Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2374

At Http2ReceiveListener.checkRequestHeaders do not check path chars when unescaped characters are allowed

XMLWordPrintable

    • Icon: Enhancement Enhancement
    • Resolution: Done
    • Icon: Optional Optional
    • 2.3.13.Final, 2.2.32.Final
    • None
    • None
    • None

      At that method, there is a block that iterates through the path

      // verify content of request pseudo-headers. Each header should only have a single value.
if (headers.contains(PATH)) {
    for (byte b: headers.get(PATH).getFirst().getBytes(ISO_8859_1)) {
        if (!allowUnescapedCharactersInUrl && !HttpRequestParser.isTargetCharacterAllowed((char)b)){
            return false;
        }
    }
}

      Iterating is unnecessary when allowUnescapedCharactersInUrl is true.

              flaviarnn Flavia Rainone
              flaviarnn Flavia Rainone
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: