Issue #8716 - Handle bad host/authority headers better #8717
Conversation
Signed-off-by: Joakim Erdfelt <[email protected]>
…t headers Signed-off-by: Joakim Erdfelt <[email protected]>
joakime
added
the
Specification
Signed-off-by: Joakim Erdfelt <[email protected]>
|
@joakime @gregw I'm on the fence about this PR. I think we should fix the double If someone sends Looking for |
Signed-off-by: Joakim Erdfelt <[email protected]>
jetty-security/src/test/java/org/eclipse/jetty/security/ConstraintTest.java
Show resolved
Hide resolved
Signed-off-by: Joakim Erdfelt <[email protected]>
Signed-off-by: Joakim Erdfelt <[email protected]>
…invalid-host-headers
Signed-off-by: Joakim Erdfelt <[email protected]>
|
|
||
| static | ||
| { | ||
| REGNAME_ALLOWED = new boolean[127]; |
| REGNAME_ALLOWED[c] = true; | ||
| } | ||
| } | ||
|
|
||
| // Use UTF-8 as per http://www.w3.org/TR/html40/appendix/notes.html#non-ascii-chars | ||
| public static final Charset __CHARSET = StandardCharsets.UTF_8; |
There was a problem hiding this comment.
Make private and possibly remove the constant altogether.
There was a problem hiding this comment.
Cool, lemme do this in a different PR
There was a problem hiding this comment.
Actually, can't do this for Jetty 10.0.x (where this PR is).
BUT I will do it for Jetty 12.0.x
There was a problem hiding this comment.
Took care of this (along with other URIUtil cleanup) in jetty-12.0.x PR #8861
Signed-off-by: Joakim Erdfelt <[email protected]>
Signed-off-by: Joakim Erdfelt <[email protected]>
…invalid-host-headers
…invalid-host-headers
…invalid-host-headers
This is a minimal version of code to reject bad Host/authority header usage.
The more robust validation can be found in the closed (and never merged) PR #7279
Signed-off-by: Joakim Erdfelt [email protected]