From 04cf89beec2e933adaf7ae1f5afd043985e16aa9 Mon Sep 17 00:00:00 2001 From: MarkLee131 Date: Sat, 25 Apr 2026 10:38:31 +0800 Subject: [PATCH] HTTPSock: reject CR/LF in AddHeader name/value AddHeader wrote its arguments straight into the response stream. No in-tree caller reaches it with attacker-controlled bytes today, but the public API is exposed to module authors; one bad caller would be a header-injection bug. Filter at the entry rather than at every caller. --- src/HTTPSock.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/HTTPSock.cpp b/src/HTTPSock.cpp index 237713e6..0a4e48f7 100644 --- a/src/HTTPSock.cpp +++ b/src/HTTPSock.cpp @@ -763,6 +763,13 @@ void CHTTPSock::SetContentType(const CString& sContentType) { } void CHTTPSock::AddHeader(const CString& sName, const CString& sValue) { + // Reject CR/LF in either half so we never emit a malformed header or + // give a caller (e.g. a future module) a cheap response-splitting + // primitive. No in-tree caller reaches this with attacker-controlled + // bytes today; this is a defensive guard, not a fix for an existing + // exploit. + if (sName.find_first_of("\r\n") != CString::npos) return; + if (sValue.find_first_of("\r\n") != CString::npos) return; m_msHeaders[sName] = sValue; }