# HG changeset patch
# User Maxim Dounin <mdounin@mdounin.ru>
# Date 1624892484 -10800
# Node ID e0fdd75871e40e4c57ed405cadb94235550142c9
# Parent  b87b7092cedb742477fbcffb879e9ab7a6e55bef
Disabled control characters in the Host header.

Control characters (0x00-0x1f, 0x7f) and space are not expected to appear
in the Host header.  Requests with such characters in the Host header are
now unconditionally rejected.

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2176,15 +2176,16 @@ ngx_http_validate_host(ngx_str_t *host, 
             }
             break;
 
-        case '\0':
-            return NGX_DECLINED;
-
         default:
 
             if (ngx_path_separator(ch)) {
                 return NGX_DECLINED;
             }
 
+            if (ch <= 0x20 || ch == 0x7f) {
+                return NGX_DECLINED;
+            }
+
             if (ch >= 'A' && ch <= 'Z') {
                 alloc = 1;
             }