Fixed non-ASCII characters in Server Timing headers

Fixes #48
Rarst · Nov 16, 2020 · 8875774 · 8875774 · joseantonnio · Nov 17, 2020
1 parent ccf3ff3
commit 8875774
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+## 3.3.4 - 2020-11-16
+
+### Fixed
+- non-ASCII characters in Server Timing headers
+
 ## 3.3.3 - 2020-03-11
 
 ### Fixed

diff --git a/laps.php b/laps.php
@@ -5,7 +5,7 @@
 Plugin URI: https://github.com/Rarst/laps
 Description: Light WordPress profiler.
 Author: Andrey “Rarst” Savchenko
-Version: 3.3.3
+Version: 3.3.4
 Author URI: https://www.rarst.net/
 Text Domain: laps
 Domain Path: /lang

diff --git a/src/Manager/Server_Timing_Manager.php b/src/Manager/Server_Timing_Manager.php
@@ -68,7 +68,8 @@ public function send_timing_header( $input ) {
 			}
 		}
 
-		header( 'Server-Timing: ' . preg_replace( '/\R/', '', $header ) );
+		// Sanitize to visible US ASCII character range (32-126).
+		header( 'Server-Timing: ' . preg_replace( '/[^\x20-\x7E]/', '', $header ) );
 
 		return $input;
 	}