Skip to content

Detect missing colon when parsing http headers with no value #9871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Dec 11, 2019
Merged

Detect missing colon when parsing http headers with no value #9871

merged 1 commit into from
Dec 11, 2019
+21 −0

Conversation

normanmaurer
Copy link
Member

Motivation:

Technical speaking its valid to have http headers with no values so we should support it. That said we need to detect if these are "generated" because of an "invalid" fold.

Modifications:

  • Detect if a colon is missing when parsing headers.
  • Add unit test

Result:

Fixes #9866

@normanmaurer
Detect missing colon when parsing http headers with no value
6ad40c8 
Motivation:

Technical speaking its valid to have http headers with no values so we should support it. That said we need to detect if these are "generated" because of an "invalid" fold.

Modifications:

- Detect if a colon is missing when parsing headers.
- Add unit test

Result:

Fixes #9866
@normanmaurer normanmaurer mentioned this pull request Dec 11, 2019
Closed
@normanmaurer
Copy link
Member Author

Just for the record here is the important bit for empty header value : whatwg/fetch#332 (comment)

@normanmaurer normanmaurer added this to the 4.1.44.Final milestone Dec 11, 2019
@normanmaurer
Copy link
Member Author

@amizurov maybe you also want to review

@normanmaurer normanmaurer merged commit a7c18d4 into 4.1 Dec 11, 2019
@normanmaurer normanmaurer deleted the check_for_colon branch December 11, 2019 14:49
normanmaurer added a commit that referenced this pull request Dec 11, 2019
@normanmaurer
Detect missing colon when parsing http headers with no value (#9871)
745814b 
Motivation:

Technical speaking its valid to have http headers with no values so we should support it. That said we need to detect if these are "generated" because of an "invalid" fold.

Modifications:

- Detect if a colon is missing when parsing headers.
- Add unit test

Result:

Fixes #9866
dalaro pushed a commit to dalaro/netty that referenced this pull request Mar 30, 2020
@normanmaurer @dalaro
Detect missing colon when parsing http headers with no value (netty#9871
072722a 
)

Motivation:

Technical speaking its valid to have http headers with no values so we should support it. That said we need to detect if these are "generated" because of an "invalid" fold.

Modifications:

- Detect if a colon is missing when parsing headers.
- Add unit test

Result:

Fixes netty#9866

(cherry picked from commit a7c18d4)

(After the default cherry-pick algorithm finished, I hand-resolved some
compile errors related to refactoring between the 4.0 and 4.1 branches)
dalaro pushed a commit to dalaro/netty that referenced this pull request Mar 30, 2020
@normanmaurer @dalaro
Detect missing colon when parsing http headers with no value (netty#9871
18ce1ac 
)

Motivation:

Technical speaking its valid to have http headers with no values so we should support it. That said we need to detect if these are "generated" because of an "invalid" fold.

Modifications:

- Detect if a colon is missing when parsing headers.
- Add unit test

Result:

Fixes netty#9866

(cherry picked from commit a7c18d4)
dalaro added a commit to dalaro/netty that referenced this pull request Apr 7, 2020
@dalaro
Version bump to 4.0.54.1.dse
9d7e6fa 
This version is equivalent to upstream's 4.0.54.Final, but with one
upstream commit (for CVE-2019-20444) cherry-picked backwards from 4.1.

Detect missing colon when parsing http headers with no value (netty#9871)
	GHSA-cqqj-4p63-rrmm
	netty#9866
	netty#9871

	a7c18d4
dalaro added a commit to dalaro/netty that referenced this pull request Apr 7, 2020
@dalaro
Version bump to 4.1.25.7.dse
e325faa 
Compared against 4.1.25.6.dse, this tag cherry-picks upstream commits
that fixed bugs in HttpObjectDecoder/HttpRequestDecoder, plus two
intermediate refactoring commits that indirectly affect those bugfix
commits.

What follows is a list of PR links, issue links, CVE links, and hashes
associated with the cherry-picked commits.

Verify we do not receive multiple content-length headers or a content-length and transfer-encoding: chunked header when using HTTP/1.1 (netty#9865)
	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7238
	netty#9861
	netty#9865

	8494b04

Detect missing colon when parsing http headers with no value (netty#9871)
	GHSA-cqqj-4p63-rrmm
	netty#9866
	netty#9871

	a7c18d4

Fix typos in javadocs (netty#9527)
	skipped

Correctly handle whitespaces in HTTP header names as defined by RFC7230#section-3.2.4 (netty#9585)
	https://nvd.nist.gov/vuln/detail/CVE-2019-16869
	netty#9571
	netty#9585

	39cafcb

Use `AppendableCharSequence.charAtUnsafe(int)` in `HttpObjectDecoder` (netty#9492)
	netty#9492

	85fcf4e

use checkPositive/checkPositiveOrZero (netty#8835)
	netty#8835

	4c64c98

HttpObjectDecoder ignores HTTP trailer header when empty line is rece… (netty#8799)
	netty#8736
	netty#8799

	91d3920
dalaro added a commit to dalaro/netty that referenced this pull request Apr 7, 2020
@dalaro
Version bump to 4.1.34.3.dse
55207c3 
Compared against 4.1.34.2.dse, this tag cherry-picks upstream commits
that fixed bugs in HttpObjectDecoder/HttpRequestDecoder, plus two
intermediate refactoring commits that indirectly affect those bugfix
commits.

