Skip to content

fix: validate response header names and values before AddHeader#50129

Merged
jkleinsc merged 1 commit into39-x-yfrom
trop/39-x-y-bp-fix-validate-response-header-names-and-values-before-addheader-1773009669192
Mar 9, 2026
Merged

fix: validate response header names and values before AddHeader#50129
jkleinsc merged 1 commit into39-x-yfrom
trop/39-x-y-bp-fix-validate-response-header-names-and-values-before-addheader-1773009669192

Conversation

@trop
Copy link
Copy Markdown
Contributor

@trop trop bot commented Mar 8, 2026

Backport of #50123

See that PR for details.

Notes: Fixed an issue where invalid characters in custom protocol or webRequest response header values were not rejected.

Matches the existing validation applied to request headers in
electron_api_url_loader.cc.

Co-authored-by: Samuel Attard <sattard@anthropic.com>
@trop trop bot requested review from a team and MarshallOfSound March 8, 2026 22:41
@trop trop bot added 39-x-y backport This is a backport PR semver/patch backwards-compatible bug fixes labels Mar 8, 2026
@jkleinsc jkleinsc merged commit f929de8 into 39-x-y Mar 9, 2026
157 of 159 checks passed
@jkleinsc jkleinsc deleted the trop/39-x-y-bp-fix-validate-response-header-names-and-values-before-addheader-1773009669192 branch March 9, 2026 15:40
@release-clerk
Copy link
Copy Markdown

release-clerk bot commented Mar 9, 2026

Release Notes Persisted

Fixed an issue where invalid characters in custom protocol or webRequest response header values were not rejected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

39-x-y backport This is a backport PR semver/patch backwards-compatible bug fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants