mod_lua: Prevent HTTP Response Splitting by not allowing tables in the request_rec...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1582262 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/lua/lua_apr.c b/modules/lua/lua_apr.c
index 8a1dcf6811e51775a5a07fd64a5cbbfa64252c0a..867a370078d7a3653df9d619153b9461bbcf8561 100644 (file)
--- a/modules/lua/lua_apr.c
+++ b/modules/lua/lua_apr.c
@@ -39,7 +39,14 @@ static int lua_table_set(lua_State *L)
     apr_table_t    *t = ap_lua_check_apr_table(L, 1);
     const char     *key = luaL_checkstring(L, 2);
     const char     *val = luaL_checkstring(L, 3);
-
+    
+    /* Prevent response/header splitting by not allowing newlines in tables.
+     * At this stage, we don't have the request_rec handy, and we can't change
+     * a const char*, so we'll redirect to a standard error value instead.
+     */
+    if (ap_strchr_c(val, '\n')) {
+        val = "[ERROR: Value contains newline, ignored.]";
+    }
     apr_table_set(t, key, val);
     return 0;
 }