Prevent the serialization of header containing a line terminator

[gontard]

akka-http should throw an Exception when an header value containing a line terminator (LF) is sent in a response

For example

package com.example

import akka.actor.typed.ActorSystem
import akka.actor.typed.scaladsl.Behaviors
import akka.http.scaladsl.Http
import akka.http.scaladsl.model._
import akka.http.scaladsl.model.headers.{ModeledCustomHeader, ModeledCustomHeaderCompanion}
import akka.http.scaladsl.server.Directives._

import scala.util.Try

object HttpServerRoutingMinimal {
  def main(args: Array[String]): Unit = {
    implicit val system = ActorSystem(Behaviors.empty, "my-system")
    implicit val executionContext = system.executionContext
    val route =
      path("hello") {
        get {
          complete(StatusCodes.OK, Seq[HttpHeader](
            MyHeader("abc\ndef")
          ), "<h1>Say hello to akka-http</h1>")
        }
      }

    Http().newServerAt("localhost", 8080).bind(route)
  }

  final class MyHeader(token: String) extends ModeledCustomHeader[MyHeader] {
    override def renderInRequests = true
    override def renderInResponses = true
    override val companion = MyHeader
    override def value: String = token
  }
  object MyHeader extends ModeledCustomHeaderCompanion[MyHeader] {
    override val name = "my-header"
    override def parse(value: String) = Try(new MyHeader(value))
  }
}

We spotted this issue because our envoy reverse proxy complains of an Invalid HTTP header field was received.

[jrudolph]

Good point, thanks for reporting (and sorry for the delay), @gontard.

I don't have a good idea how to check this cheaply. I don't think we want that check for our own modeled headers. It would certainly make sense for RawHeader but not sure where to put this for more generic user-defined modeled headers. Any ideas?

[gontard]

Thanks for your answer.

I don't think we want that check for our own modeled headers

Is it a performance concern?

Any ideas?

IDK the akka-http internals, but naively i would check that systematically.

[nitikagarw]

Hi @jrudolph,
How about adding the check here and here?

[jrudolph]

How about adding the check here and here?

It should go into the constructor of ModeledCustomHeader (instead of its companion). We can put a verification method into object HttpHeader to call from the constructors.

[nitikagarw]

Hi @jrudolph, I have created a PR #3763 to discuss the fix.

[jrudolph]

#3922 adds a general solution that checks headers for invalid characters while rendering and if occurred drops those headers.