From: Joe Orton Date: Fri, 17 Jul 2026 12:12:23 +0000 (+0000) Subject: mod_cern_meta: reject HTTP framing headers in metadata files X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=753188653c2e139ffbeead6eacdb179adfa14826;p=thirdparty%2Fapache%2Fhttpd.git mod_cern_meta: reject HTTP framing headers in metadata files * modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500 error if a framing header is found in a .meta file rather than merging it into the response headers. Assisted-by: Claude Sonnet 4.6 GitHub: PR #685 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936260 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/changes-entries/cern-meta-header-injection.txt b/changes-entries/cern-meta-header-injection.txt new file mode 100644 index 0000000000..2aef1eec92 --- /dev/null +++ b/changes-entries/cern-meta-header-injection.txt @@ -0,0 +1,2 @@ + *) mod_cern_meta: Reject HTTP framing headers in metadata files to prevent + response splitting. [Joe Orton] diff --git a/modules/metadata/mod_cern_meta.c b/modules/metadata/mod_cern_meta.c index 3f36b2dba8..a150b3c9fa 100644 --- a/modules/metadata/mod_cern_meta.c +++ b/modules/metadata/mod_cern_meta.c @@ -256,6 +256,18 @@ static int scan_meta_file(request_rec *r, apr_file_t *f) sscanf(l, "%d", &r->status); r->status_line = apr_pstrdup(r->pool, l); } + else if (!ap_cstr_casecmp(w, "Transfer-Encoding") + || !ap_cstr_casecmp(w, "Content-Length") + || !ap_cstr_casecmp(w, "Connection") + || !ap_cstr_casecmp(w, "Trailer") + || !ap_cstr_casecmp(w, "Upgrade") + || !ap_cstr_casecmp(w, "Keep-Alive") + || !ap_cstr_casecmp(w, "TE")) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10596) + "forbidden HTTP framing header '%s' in meta file: %s", + w, r->filename); + return HTTP_INTERNAL_SERVER_ERROR; + } else { apr_table_set(tmp_headers, w, l); }