diff options
| author | Damien Neil <dneil@google.com> | 2022-06-01 11:17:07 -0700 |
|---|---|---|
| committer | Michael Knyszek <mknyszek@google.com> | 2022-07-12 14:50:37 +0000 |
| commit | d13431c37ab62f9755f705731536ff74e7165b08 (patch) | |
| tree | 72919ee718ca3dd39d749c1c62af4a1f42edba9c /src/net/http/header_test.go | |
| parent | ae2dfcc1c8891a7610f2d31d457427b71ed9c6e0 (diff) | |
| download | go-d13431c37ab62f9755f705731536ff74e7165b08.tar.gz go-d13431c37ab62f9755f705731536ff74e7165b08.zip | |
[release-branch.go1.17] net/http: don't strip whitespace from Transfer-Encoding headers
Do not accept "Transfer-Encoding: \rchunked" as a valid TE header
setting chunked encoding.
Thanks to Zeyu Zhang (https://www.zeyu2001.com/) for identifying
the issue.
For #53188
For CVE-2022-1705
Fixes #53432
Change-Id: I1a16631425159267f2eca68056b057192a7edf6c
Reviewed-on: https://go-review.googlesource.com/c/go/+/409874
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
(cherry picked from commit e5017a93fcde94f09836200bca55324af037ee5f)
Reviewed-on: https://go-review.googlesource.com/c/go/+/415217
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Diffstat (limited to 'src/net/http/header_test.go')
0 files changed, 0 insertions, 0 deletions