diff options
| author | Hauke Mehrtens | 2026-05-03 20:49:47 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-05-03 23:59:45 +0000 |
| commit | 07f0afb3bf9160b90111009829676da1758060ff (patch) | |
| tree | 06ff5bcafbd7c16bda5eb006a14439d367b5a180 | |
| parent | d2551871b5e52b576236c0a2470f392eca81c2de (diff) | |
| download | uhttpd-07f0afb3bf9160b90111009829676da1758060ff.tar.gz | |
client: match Host and URL attributes exactly in tls_redirect_check
The TLS redirect logic walked the header blob with strncmp(name,
\"host\", 4) and strncmp(name, \"URL\", 3), so any header whose
lowercased name started with \"host\" (for example \"host-foo\" or
\"hostess\") would be picked up as the request authority, and any
attribute starting with \"URL\" would be picked up as the request
target.
The Host value is then echoed verbatim into the Location header of
the 307 response. A client without a real Host header but with
\"Hostess: attacker.example\" would therefore receive a redirect
pointing at the attacker, turning the TLS-redirect feature into an
open redirect.
Use strcmp so only the canonical \"host\" header (lowercased by
client_parse_header) and the synthetic \"URL\" attribute set by
client_parse_request can match.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | client.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -294,10 +294,10 @@ static bool tls_redirect_check(struct client *cl) return true; blob_for_each_attr(cur, cl->hdr.head, rem) { - if (!strncmp(blobmsg_name(cur), "host", 4)) + if (!strcmp(blobmsg_name(cur), "host")) host = blobmsg_get_string(cur); - if (!strncmp(blobmsg_name(cur), "URL", 3)) + if (!strcmp(blobmsg_name(cur), "URL")) url = blobmsg_get_string(cur); if (url && host) |