From 30fbc68dd45107951f6c15ff0f0f5215202d6d84 Mon Sep 17 00:00:00 2001 From: daum3ns <23260410+daum3ns@users.noreply.github.com> Date: Tue, 4 Mar 2025 11:54:08 +0100 Subject: [PATCH] tls_validate_record_header(): Check for all HTTP methods The change checks for all HTTP methods in ssl_record, not only GET, POST, PUT and HEAD. (additionally PATCH, DELETE, OPTIONS and TRACE) CLA: trivial Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26968) --- ssl/record/methods/tlsany_meth.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ssl/record/methods/tlsany_meth.c b/ssl/record/methods/tlsany_meth.c index 3f73f9ebdd8..38d74807140 100644 --- a/ssl/record/methods/tlsany_meth.c +++ b/ssl/record/methods/tlsany_meth.c @@ -67,6 +67,10 @@ static int tls_validate_record_header(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec) if (HAS_PREFIX((char *)p, "GET ") || HAS_PREFIX((char *)p, "POST ") || HAS_PREFIX((char *)p, "HEAD ") || + HAS_PREFIX((char *)p, "PATCH") || + HAS_PREFIX((char *)p, "OPTIO") || + HAS_PREFIX((char *)p, "DELET") || + HAS_PREFIX((char *)p, "TRACE") || HAS_PREFIX((char *)p, "PUT ")) { RLAYERfatal(rl, SSL_AD_NO_ALERT, SSL_R_HTTP_REQUEST); return 0; -- 2.47.2