Skip to content

Commit

Permalink
ShenYu Admin Cluster #5448
Browse files Browse the repository at this point in the history
  • Loading branch information
Aias00 committed Apr 24, 2024
1 parent 664b79b commit 6102027
Showing 1 changed file with 6 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -133,20 +133,24 @@ private void forwardRequest(final HttpServletRequest request, final HttpServletR
private void copyHeaders(final HttpServletRequest request, final HttpHeaders headers) {
Collections.list(request.getHeaderNames())
.forEach(headerName -> {
headers.add(headerName, request.getHeader(headerName).replace("\r", "").replace("\n", ""));
headers.add(headerName, removeSpecial(request.getHeader(headerName)));
});
}

private void copyHeaders(final HttpHeaders sourceHeaders, final HttpServletResponse response) {
sourceHeaders.forEach((headerName, headerValues) -> {
if (!response.containsHeader(headerName)) {
headerValues.forEach(headerValue -> {
response.addHeader(headerName, headerValue.replace("\r", "").replace("\n", ""));
response.addHeader(headerName, removeSpecial(headerValue));

Check warning

Code scanning / CodeQL

HTTP response splitting Medium

This header depends on a
user-provided value
, which may cause a response-splitting vulnerability.
});
}
});
}

private static String removeSpecial(final String str) {
return str.replaceAll("[^a-zA-Z ]", "");
}

private byte[] getBody(final HttpServletRequest request) throws IOException {
InputStream is = request.getInputStream();
ByteArrayOutputStream baos = new ByteArrayOutputStream();
Expand Down

0 comments on commit 6102027

Please sign in to comment.