From da92f58a0603949970d0c217bbd81139e24599ab Mon Sep 17 00:00:00 2001 From: Maxim Dounin Date: Wed, 8 May 2024 23:00:07 +0300 Subject: [PATCH] Disabled handling of headers without a colon. Starting with nginx 0.1.29 (509:9b8c906f6e63), header names not followed by a colon and a value were allowed. Such headers were interpreted as headers with an empty value. With this change, such headers are unconditionally rejected. Requested by Maksim Yevmenkin. Closes: https://github.com/nginx/nginx/issues/1499 Signed-off-by: Vadim Zhestikov Origin: --- src/http/ngx_http_parse.c | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index e547d0fdb..1fa40cc6c 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c @@ -989,21 +989,6 @@ ngx_http_parse_header_line(ngx_http_request_t *r, ngx_buf_t *b, break; } - if (ch == CR) { - r->header_name_end = p; - r->header_start = p; - r->header_end = p; - state = sw_almost_done; - break; - } - - if (ch == LF) { - r->header_name_end = p; - r->header_start = p; - r->header_end = p; - goto done; - } - /* IIS may send the duplicate "HTTP/1.1 ..." lines */ if (ch == '/' && r->upstream -- 2.47.3