[RESTEASY-2559] Improper validation of response header in MediaTypeHe…

…aderDelegate.java class
resteasy · May 11, 2020 · f3e354b · f3e354b
1 parent a422eda
commit f3e354b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/...asy-jaxrs/src/main/java/org/jboss/resteasy/plugins/delegates/MediaTypeHeaderDelegate.java b/...asy-jaxrs/src/main/java/org/jboss/resteasy/plugins/delegates/MediaTypeHeaderDelegate.java
@@ -89,6 +89,7 @@ protected static boolean isValid(String str)
             case '[':
             case ']':
             case '=':
+            case '\n':
                return false;
             default:
                break;

diff --git a/...suite/unit-tests/src/test/java/org/jboss/resteasy/test/mediatype/MediaTypeHeaderTest.java b/...suite/unit-tests/src/test/java/org/jboss/resteasy/test/mediatype/MediaTypeHeaderTest.java
@@ -0,0 +1,14 @@
+package org.jboss.resteasy.test.mediatype;
+
+import org.jboss.resteasy.plugins.delegates.MediaTypeHeaderDelegate;
+import org.junit.Test;
+
+public class MediaTypeHeaderTest {
+
+   @Test(expected = IllegalArgumentException.class)
+   public void testNewLineInHeaderValueIsRejected() {
+      MediaTypeHeaderDelegate delegate = new MediaTypeHeaderDelegate();
+
+      delegate.fromString("foo/bar\n");
+   }
+}