]> git.kaiwu.me - haproxy.git/commit
BUG/MEDIUM: h1: Enforce the authority validation during H1 request parsing
authorChristopher Faulet <cfaulet@haproxy.com>
Tue, 28 Apr 2026 09:20:59 +0000 (11:20 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Wed, 29 Apr 2026 08:03:39 +0000 (10:03 +0200)
commita46b0eec72e01dbbf436c8bd6917d9e4097ba8c3
tree3afb98695642c5d6c65f353f255263b8ca6e34d1
parentb743b566b4215ed49b95d2fc22054ffe66202a0f
BUG/MEDIUM: h1: Enforce the authority validation during H1 request parsing

When a H1 request was parsed, only a light validation was performed on the
URI, mainly because there was no distinction between the different parts of
the URI. So only characters in the range [0x21, 0x7e], excluding the "#" was
allowed.

To be consistant with the H2 and H3 parser, the authority is now validated,
using http_authority_has_forbidden_char() function.

This patch should be backported as far as 2.8. For previous verions,
http_authority_has_forbidden_char() function does not exist.
src/h1.c