mod_cern_meta: reject HTTP framing headers in metadata files

* modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500
  error if a framing header is found in a .meta file rather than
  merging it into the response headers.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936260 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/changes-entries/cern-meta-header-injection.txt b/changes-entries/cern-meta-header-injection.txt
new file mode 100644 (file)
index 0000000..2aef1ee
--- /dev/null
+++ b/changes-entries/cern-meta-header-injection.txt
@@ -0,0 +1,2 @@
+  *) mod_cern_meta: Reject HTTP framing headers in metadata files to prevent
+     response splitting.  [Joe Orton]

diff --git a/modules/metadata/mod_cern_meta.c b/modules/metadata/mod_cern_meta.c
index 3f36b2dba8a8e296f51e23c40e35a2346ed3a650..a150b3c9fa15f867b5aa0731a13d54f20a65a944 100644 (file)
--- a/modules/metadata/mod_cern_meta.c
+++ b/modules/metadata/mod_cern_meta.c
@@ -256,6 +256,18 @@ static int scan_meta_file(request_rec *r, apr_file_t *f)
             sscanf(l, "%d", &r->status);
             r->status_line = apr_pstrdup(r->pool, l);
         }
+        else if (!ap_cstr_casecmp(w, "Transfer-Encoding")
+                 || !ap_cstr_casecmp(w, "Content-Length")
+                 || !ap_cstr_casecmp(w, "Connection")
+                 || !ap_cstr_casecmp(w, "Trailer")
+                 || !ap_cstr_casecmp(w, "Upgrade")
+                 || !ap_cstr_casecmp(w, "Keep-Alive")
+                 || !ap_cstr_casecmp(w, "TE")) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10596)
+                          "forbidden HTTP framing header '%s' in meta file: %s",
+                          w, r->filename);
+            return HTTP_INTERNAL_SERVER_ERROR;
+        }
         else {
             apr_table_set(tmp_headers, w, l);
         }