From 8ae663bc780b05657c6766651f33c870f25d93d6 Mon Sep 17 00:00:00 2001 From: Daniel Gruno Date: Thu, 27 Mar 2014 11:20:03 +0000 Subject: [PATCH] mod_lua: Prevent HTTP Response Splitting by not allowing tables in the request_rec to be set with values containing newlines. This is a semi-ugly hack, but it will have to do until we find another way of setting these values. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1582262 13f79535-47bb-0310-9956-ffa450edef68 --- modules/lua/lua_apr.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/lua/lua_apr.c b/modules/lua/lua_apr.c index 8a1dcf6811..867a370078 100644 --- a/modules/lua/lua_apr.c +++ b/modules/lua/lua_apr.c @@ -39,7 +39,14 @@ static int lua_table_set(lua_State *L) apr_table_t *t = ap_lua_check_apr_table(L, 1); const char *key = luaL_checkstring(L, 2); const char *val = luaL_checkstring(L, 3); - + + /* Prevent response/header splitting by not allowing newlines in tables. + * At this stage, we don't have the request_rec handy, and we can't change + * a const char*, so we'll redirect to a standard error value instead. + */ + if (ap_strchr_c(val, '\n')) { + val = "[ERROR: Value contains newline, ignored.]"; + } apr_table_set(t, key, val); return 0; } -- 2.50.1