The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling.
This was originally done in https://codereview.appspot.com/5690059 (Feb 2012) to deal with bad response headers coming back from webcams, but it presents a potential security problem with HTTP request smuggling for request headers containing "Content Length" instead of "Content-Length".
Part of overall HTTP hardening for request smuggling. See RFC 7230.
This is CVE-2015-5739 and is fixed in Go 1.4.3.
"Content Length" treated as valid header:
https://go-review.googlesource.com/#/c/11772/
Thank you Régis Leroy for reporting.
The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling.
This was originally done in https://codereview.appspot.com/5690059 (Feb 2012) to deal with bad response headers coming back from webcams, but it presents a potential security problem with HTTP request smuggling for request headers containing "Content Length" instead of "Content-Length".
Part of overall HTTP hardening for request smuggling. See RFC 7230.
This is CVE-2015-5739 and is fixed in Go 1.4.3.
"Content Length" treated as valid header:
https://go-review.googlesource.com/#/c/11772/
Thank you Régis Leroy for reporting.