[jira] [Resolved] (CAMEL-25704) camel-undertow - the producer refuses a request target or header value it cannot write as it is

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25704?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-25704.
---------------------------------
    Resolution: Fixed

> camel-undertow - the producer refuses a request target or header value it cannot write as it is
> -----------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25704
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25704
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-core, camel-undertow
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.18.6, 4.22.2, 4.24.0
>
>
> The undertow producer writes the path, query and header values of the outgoing HTTP request to the socket one character at a time, without validating them. A control character such as a carriage return or line feed was therefore written into the request line or a header line, producing a malformed request, and a character above 0xFF was narrowed to a single, different byte (for example U+010A was written as a line feed).
> The producer decodes a percent-encoded CamelHttpPath or CamelHttpQuery before building the request target (URISupport.pathAndQueryOf uses the decoded URI.getPath() and URI.getQuery()), so a percent-encoded control character in those headers became a real control character at that point.
> Expected: the producer refuses to send a request path, query or header value that contains a control character or a character above 0xFF, failing the exchange instead. A space and a tab, which do not change the request framing, are still allowed.
> Note: the decoding of CamelHttpPath/CamelHttpQuery is kept for compatibility. The rest producer double-encodes its query parameters and relies on the undertow producer decoding once (CAMEL-15410), so the fix keeps the decoding and only refuses characters that cannot be written as they are.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)