diff options
| author | nagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-10-01 10:57:43 +0000 |
|---|---|---|
| committer | nagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-10-01 10:57:43 +0000 |
| commit | 8d5d5d5609e94b4ab75512c8d036d049fd1af6c2 (patch) | |
| tree | eac64868d4b025a40e7ab3802d3aa6654274cec7 /lib | |
| parent | 1443dfd7c30fc9847d8316bc522ff32da5fb6fc1 (diff) | |
merge revision(s) 3ce238b5f9795581eb84114dcfbdf4aa086bfecc:
WEBrick: prevent response splitting and header injection
This is a follow up to d9d4a28f1cdd05a0e8dabb36d747d40bbcc30f16.
The commit prevented CRLR, but did not address an isolated CR or an
isolated LF.
Co-Authored-By: NARUSE, Yui <naruse@airemix.jp>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67808 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/webrick/httpresponse.rb | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb index 41a2510e6f..08f7797c4f 100644 --- a/lib/webrick/httpresponse.rb +++ b/lib/webrick/httpresponse.rb @@ -369,7 +369,8 @@ module WEBrick private def check_header(header_value) - if header_value =~ /\r\n/ + header_value = header_value.to_s + if /[\r\n]/ =~ header_value raise InvalidHeader else header_value |