github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-30 11:44:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3225 from airween/v3/mpinvcharreqbody

Browse Source 
feat: Check if the MP header contains invalid character
This commit is contained in:
Ervin Hegedus
2024-08-14 09:06:14 +02:00
committed by GitHub
parent 718d121ee3 6388d88f38
commit a6b287e120
2 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/request_body_processor/multipart.cc
View File

@@ -916,6 +916,18 @@ int Multipart::process_part_header(std::string *error, int offset) {
return false;
}
/* check if multipart header contains any invalid characters */
for (const auto& ch : header_name) {
if (ch < 33 || ch > 126) {
ms_dbg_a(m_transaction, 1,
"Multipart: Invalid part header " \
"(contains invalid character).");
error->assign("Multipart: Invalid part header "\
"(contains invalid character).");
return false;
}
}
/* extract the value value */
data++;
i++;