Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrapped encoding for problematic fields #2166

Closed
jricher opened this issue Jun 17, 2022 · 0 comments · Fixed by #2189
Closed

Wrapped encoding for problematic fields #2166

jricher opened this issue Jun 17, 2022 · 0 comments · Fixed by #2189

Comments

@jricher
Copy link
Contributor

jricher commented Jun 17, 2022

Some fields, like Set-Cookie, have an internal syntax that allows unquoted commas and messes things up when multiple lines are combined for the signature base, leading to the potential case where two semantically different inputs have the same signature base. This means that:

Set-Cookie: that, happens
Set-Cookie: to, contain, a, comma

And:

Set-Cookie: that, happens, to, contain, a, comma

Both produce the same signature input line:

"set-cookie": that, happens, to, contain, a, comma

Even though the two-line and single-line versions are processed differently by the application.

To counter this, we could have a distinct encoding flag that wraps the field values, similar to sf. This can be used to protect problematic fields like Set-Cookie so that we get something like this for the multiple line version:

"set-cookie";b64: :dGhhdCwgaGFwcGVucw==:, :dG8sIGNvbnRhaW4sIGEsIGNvbW1h:

But you'd get this for the single-line version:

"set-cookie";b64: :dGhhdCwgaGFwcGVucywgdG8sIGNvbnRhaW4sIGEsIGNvbW1h:

The background of this has been discussed in #2143 and #1183

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging a pull request may close this issue.

1 participant