Correctly handle whitespaces in HTTP header names as defined by RFC72… by normanmaurer · Pull Request #9585 · netty/netty

normanmaurer · 2019-09-20T07:09:48Z

…30#section-3.2.4

Motivation:

When parsing HTTP headers special care needs to be taken when a whitespace is detected in the header name.

Modifications:

Ignore whitespace when decoding response (just like before)
Throw exception when whitespace is detected during parsing
Add unit tests

Result:

…30#section-3.2.4 Motivation: When parsing HTTP headers special care needs to be taken when a whitespace is detected in the header name. Modifications: - Ignore whitespace when decoding response (just like before) - Throw exception when whitespace is detected during parsing - Add unit tests Result: Fixes #9571

normanmaurer · 2019-09-20T08:13:57Z

@netty-bot test this please

slandelle · 2019-09-20T08:17:39Z

codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java

+            // response message before forwarding the message downstream.
+            if (ch == ':' ||
+                    // In case of decoding a request we will just continue processing and header validation
+                    // is done in the DefaultHttpHeaders implementation.


side comment: DefaultHttpHeaders#validateHeaderNameElement uses a long switch/case to detect illegal characters. Wouldn't it be more efficient to use a BitSet?

Thats something we may want to measure :)

Of course. Will do next week.

slandelle

LGTM

…30#section-3.2.4 (#9585) Motivation: When parsing HTTP headers special care needs to be taken when a whitespace is detected in the header name. Modifications: - Ignore whitespace when decoding response (just like before) - Throw exception when whitespace is detected during parsing - Add unit tests Result: Fixes #9571

Backport netty#9585

…30#section-3.2.4 (netty#9585) Motivation: When parsing HTTP headers special care needs to be taken when a whitespace is detected in the header name. Modifications: - Ignore whitespace when decoding response (just like before) - Throw exception when whitespace is detected during parsing - Add unit tests Result: Fixes netty#9571 (cherry picked from commit 39cafcb)

Compared against 4.1.25.6.dse, this tag cherry-picks upstream commits that fixed bugs in HttpObjectDecoder/HttpRequestDecoder, plus two intermediate refactoring commits that indirectly affect those bugfix commits. What follows is a list of PR links, issue links, CVE links, and hashes associated with the cherry-picked commits. Verify we do not receive multiple content-length headers or a content-length and transfer-encoding: chunked header when using HTTP/1.1 (netty#9865) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7238 netty#9861 netty#9865 8494b04 Detect missing colon when parsing http headers with no value (netty#9871) GHSA-cqqj-4p63-rrmm netty#9866 netty#9871 a7c18d4 Fix typos in javadocs (netty#9527) skipped Correctly handle whitespaces in HTTP header names as defined by RFC7230#section-3.2.4 (netty#9585) https://nvd.nist.gov/vuln/detail/CVE-2019-16869 netty#9571 netty#9585 39cafcb Use `AppendableCharSequence.charAtUnsafe(int)` in `HttpObjectDecoder` (netty#9492) netty#9492 85fcf4e use checkPositive/checkPositiveOrZero (netty#8835) netty#8835 4c64c98 HttpObjectDecoder ignores HTTP trailer header when empty line is rece… (netty#8799) netty#8736 netty#8799 91d3920

Compared against 4.1.34.2.dse, this tag cherry-picks upstream commits that fixed bugs in HttpObjectDecoder/HttpRequestDecoder, plus two intermediate refactoring commits that indirectly affect those bugfix commits. What follows is a list of PR links, issue links, CVE links, and hashes associated with the cherry-picked commits. Verify we do not receive multiple content-length headers or a content-length and transfer-encoding: chunked header when using HTTP/1.1 (netty#9865) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7238 netty#9861 netty#9865 8494b04 Detect missing colon when parsing http headers with no value (netty#9871) https://nvd.nist.gov/vuln/detail/CVE-2019-20444 netty#9866 netty#9871 a7c18d4 Fix typos in javadocs (netty#9527) skipped Correctly handle whitespaces in HTTP header names as defined by RFC7230#section-3.2.4 (netty#9585) https://nvd.nist.gov/vuln/detail/CVE-2019-16869 netty#9571 netty#9585 39cafcb Use `AppendableCharSequence.charAtUnsafe(int)` in `HttpObjectDecoder` (netty#9492) netty#9492 85fcf4e

…E header (#1) VISA-11: Backported the PR netty#9585 Add fix for http request smuggling, cause by obfuscating TE header.

Added fix for http request smuggling, cause by obfuscating TE header.

* [maven-release-plugin] prepare for next development iteration * Use the Runnable.run method to clean direct byte buffers if avaiable. Motivation: In JDK9 the Cleaner.clean method cannot be called as it is not exported from `java.base`. `Runnable.run` should be called instead. Modifications: Pick Runnable.run if the cleaner implements Runnable. Otherwise try the clean method on the class implementing the cleaner. Result: The cleaner for direct byte buffers is run on JDK9 as well as earlier JDKs. * VISA-11: Added fix for http request smuggling, cause by obfuscating TE header (#1) VISA-11: Backported the PR netty#9585 Add fix for http request smuggling, cause by obfuscating TE header. * DEEP-462: Backported the [PR](netty#9871) --------- Co-authored-by: Norman Maurer <norman_maurer@apple.com> Co-authored-by: Carsten Varming <cvarming@twitter.com>

