Preventing some CRLF header injection attacks
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 2.3k
- Forks
- 403
- Avg merge
- 21h 16m
- Merged PRs (30d)
- 4
Description
Firefox has some logic to prevent CRLF header injection attacks for Location, Content-Length, and Content-Disposition headers.
Search for "IsSuspectDuplicateHeader" in
http://searchfox.org/mozilla-central/source/netwerk/protocol/http/nsHttpHeaderArray.h
http://searchfox.org/mozilla-central/source/netwerk/protocol/http/nsHttpHeaderArray.cpp
I'm not entirely sure whether to standardize this since other implementations seem to have different behavior, but it does seem nice as defense-in-depth.
Note that Firefox' behavior also affects what can be observed in the API as the duplicate headers with equal values are silently dropped and therefore not exposed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading Firefox's nsHttpHeaderArray.h and nsHttpHeaderArray.cpp, searching for "IsSuspectDuplicateHeader" as the issue suggests. Compare that behavior with the Fetch Standard's handling of Location, Content-Length, and Content-Disposition headers, including whether equal duplicate values are exposed. Done requires a resolved standardization decision and defined expected API behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100