode (#456)

From 21d99bdeaed7b2208098d824496da954920ea720 Mon Sep 17 00:00:00 2001
From: Armin Wolfermann <aw@osn.de>
Date: Tue, 4 Feb 2020 21:15:00 +0100
Subject: [PATCH] fix security patch

Index: squid-3.5.21/src/client_side.cc
===================================================================
--- squid-3.5.21.orig/src/client_side.cc
+++ squid-3.5.21/src/client_side.cc
@@ -2018,6 +2018,23 @@ setLogUri(ClientHttpRequest * http, char
     }
 }
 
+static char *
+getHostHeader(const char *req_hdr)
+{
+    char *host = mime_get_header(req_hdr, "Host");
+    if (!host)
+        return NULL;
+
+    // check the header contents are valid
+    for(const char *c = host; *c != '\0'; ++c) {
+        // currently only used for pre-parse Host header, ensure valid domain[:port] or ip[:port]
+        static const CharacterSet hostChars = CharacterSet("host",":[].-_") + CharacterSet::ALPHA + CharacterSet::DIGIT;
+        if (!hostChars[*c])
+            return NULL; // error. line contains character not accepted in Host header
+    }
+    return host;
+}
+
 static void
 prepareAcceleratedURL(ConnStateData * conn, ClientHttpRequest *http, char *url, const char *req_hdr)
 {
@@ -2060,9 +2077,9 @@ prepareAcceleratedURL(ConnStateData * co
 
     const bool switchedToHttps = conn->switchedToHttps();
     const bool tryHostHeader = vhost || switchedToHttps;
-    if (tryHostHeader && (host = mime_get_header(req_hdr, "Host")) != NULL) {
+    if (tryHostHeader && (host = getHostHeader(req_hdr)) != NULL && strlen(host) <= SQUIDHOSTNAMELEN) {
         debugs(33, 5, "ACCEL VHOST REWRITE: vhost=" << host << " + vport=" << vport);
-        char thost[256];
+        char thost[SQUIDHOSTNAMELEN + 6 /* ':' vport */];
         if (vport > 0) {
             thost[0] = '\0';
             char *t = NULL;
@@ -2119,7 +2136,7 @@ prepareTransparentURL(ConnStateData * co
 
     /* BUG: Squid cannot deal with '*' URLs (RFC2616 5.1.2) */
 
-    if ((host = mime_get_header(req_hdr, "Host")) != NULL) {
+    if ((host = getHostHeader(req_hdr)) != NULL) {
         int url_sz = strlen(url) + 32 + Config.appendDomainLen +
                      strlen(host);
         http->uri = (char *)xcalloc(url_sz, 1);