forked from dotnet/runtime
-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
We pass headers to WinHTTP.dll without any validation of their values:
https://github.com/dotnet/runtime/blob/cc3700953542b96052f73fc7ee259994692575cf/src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs#L742
We should validate the values to be well-formed the same way as SocketsHttpHandler does:
https://github.com/dotnet/runtime/blob/a37502bc5f33765413118a4f1b888c79c403a809/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnection.cs#L509
I.e. For ASCII chars.
See RFC for header values: https://www.rfc-editor.org/rfc/rfc9110.html#name-field-values
Note: it allows up to the full byte to allow encoding like Latin-1 for historical purposes.
Metadata
Metadata
Assignees
Labels
No labels