You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2015/11/12 22:35:10 UTC
[jira] [Commented] (TS-4019) Headers passed via HTTP/2 should be
validated before passing to FetchSM
[ https://issues.apache.org/jira/browse/TS-4019?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15002968#comment-15002968 ]
ASF GitHub Bot commented on TS-4019:
------------------------------------
GitHub user maskit opened a pull request:
https://github.com/apache/trafficserver/pull/334
TS-4019: Validate header names and values before passing to FetchSM
https://issues.apache.org/jira/browse/TS-4019
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/maskit/trafficserver ts4019
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/trafficserver/pull/334.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #334
----
commit b125b791feab4c1fb497558ce464484bd2cb582d
Author: Masakazu Kitajo <mk...@yahoo-corp.jp>
Date: 2015-11-12T21:26:16Z
TS-4019: Validate header names and values before passing to FetchSM
----
> Headers passed via HTTP/2 should be validated before passing to FetchSM
> -----------------------------------------------------------------------
>
> Key: TS-4019
> URL: https://issues.apache.org/jira/browse/TS-4019
> Project: Traffic Server
> Issue Type: Bug
> Components: HTTP/2
> Reporter: Masakazu Kitajo
>
> HTTP/2 header fields which contain invalid characters must not be passed to an origin server via HTTP/1.1, and it must be treated as a protocol error.
> {quote}
> 10.3. Intermediary Encapsulation Attacks
> The HTTP/2 header field encoding allows the expression of names that
> are not valid field names in the Internet Message Syntax used by
> HTTP/1.1. Requests or responses containing invalid header field
> names MUST be treated as malformed (Section 8.1.2.6). An
> intermediary therefore cannot translate an HTTP/2 request or response
> containing an invalid field name into an HTTP/1.1 message.
> Similarly, HTTP/2 allows header field values that are not valid.
> While most of the values that can be encoded will not alter header
> field parsing, carriage return (CR, ASCII 0xd), line feed (LF, ASCII
> 0xa), and the zero character (NUL, ASCII 0x0) might be exploited by
> an attacker if they are translated verbatim. Any request or response
> that contains a character not permitted in a header field value MUST
> be treated as malformed (Section 8.1.2.6). Valid characters are
> defined by the "field-content" ABNF rule in Section 3.2 of \[RFC7230\].
> {quote}
> https://tools.ietf.org/html/rfc7540#section-10.3
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)