adafruit-mirror/arduino-esp32
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(webserver): Validate header inputs

Browse source
This commit is contained in:
Lucas Saavedra Vaz 2025-06-26 12:43:50 +03:00
parent 9e61fa7e4b
commit 21640ac82a
No known key found for this signature in database
GPG key ID: 9CAE85DC84A38188
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
libraries/WebServer/src/WebServer.cpp
View file

@ -502,6 +502,16 @@ void WebServer::stop() {
}
void WebServer::sendHeader(const String &name, const String &value, bool first) {
if (name.indexOf('\r') != -1 || name.indexOf('\n') != -1) {
log_e("Invalid character in HTTP header name");
return;
}
if (value.indexOf('\r') != -1 || value.indexOf('\n') != -1) {
log_e("Invalid character in HTTP header value");
return;
}
RequestArgument *header = new RequestArgument();
header->key = name;
header->value = value;