]> git.kaiwu.me - haproxy.git/commit
projects / haproxy.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f7130c0) | patch
BUG/MINOR: hlua: prevent Lua from passing CR/LF/NUL in HTTP headers
authorWilly Tarreau <w@1wt.eu>
Tue, 26 May 2026 11:49:49 +0000 (13:49 +0200)
committerWilly Tarreau <w@1wt.eu>
Tue, 26 May 2026 12:18:20 +0000 (14:18 +0200)
commitb46307203267a7c15c86190a53877703945f8d56
treecdd93b1f8cce9127b49523377eb99fd44e4d301dtree | snapshot
parentf7130c0f3673d79b2c740fc4b0abbfb400fae1f5commit | diff
BUG/MINOR: hlua: prevent Lua from passing CR/LF/NUL in HTTP headers

hlua_http_add_hdr() passes Lua string values directly to htx_add_header()
without validation. This can be an issue for user-controlled data, but as
well when relying on poorly written scripts. This patch makes sure that
neither the name nor the value may contain any of these forbidden chars.

This should be backported to all versions since the issue has been there
since at least 2.4.
src/hlua.c diff | blob | history
haproxy upstream