From: Daniel Gruno <humbedooh@apache.org>
Date: Thu, 27 Mar 2014 11:22:33 +0000 (+0000)
Subject: mod_lua: Prevent HTTP Response Splitting by not allowing tables in the request_rec... 
X-Git-Tag: 2.4.10~400
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1486d67e268ddce468a65ef86e115b65c0ad9410;p=apache

mod_lua: Prevent HTTP Response Splitting by not allowing tables in the request_rec to be set with values containing newlines.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1582264 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 410cc75f4d..e15c142da4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,10 @@ Changes with Apache 2.4.10
      from causing response splitting.
      [Daniel Gruno, Felipe Daragon <filipe syhunt com>]
 
+  *) mod_lua: Disallow newlines in table values inside the request_rec, 
+     to prevent HTTP Response Splitting via tainted headers.
+     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]
+
 Changes with Apache 2.4.9
 
   *) mod_ssl: Work around a bug in some older versions of OpenSSL that
diff --git a/modules/lua/lua_apr.c b/modules/lua/lua_apr.c
index 8a1dcf6811..d8c59d0e16 100644
--- a/modules/lua/lua_apr.c
+++ b/modules/lua/lua_apr.c
@@ -40,6 +40,13 @@ static int lua_table_set(lua_State *L)
     const char     *key = luaL_checkstring(L, 2);
     const char     *val = luaL_checkstring(L, 3);
 
+    /* Prevent response/header splitting by not allowing newlines in tables.
+     * At this stage, we don't have the request_rec handy, and we can't change
+     * a const char*, so we'll redirect to a standard error value instead.
+     */
+    if (ap_strchr_c(val, '\n')) {
+        val = "[ERROR: Value contains newline, ignored.]";
+    }
     apr_table_set(t, key, val);
     return 0;
 }