What follows is a list of PR links, issue links, CVE links, and hashes
associated with the cherry-picked commits.

Verify we do not receive multiple content-length headers or a content-length and transfer-encoding: chunked header when using HTTP/1.1 (netty#9865)
	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7238
	netty#9861
	netty#9865

	8494b04

Detect missing colon when parsing http headers with no value (netty#9871)
	https://nvd.nist.gov/vuln/detail/CVE-2019-20444
	netty#9866
	netty#9871

	a7c18d4

Fix typos in javadocs (netty#9527)
	skipped

Correctly handle whitespaces in HTTP header names as defined by RFC7230#section-3.2.4 (netty#9585)
	https://nvd.nist.gov/vuln/detail/CVE-2019-16869
	netty#9571
	netty#9585

	39cafcb

Use `AppendableCharSequence.charAtUnsafe(int)` in `HttpObjectDecoder` (netty#9492)
	netty#9492

	85fcf4e
ihanyong pushed a commit to ihanyong/netty that referenced this pull request Jul 31, 2020
@normanmaurer @ihanyong
Detect missing colon when parsing http headers with no value (netty#9871
f7f2e6f 
)

Motivation:

Technical speaking its valid to have http headers with no values so we should support it. That said we need to detect if these are "generated" because of an "invalid" fold.

Modifications:

- Detect if a colon is missing when parsing headers.
- Add unit test

Result:

Fixes netty#9866
suneet-s added a commit to suneet-s/netty that referenced this pull request Aug 18, 2020
@suneet-s
Fix CVE-2019-20444
df71b27 
Backport netty#9871
@suneet-s suneet-s mentioned this pull request Aug 18, 2020
Merged
suneet-s added a commit to implydata/netty that referenced this pull request Aug 18, 2020
@suneet-s
Fix CVE-2019-20444 (#1)
8219bcb 
Backport netty#9871
@scott-cx scott-cx mentioned this pull request Aug 1, 2022
Open
@ytang1-godaddy ytang1-godaddy mentioned this pull request Feb 6, 2023
Open
vivek807 added a commit to deep-bi/netty that referenced this pull request Sep 27, 2024
@vivek807
DEEP-462: Backported the [PR](netty#9871)
54e8d1d
vivek807 added a commit to deep-bi/netty that referenced this pull request Sep 28, 2024
@vivek807
DEEP-462: Backported the [PR](netty#9871)
e2fcd6d
@vivek807 vivek807 mentioned this pull request Sep 28, 2024
Merged
vivek807 added a commit to deep-bi/netty that referenced this pull request Oct 3, 2024
@vivek807 @normanmaurer
CVE-2019-20444 fix (#2)
fa42adb 
* [maven-release-plugin] prepare for next development iteration

* Use the Runnable.run method to clean direct byte buffers if avaiable.

Motivation:

In JDK9 the Cleaner.clean method cannot be called as it is not exported
from `java.base`. `Runnable.run` should be called instead.

Modifications:
Pick Runnable.run if the cleaner implements Runnable. Otherwise try the
clean method on the class implementing the cleaner.

Result:
The cleaner for direct byte buffers is run on JDK9 as well as earlier
JDKs.

* VISA-11: Added fix for http request smuggling, cause by obfuscating TE header (#1)

VISA-11: Backported the PR netty#9585

Add fix for http request smuggling, cause by obfuscating TE header.

* DEEP-462: Backported the [PR](netty#9871)

---------

Co-authored-by: Norman Maurer <[email protected]>
Co-authored-by: Carsten Varming <[email protected]>
vivek807 added a commit to deep-bi/netty that referenced this pull request Oct 3, 2024
@vivek807 @normanmaurer
CVE 2019 20445 fix (#4)
b3338f9 
* [maven-release-plugin] prepare for next development iteration

* Use the Runnable.run method to clean direct byte buffers if avaiable.

Motivation:

In JDK9 the Cleaner.clean method cannot be called as it is not exported
from `java.base`. `Runnable.run` should be called instead.

Modifications:
Pick Runnable.run if the cleaner implements Runnable. Otherwise try the
clean method on the class implementing the cleaner.

Result:
The cleaner for direct byte buffers is run on JDK9 as well as earlier
JDKs.

* VISA-11: Added fix for http request smuggling, cause by obfuscating TE header (#1)

VISA-11: Backported the PR netty#9585

Add fix for http request smuggling, cause by obfuscating TE header.

* DEEP-462: Backported the [PR](netty#9871)

* DEEP-462: Backported the [PR](netty#9865)

---------

Co-authored-by: Norman Maurer <[email protected]>
Co-authored-by: Carsten Varming <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@slandelle slandelle Awaiting requested review from slandelle

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

4.1.44.Final

Development

Successfully merging this pull request may close these issues.

Netty shouldn't allow the invalid fold.

1 participant

@normanmaurer