mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 12:41:00 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: http: forbid comma character in authority value

Browse Source 
Strictly speaking, the comma character in authority is allowed by RFC3986.
However, it is pretty ambiguous for Host header value because comma is also
the value separator for headers supporting multiple value. It is also very
unlikely to have comma in host header value or authority. So instead of
dealing with this case with all the risks of bugs that this entails, we've
decided to forbid the comma in authority and host header value during the
parsing. Concretely, only http_authority_has_forbidden_char() was updated.

The internal API was not updated to prevent comma to be inserted when the
host header value is updated for instance. But this should be so uncommon
that it is not really a concern.

This patch should be backported as far as 2.8. For previous verions,
http_authority_has_forbidden_char() function does not exist.
This commit is contained in:
Christopher Faulet 2026-04-28 09:37:34 +02:00
parent dd92232012
commit b743b566b4
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/haproxy/http.h
View File

@ -238,6 +238,11 @@ static inline int http_path_has_forbidden_char(const struct ist ist, const char
* fall back to the slow path and decide. Brackets are used for IP-literal and
* deserve special case, that is better handled in the slow path. The function
* returns 0 if no forbidden char is presnet, non-zero otherwise.
*
* There is a special case for the comma (','). While it is allowed, we reject
* it because the authority is higly linked with the host header. The comma is
* also the header value separator. So it is highly ambiguous to use it for the
* authority/host value.
*/
static inline int http_authority_has_forbidden_char(const struct ist ist)
{
@ -257,6 +262,7 @@ static inline int http_authority_has_forbidden_char(const struct ist ist)
c = p[ofs];
if (unlikely(c < 0x21 || c > 0x7e ||
c == ',' || /* Special case: forbidden because it is ambiguous for the host header value */
c == '#' || c == '/' || c == '?' || c == '@' ||
c == '[' || c == '\\' || c == ']')) {
/* all of them must be rejected, except '[' which may