You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "merlimat (via GitHub)" <gi...@apache.org> on 2025/02/13 05:20:32 UTC
[PR] Potential fix for code scanning alert no. 22: HTTP response splitting [pulsar]
merlimat opened a new pull request, #23976:
URL: https://github.com/apache/pulsar/pull/23976
Potential fix for [https://github.com/apache/pulsar/security/code-scanning/22](https://github.com/apache/pulsar/security/code-scanning/22)
To fix the problem, we need to ensure that any user-provided input used in HTTP headers is properly sanitized to prevent HTTP response splitting. This can be done by removing or escaping special characters such as CRLF from the input before using it in the response header.
The best way to fix this issue is to create a method that sanitizes the input by removing or escaping special characters and then use this method to sanitize the `SASL_STATE_SERVER` header value before setting it in the response.
_Suggested fixes powered by Copilot Autofix. Review carefully before merging._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix] Potential fix for code scanning alert no. 22: HTTP response splitting [pulsar]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #23976:
URL: https://github.com/apache/pulsar/pull/23976#discussion_r1953888391
##########
pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java:
##########
@@ -271,7 +271,7 @@
} else {
checkState(request.getHeader(SASL_HEADER_STATE).equalsIgnoreCase(SASL_STATE_SERVER_CHECK_TOKEN));
setResponseHeaderState(response, SASL_STATE_COMPLETE);
- response.setHeader(SASL_STATE_SERVER, request.getHeader(SASL_STATE_SERVER));
+ response.setHeader(SASL_STATE_SERVER, sanitizeHeaderValue(request.getHeader(SASL_STATE_SERVER)));
Review Comment:
## HTTP response splitting
This header depends on a [user-provided value](1), which may cause a response-splitting vulnerability.
[Show more details](https://github.com/apache/pulsar/security/code-scanning/151)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix] Potential fix for code scanning alert no. 22: HTTP response splitting [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat merged PR #23976:
URL: https://github.com/apache/pulsar/pull/23976
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Potential fix for code scanning alert no. 22: HTTP response splitting [pulsar]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #23976:
URL: https://github.com/apache/pulsar/pull/23976#issuecomment-2655509211
@merlimat Please add the following content to your PR description and select a checkbox:
```
- [ ] `doc` <!-- Your PR contains doc changes -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [ ] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org