diff options
| author | Damien Neil <dneil@google.com> | 2022-06-01 11:17:07 -0700 |
|---|---|---|
| committer | Michael Knyszek <mknyszek@google.com> | 2022-07-12 14:50:47 +0000 |
| commit | 222ee24a0046ae61679f4d97967e3b4058a3b90e (patch) | |
| tree | 1444c8d162b3e13bf7e2947329b4860ebf7eaa49 | |
| parent | 93aab1813930fd3e936d13cb2d0729a8b60aa541 (diff) | |
| download | go-222ee24a0046ae61679f4d97967e3b4058a3b90e.tar.gz go-222ee24a0046ae61679f4d97967e3b4058a3b90e.zip | |
[release-branch.go1.18] net/http: don't strip whitespace from Transfer-Encoding headers
Do not accept "Transfer-Encoding: \rchunked" as a valid TE header
setting chunked encoding.
Thanks to Zeyu Zhang (https://www.zeyu2001.com/) for identifying
the issue.
For #53188
For CVE-2022-1705
Fixes #53433
Change-Id: I1a16631425159267f2eca68056b057192a7edf6c
Reviewed-on: https://go-review.googlesource.com/c/go/+/409874
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
(cherry picked from commit e5017a93fcde94f09836200bca55324af037ee5f)
Reviewed-on: https://go-review.googlesource.com/c/go/+/415218
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
| -rw-r--r-- | src/net/http/serve_test.go | 1 | ||||
| -rw-r--r-- | src/net/http/transfer.go | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go index fb18cb2c6f..3f3e1421a9 100644 --- a/src/net/http/serve_test.go +++ b/src/net/http/serve_test.go @@ -6250,6 +6250,7 @@ func TestUnsupportedTransferEncodingsReturn501(t *testing.T) { "fugazi", "foo-bar", "unknown", + "\rchunked", } for _, badTE := range unsupportedTEs { diff --git a/src/net/http/transfer.go b/src/net/http/transfer.go index 6d51178ee9..de69d835ac 100644 --- a/src/net/http/transfer.go +++ b/src/net/http/transfer.go @@ -640,7 +640,7 @@ func (t *transferReader) parseTransferEncoding() error { if len(raw) != 1 { return &unsupportedTEError{fmt.Sprintf("too many transfer encodings: %q", raw)} } - if !ascii.EqualFold(textproto.TrimString(raw[0]), "chunked") { + if !ascii.EqualFold(raw[0], "chunked") { return &unsupportedTEError{fmt.Sprintf("unsupported transfer encoding: %q", raw[0])} } |