IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

Upstream: check format of CGI Status header

Browse Source 
The CGI Status header is used as the HTTP status line if it has a
reason-phrase: its length should be > 3.

This change validates that the 4th character is a space, the only
allowed character in that position.

An addition to:
fa46a57199
This commit is contained in:
Ricardo Yanome 2024-12-10 19:30:31 +09:00
parent e28ef42b97
commit cc536f9ca9
No known key found for this signature in database
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/http/modules/ngx_http_fastcgi_module.c
View File

@ -2049,7 +2049,7 @@ ngx_http_fastcgi_process_header(ngx_http_request_t *r)
u->headers_in.status_n = status;
if (status_line->len > 3) {
if (status_line->len > 3 && status_line->data[3] == ' ') {
u->headers_in.status_line = *status_line;
}

2
src/http/modules/ngx_http_scgi_module.c
View File

@ -1154,7 +1154,7 @@ ngx_http_scgi_process_header(ngx_http_request_t *r)
u->headers_in.status_n = status;
if (status_line->len > 3) {
if (status_line->len > 3 && status_line->data[3] == ' ') {
u->headers_in.status_line = *status_line;
}

2
src/http/modules/ngx_http_uwsgi_module.c
View File

@ -1382,7 +1382,7 @@ ngx_http_uwsgi_process_header(ngx_http_request_t *r)
u->headers_in.status_n = status;
if (status_line->len > 3) {
if (status_line->len > 3 && status_line->data[3] == ' ') {
u->headers_in.status_line = *status_line;
}