changeset 8832:0d35b1ff6af5 quic

HTTP/3: disabled control characters and space in header names. This is a follow up to 41f4bd4c51f1.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 10 Aug 2021 12:35:12 +0300
parents 598f8e3bef30
children e5a180511dec
files src/http/v3/ngx_http_v3_request.c
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/v3/ngx_http_v3_request.c
+++ b/src/http/v3/ngx_http_v3_request.c
@@ -428,7 +428,7 @@ ngx_http_v3_validate_header(ngx_http_req
             continue;
         }
 
-        if (ch == '\0' || ch == LF || ch == CR || ch == ':'
+        if (ch <= 0x20 || ch == 0x7f || ch == ':'
             || (ch >= 'A' && ch <= 'Z'))
         {
             ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,