diff options
| author | Hauke Mehrtens | 2026-04-23 22:19:54 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-06-07 11:24:06 +0000 |
| commit | bf403fa0f8e5d9e657bf380816165b4b5bc81591 (patch) | |
| tree | d0bab80a9785852222398420246a5fe6381ee9c5 | |
| parent | 8658324bd23479021465dcf0698c51fb77184c1e (diff) | |
| download | uclient-bf403fa0f8e5d9e657bf380816165b4b5bc81591.tar.gz | |
uclient-fetch: reject CR in --header values
The validation for --header values already rejected LF to prevent the
attacker splitting a header into multiple HTTP header lines, but did
not reject CR. A lone CR followed by a header-looking string on the
wire ("X-Foo: bar\rX-Evil: 1") is interpreted by many servers and
proxies as two separate headers, opening the same request-splitting
hole.
Reject values containing either '\r' or '\n'.
Assisted-by: Claude:claude-opus-4-7
Link: https://github.com/openwrt/uclient/pull/16
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | uclient-fetch.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/uclient-fetch.c b/uclient-fetch.c index 3a6389d..48fafe8 100644 --- a/uclient-fetch.c +++ b/uclient-fetch.c @@ -774,7 +774,8 @@ int main(int argc, char **argv) while (isspace((unsigned char)*tmp)) ++tmp; - if (*tmp == '\0' || !is_valid_header(optarg) || strchr(tmp, '\n')) { + if (*tmp == '\0' || !is_valid_header(optarg) || + strchr(tmp, '\n') || strchr(tmp, '\r')) { usage(progname); goto out; } |