You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by hu...@apache.org on 2014/03/27 12:20:03 UTC
svn commit: r1582262 - /httpd/httpd/trunk/modules/lua/lua_apr.c
Author: humbedooh
Date: Thu Mar 27 11:20:03 2014
New Revision: 1582262
URL: http://svn.apache.org/r1582262
Log:
mod_lua: Prevent HTTP Response Splitting by not allowing tables in the request_rec to be set with values containing newlines. This is a semi-ugly hack, but it will have to do until we find another way of setting these values.
Modified:
httpd/httpd/trunk/modules/lua/lua_apr.c
Modified: httpd/httpd/trunk/modules/lua/lua_apr.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_apr.c?rev=1582262&r1=1582261&r2=1582262&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/lua/lua_apr.c (original)
+++ httpd/httpd/trunk/modules/lua/lua_apr.c Thu Mar 27 11:20:03 2014
@@ -39,7 +39,14 @@ static int lua_table_set(lua_State *L)
apr_table_t *t = ap_lua_check_apr_table(L, 1);
const char *key = luaL_checkstring(L, 2);
const char *val = luaL_checkstring(L, 3);
-
+
+ /* Prevent response/header splitting by not allowing newlines in tables.
+ * At this stage, we don't have the request_rec handy, and we can't change
+ * a const char*, so we'll redirect to a standard error value instead.
+ */
+ if (ap_strchr_c(val, '\n')) {
+ val = "[ERROR: Value contains newline, ignored.]";
+ }
apr_table_set(t, key, val);
return 0;
}