* [maven-release-plugin] prepare for next development iteration * Use the Runnable.run method to clean direct byte buffers if avaiable. Motivation: In JDK9 the Cleaner.clean method cannot be called as it is not exported from `java.base`. `Runnable.run` should be called instead. Modifications: Pick Runnable.run if the cleaner implements Runnable. Otherwise try the clean method on the class implementing the cleaner. Result: The cleaner for direct byte buffers is run on JDK9 as well as earlier JDKs. * VISA-11: Added fix for http request smuggling, cause by obfuscating TE header (#1) VISA-11: Backported the PR netty#9585 Add fix for http request smuggling, cause by obfuscating TE header. * DEEP-462: Backported the [PR](netty#9871) * DEEP-462: Backported the [PR](netty#9865) --------- Co-authored-by: Norman Maurer <norman_maurer@apple.com> Co-authored-by: Carsten Varming <cvarming@twitter.com>

* [maven-release-plugin] prepare for next development iteration * Use the Runnable.run method to clean direct byte buffers if avaiable. Motivation: In JDK9 the Cleaner.clean method cannot be called as it is not exported from `java.base`. `Runnable.run` should be called instead. Modifications: Pick Runnable.run if the cleaner implements Runnable. Otherwise try the clean method on the class implementing the cleaner. Result: The cleaner for direct byte buffers is run on JDK9 as well as earlier JDKs. * VISA-11: Added fix for http request smuggling, cause by obfuscating TE header (#1) VISA-11: Backported the PR netty#9585 Add fix for http request smuggling, cause by obfuscating TE header. * DEEP-462: Backported the [commit](netty@0d0c6ed) --------- Co-authored-by: Norman Maurer <norman_maurer@apple.com> Co-authored-by: Carsten Varming <cvarming@twitter.com>

* [maven-release-plugin] prepare for next development iteration * Use the Runnable.run method to clean direct byte buffers if avaiable. Motivation: In JDK9 the Cleaner.clean method cannot be called as it is not exported from `java.base`. `Runnable.run` should be called instead. Modifications: Pick Runnable.run if the cleaner implements Runnable. Otherwise try the clean method on the class implementing the cleaner. Result: The cleaner for direct byte buffers is run on JDK9 as well as earlier JDKs. * VISA-11: Added fix for http request smuggling, cause by obfuscating TE header (#1) VISA-11: Backported the PR netty#9585 Add fix for http request smuggling, cause by obfuscating TE header. * DEEP-462: Backported the [PR](netty@07aa6b5) * DEEP-462: Backported the [PR](netty@07aa6b5) --------- Co-authored-by: Norman Maurer <norman_maurer@apple.com> Co-authored-by: Carsten Varming <cvarming@twitter.com>

normanmaurer requested review from slandelle and trustin September 20, 2019 07:09

normanmaurer mentioned this pull request Sep 20, 2019

http request smuggling, cause by obfuscating TE header #9571

Closed

slandelle reviewed Sep 20, 2019

View reviewed changes

slandelle approved these changes Sep 20, 2019

View reviewed changes

normanmaurer added this to the 4.1.42.Final milestone Sep 20, 2019

normanmaurer merged commit 39cafcb into 4.1 Sep 20, 2019

normanmaurer deleted the http_ws_name branch September 20, 2019 19:02

ccaominh added a commit to implydata/netty that referenced this pull request Dec 12, 2019

Fix CVE-2019-16869

22d24a2

Backport netty#9585

scott-cx mentioned this pull request Aug 1, 2022

CVE-2019-16869 @ Maven-io.netty:netty-codec-http-4.1.17.Final scott-cx/edgemere#40

Open

vivek807 added a commit to deep-bi/netty that referenced this pull request Jul 30, 2024

VISA-11: Backported the PR netty#9585

2e9f414

cmick pushed a commit to deep-bi/netty that referenced this pull request Jul 30, 2024

VISA-11: Added fix for http request smuggling, cause by obfuscating T…

098c743

…E header (#1) VISA-11: Backported the PR netty#9585 Add fix for http request smuggling, cause by obfuscating TE header.

vivek807 added a commit to deep-bi/netty that referenced this pull request Aug 2, 2024

VISA-11: Backported the PR netty#9585

9ef01ed

Added fix for http request smuggling, cause by obfuscating TE header.

vivek807 mentioned this pull request Aug 2, 2024

Fix for http request smuggling cause by obfuscating te header fix #14209

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Correctly handle whitespaces in HTTP header names as defined by RFC72…#9585

Correctly handle whitespaces in HTTP header names as defined by RFC72…#9585
normanmaurer merged 1 commit into4.1from
http_ws_name

normanmaurer commented Sep 20, 2019

Uh oh!

normanmaurer commented Sep 20, 2019

Uh oh!

slandelle Sep 20, 2019

Uh oh!

normanmaurer Sep 20, 2019

Uh oh!

slandelle Sep 20, 2019

Uh oh!

slandelle left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

normanmaurer commented Sep 20, 2019

Uh oh!

normanmaurer commented Sep 20, 2019

Uh oh!

slandelle Sep 20, 2019

Choose a reason for hiding this comment

Uh oh!

normanmaurer Sep 20, 2019

Choose a reason for hiding this comment

Uh oh!

slandelle Sep 20, 2019

Choose a reason for hiding this comment

Uh oh!

slandelle left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants