mirror of
http://git.haproxy.org/git/haproxy.git/
synced 2025-03-25 04:17:42 +00:00
haproxy public development tree
146f53ae7e
Tim D�sterhus found that the amount of sanitization we perform on HTTP header field names received in H2 is insufficient. Currently we reject upper case letters as mandated by RFC7540#8.1.2, but section 10.3 also requires that intermediaries translating streams to HTTP/1 further refine the filtering to also reject invalid names (which means any name that doesn't match a token). There is a small trick here which is that the colon character used to start pseudo-header names doesn't match a token, so pseudo-header names fall into that category, thus we have to swap the pseudo-header name lookup with this check so that we only check from the second character (past the ':') in case of pseudo-header names. Another possibility could have been to perform this check only in the HTX-to-H1 trancoder but doing would still expose the configured rules and logs to such header names. This fix must be backported as far as 1.8 since this bug could be exploited and serve as the base for an attack. In 2.0 and earlier, functions h2_make_h1_request() and h2_make_h1_trailers() must also be adapted to sanitize requests coming in legacy mode. |
||
|---|---|---|
| .github/ISSUE_TEMPLATE | ||
| contrib | ||
| doc | ||
| ebtree | ||
| examples | ||
| include | ||
| reg-tests | ||
| scripts | ||
| src | ||
| tests | ||
| .cirrus.yml | ||
| .gitignore | ||
| .travis.yml | ||
| BRANCHES | ||
| CHANGELOG | ||
| CONTRIBUTING | ||
| INSTALL | ||
| LICENSE | ||
| MAINTAINERS | ||
| Makefile | ||
| README | ||
| ROADMAP | ||
| SUBVERS | ||
| VERDATE | ||
| VERSION | ||
The HAProxy documentation has been split into a number of different files for ease of use. Please refer to the following files depending on what you're looking for : - INSTALL for instructions on how to build and install HAProxy - BRANCHES to understand the project's life cycle and what version to use - LICENSE for the project's license - CONTRIBUTING for the process to follow to submit contributions The more detailed documentation is located into the doc/ directory : - doc/intro.txt for a quick introduction on HAProxy - doc/configuration.txt for the configuration's reference manual - doc/lua.txt for the Lua's reference manual - doc/SPOE.txt for how to use the SPOE engine - doc/network-namespaces.txt for how to use network namespaces under Linux - doc/management.txt for the management guide - doc/regression-testing.txt for how to use the regression testing suite - doc/peers.txt for the peers protocol reference - doc/coding-style.txt for how to adopt HAProxy's coding style - doc/internals for developer-specific documentation (not all up to date)