-
Notifications
You must be signed in to change notification settings - Fork 17.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
net/http: allows invalid characters in header values #11207
Comments
Didn't I see a CL for this today? |
That was specifically for Host headers. This is all headers. Very similar. I'll do this one today. |
CL https://golang.org/cl/17980 mentions this issue. |
I think this is too strict. RFC2616 §4.2 says that a header's field-content can consist of *TEXT, and RFC2616 §2.2 says that TEXT is |
@andybalholm, thanks. |
CL https://golang.org/cl/18374 mentions this issue. |
CL https://golang.org/cl/18375 mentions this issue. |
Third time's a charm. Thanks to Ralph Corderoy for noticing the DEL omission. Update #11207 Change-Id: I174fd01eaecceae1eb220f2c9136e12d40fbe943 Reviewed-on: https://go-review.googlesource.com/18375 Reviewed-by: Russ Cox <rsc@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
net/http successfully parses invalid characters in http header values.
For examples, in the following program header value is not preserved after Write/Parse. But in general header values must contain only visible character (0x21-0x7f) + space and tab.
go version devel +a1fe3b5 Sat Jun 13 04:33:26 2015 +0000 linux/amd64
The text was updated successfully, but these errors were encountered: