Mail: disabled handling of headers without a colon in auth_http

Header names not followed by a colon and a value in an auth_http server
response were accepted as headers with an empty value, similarly to
ngx_http_parse_header_line().  With this change, such headers are
rejected with the "sent invalid header in response" error, and the
client gets the internal server error reply.

The problem appeared in 5192b3651 (0.1.38).

diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c
index 3e5095a2d226b25c50f20acffe652956200d5e76..1b077a469305b575c85fd80f133460d52bbbb75d 100644 (file)
--- a/src/mail/ngx_mail_auth_http_module.c
+++ b/src/mail/ngx_mail_auth_http_module.c
@@ -985,21 +985,6 @@ ngx_mail_auth_http_parse_header_line(ngx_mail_session_t *s,
                 break;
             }
 
-            if (ch == CR) {
-                ctx->header_name_end = p;
-                ctx->header_start = p;
-                ctx->header_end = p;
-                state = sw_almost_done;
-                break;
-            }
-
-            if (ch == LF) {
-                ctx->header_name_end = p;
-                ctx->header_start = p;
-                ctx->header_end = p;
-                goto done;
-            }
-
             return NGX_ERROR;
 
         /* space* before header value */