Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 6388d88

Browse files
committed
Check if the MP header contains invalid character
1 parent 305f33f commit 6388d88

File tree

2 files changed

+63
-0
lines changed

2 files changed

+63
-0
lines changed

‎src/request_body_processor/multipart.cc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -918,6 +918,18 @@ int Multipart::process_part_header(std::string *error, int offset) {
918918
return false;
919919
}
920920

921+
/* check if multipart header contains any invalid characters */
922+
for (const auto& ch : header_name) {
923+
if (ch < 33 || ch > 126) {
924+
ms_dbg_a(m_transaction, 1,
925+
"Multipart: Invalid part header " \
926+
"(contains invalid character).");
927+
error->assign("Multipart: Invalid part header "\
928+
"(contains invalid character).");
929+
return false;
930+
}
931+
}
932+
921933
/* extract the value value */
922934
data++;
923935
i++;

‎test/test-cases/regression/request-body-parser-multipart.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3294,5 +3294,56 @@
32943294
"SecRequestBodyAccess On",
32953295
"SecRule ARGS:namea \"@streq 111\" \"phase:2,deny,id:500096\""
32963296
]
3297+
},
3298+
{
3299+
"enabled":1,
3300+
"version_min":300000,
3301+
"title":"multipart parser (invalid part header - contains invalid character)",
3302+
"client":{
3303+
"ip":"200.249.12.31",
3304+
"port":123
3305+
},
3306+
"server":{
3307+
"ip":"200.249.12.31",
3308+
"port":80
3309+
},
3310+
"request":{
3311+
"headers":{
3312+
"Host":"localhost",
3313+
"User-Agent":"curl/7.38.0",
3314+
"Accept":"*/*",
3315+
"Content-Length":"330",
3316+
"Content-Type":"multipart/form-data; boundary=a",
3317+
"Expect":"100-continue"
3318+
},
3319+
"uri":"/",
3320+
"method":"POST",
3321+
"body":[
3322+
"--a\r",
3323+
"\u000eContent-Disposition\u000e: form-data; name=\"file\"; filename=\"1.jsp\"\r",
3324+
"Content-Disposition: form-data; name=\"post\";\r",
3325+
"\r",
3326+
"<%out.print(123)%>\r",
3327+
"--a--\r"
3328+
]
3329+
},
3330+
"response":{
3331+
"headers":{
3332+
"Date":"2015年7月13日 20:02:41 GMT",
3333+
"Last-Modified":"2014年10月26日 22:33:37 GMT",
3334+
"Content-Type":"text/html"
3335+
},
3336+
"body":[
3337+
"no need."
3338+
]
3339+
},
3340+
"expected":{
3341+
"http_code":403,
3342+
"debug_log":"Multipart: Invalid part header \\(contains invalid character\\)"
3343+
},
3344+
"rules":[
3345+
"SecruleEngine On",
3346+
"SecRule REQBODY_PROCESSOR_ERROR \"@eq 1\" \"phase:2,deny,status:403,id:500077\""
3347+
]
32973348
}
32983349
]

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /