paivana

commit 35fc61a8ec0a5eb58b4b283ab6c751738134bc0f
parent 99d184b59f12d2028a6affa7c5f1e75fd49360e6
Author: Christian Grothoff <christian@grothoff.org>
Date:   Thu,  6 Aug 2026 16:20:21 +0200

\r and \n are illegal in values, but \t is allowed

Diffstat:
M
src/backend/paivana-httpd_reverse.c
 | 
8
++++----

1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/backend/paivana-httpd_reverse.c b/src/backend/paivana-httpd_reverse.c
@@ -717,14 +717,14 @@ curl_check_hdr (void *buffer,
   while (' ' == *hdr_val)
     hdr_val++;
 
-  /* MHD does not allow certain characters in values,
-   * remove those, plus those could alter strings matching.  */
+  /* MHD rejects CR and LF in header values, and forwarding either
+     would be response splitting.  HTAB, on the other hand, is legal
+     field-content (RFC 9110 section 5.5) and truncating at it corrupts
+     values such as a Content-Disposition filename. */
   if (NULL != (tok = strchr (hdr_val, '\n')))
     *tok = '\0';
   if (NULL != (tok = strchr (hdr_val, '\r')))
     *tok = '\0';
-  if (NULL != (tok = strchr (hdr_val, '\t')))
-    *tok = '\0';
   PAIVANA_LOG_DEBUG ("Parsed line: '%s: %s'\n",
                      hdr_type,
                      hdr_val);