You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@pekko.apache.org by "pjfanning (via GitHub)" <gi...@apache.org> on 2026/09/03 07:32:32 UTC
[PR] fix: drop rendered headers containing NUL as well as CR and LF (#1260) [pekko-http]
pjfanning opened a new pull request, #1272:
URL: https://github.com/apache/pekko-http/pull/1272
cherry pick 6cd9e7b80dd3c8eb23deeb49e36b2b9c0f82a912 #1260
Motivation:
The guard in `Rendering.~~(HttpHeader)` renders a header and then scans the rendered bytes, discarding the header if it finds one of the characters that must never reach the wire. It only looked for CR and LF, so a `RawHeader` value carrying a NUL was rendered as-is. NUL is not a legal field-value character, and a downstream consumer that treats the value as a C string truncates it there, so two parties can disagree about where the value ends. The HTTP/2 renderer rejects CR, LF and NUL alike, so HTTP/1.1 was the weaker of the two.
Modification:
Add `Rendering.isIllegalHeaderChar`, which covers CR, LF and NUL, and use it from all four `check` implementations (`StringRendering`, `ByteArrayRendering`, `ByteStringRendering` and
`CustomCharsetByteStringRendering`) instead of repeating the character comparison a fourth time. It takes an `Int` so the `Char` and `Byte` based renderings can pass their element straight in.
Result:
A header whose name or value contains NUL is discarded like one containing CR or LF, on every rendering implementation, and the rule now lives in one place.
Tests:
- sbt "http-core/testOnly org.apache.pekko.http.impl.util.RenderingSpec org.apache.pekko.http.impl.engine.rendering.ResponseRendererSpec org.apache.pekko.http.impl.engine.rendering.RequestRendererSpec" - pass (80 tests); a new case in the shared rendering table asserts a header with NUL in the value is discarded. Verified it fails with the fix stashed, once for each of the four renderings.
- sbt http-core/mimaReportBinaryIssues - pass (internal impl.util change, no public API).
References:
None - extends the outgoing header guard to NUL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org
Re: [PR] fix: drop rendered headers containing NUL as well as CR and LF (#1260) [pekko-http]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning merged PR #1272:
URL: https://github.com/apache/pekko-http/pull/1272
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org