From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Fri, 10 Feb 2017 13:27:13 +0000 (+0200)
Subject: lib-http: http_client_request_add_header() - Add key/value asserts
X-Git-Tag: 2.3.0.rc1~2133
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=887c92aa9f171ab90e417de48ffa08d4909c809a;p=thirdparty%2Fdovecot%2Fcore.git

lib-http: http_client_request_add_header() - Add key/value asserts

These don't check that they're entirely correct as required by HTTP
specifications. They're mainly there as a quick check that if the caller
didn't validate the key/value in any way, we'll crash instead of creating
a potential security hole. (Because with line feeds the attacker could
add extra headers or even entirely new HTTP requests.)
---

diff --git a/src/lib-http/http-client-request.c b/src/lib-http/http-client-request.c
index 6b6cf10366..f4af334aed 100644
--- a/src/lib-http/http-client-request.c
+++ b/src/lib-http/http-client-request.c
@@ -301,6 +301,9 @@ void http_client_request_add_header(struct http_client_request *req,
 		 /* allow calling for retries */
 		 req->state == HTTP_REQUEST_STATE_GOT_RESPONSE ||
 		 req->state == HTTP_REQUEST_STATE_ABORTED);
+	/* make sure key or value can't break HTTP headers entirely */
+	i_assert(strpbrk(key, ":\r\n") == NULL);
+	i_assert(strpbrk(value, "\r\n") == NULL);
 
 	/* mark presence of special headers */
 	switch (key[0]) {