File 0813-erts-Do-not-allow-whitespace-in-http-heade... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 0813-erts-Do-not-allow-whitespace-in-http-header-at-all.patch of Package erlang (Revision 92a9db5911968ad774442444386cc5b8)

Currently displaying revision 92a9db5911968ad774442444386cc5b8 , Show latest

From 2407480445e6f8f34c886b1bdad2f38034e62a9f Mon Sep 17 00:00:00 2001
From: Lukas Larsson <lukas@erlang.org>
Date: Fri, 8 Nov 2019 13:31:48 +0100
Subject: [PATCH] erts: Do not allow whitespace in http header at all

In RFC 7230 headers must not include any whitespaces because
of security reasons. This change returns a http_error
when a header ends with a whitespace. i.e. The below is no longer
allowed:

Host : localhost:8000
---
 erts/emulator/beam/packet_parser.c         |  3 ---
 erts/emulator/test/decode_packet_SUITE.erl | 12 +++++++++---
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/erts/emulator/beam/packet_parser.c b/erts/emulator/beam/packet_parser.c
index 4b526887b5..c0937aa5f2 100644
--- a/erts/emulator/beam/packet_parser.c
+++ b/erts/emulator/beam/packet_parser.c
@@ -816,9 +816,6 @@ int packet_parse_http(const char* buf, int len, int* statep,
             ptr++;
             if (--n == 0) return -1;
         }
-        while (n && SP(ptr)) { /* Skip white space before ':' */
-            ptr++; n--;
-        } 
         if (*ptr != ':') {
             return -1;
         }
diff --git a/erts/emulator/test/decode_packet_SUITE.erl b/erts/emulator/test/decode_packet_SUITE.erl
index ef13b515fb..d0f46167e4 100644
--- a/erts/emulator/test/decode_packet_SUITE.erl
+++ b/erts/emulator/test/decode_packet_SUITE.erl
@@ -330,6 +330,15 @@ http(Config) when is_list(Config) ->
     %% Response with empty phrase
     {ok,{http_response,{1,1},200,[]},<<>>} = decode_pkt(http, <<"HTTP/1.1 200\r\n">>, []),
     {ok,{http_response,{1,1},200,<<>>},<<>>} = decode_pkt(http_bin, <<"HTTP/1.1 200\r\n">>, []),
+
+
+    %% Test error cases
+    {ok,{http_error,"Host\t: localhost:8000\r\n"},<<"a">>} =
+        decode_pkt(httph, <<"Host\t: localhost:8000\r\na">>, []),
+    {ok,{http_error,"Host : localhost:8000\r\n"},<<"a">>} =
+        decode_pkt(httph, <<"Host : localhost:8000\r\na">>, []),
+    {ok,{http_error," : localhost:8000\r\n"},<<"a">>} =
+        decode_pkt(httph, <<" : localhost:8000\r\na">>, []),
     ok.
 
 http_with_bin(http) ->
@@ -366,9 +375,6 @@ http_request(Msg) ->
            {"Connection: close\r\n",
             {http_header,2,'Connection',undefined,  "close"},
             {http_header,2,'Connection',undefined,<<"close">>}},	 
-           {"Host\t : localhost:8000\r\n", % white space before :
-            {http_header,14,'Host',undefined,  "localhost:8000"},
-            {http_header,14,'Host',undefined,<<"localhost:8000">>}},
            {"User-Agent: perl post\r\n",
             {http_header,24,'User-Agent',undefined,  "perl post"},
             {http_header,24,'User-Agent',undefined,<<"perl post">>}},
-- 
2.16.4

Places

File 0813-erts-Do-not-allow-whitespace-in-http-header-at-all.patch of Package erlang (Revision 92a9db5911968ad774442444386cc5b8)

Places