github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 13:56:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Check if the MP header contains invalid character

Browse Source
This commit is contained in:
Ervin Hegedus 2024-08-13 11:07:18 +02:00
parent 935e68c816
commit f27c85cf47
No known key found for this signature in database
GPG Key ID: 5FA5BC3F5EC41F61
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
apache2/msc_multipart.c
View File

@ -402,7 +402,7 @@ static int multipart_process_part_header(modsec_rec *msr, char **error_msg) {
if (msr->mpd->mpp->last_header_line != NULL) { if (msr->mpd->mpp->last_header_line != NULL) {
*(char **)apr_array_push(msr->mpd->mpp->header_lines) = msr->mpd->mpp->last_header_line; *(char **)apr_array_push(msr->mpd->mpp->header_lines) = msr->mpd->mpp->last_header_line;
msr_log(msr, 9, "Multipart: Added part header line \"%s\"", msr->mpd->mpp->last_header_line); msr_log(msr, 9, "Multipart: Added part header line \"%s\"", msr->mpd->mpp->last_header_line);
} }
data = msr->mpd->buf; data = msr->mpd->buf;
@ -424,6 +424,16 @@ static int multipart_process_part_header(modsec_rec *msr, char **error_msg) {
return -1; return -1;
} }
/* check if multipart header contains any invalid characters */
char *ch = header_name;
while(*ch != '\0') {
if (*ch < 33 || *ch > 126) {
*error_msg = apr_psprintf(msr->mp, "Multipart: Invalid part header (contains invalid character).");
return -1;
}
ch++;
}
/* extract the value value */ /* extract the value value */
data++; data++;
while((*data == '\t') || (*data == ' ')) data++; while((*data == '\t') || (*data == ' ')) data++;