[fix] Potential fix for code scanning alert no. 22: HTTP response splitting #23976
+9
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…itting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
|
@merlimat Please add the following content to your PR description and select a checkbox: |
merlimat
changed the title
github-actions
bot
added
doc-not-needed
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
...h-sasl/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderSasl.java
Fixed
Show fixed
Hide fixed
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/apache/pulsar/security/code-scanning/22
To fix the problem, we need to ensure that any user-provided input used in HTTP headers is properly sanitized to prevent HTTP response splitting. This can be done by removing or escaping special characters such as CRLF from the input before using it in the response header.
The best way to fix this issue is to create a method that sanitizes the input by removing or escaping special characters and then use this method to sanitize the
SASL_STATE_SERVERheader value before setting it in the response.docdoc-requireddoc-not-neededdoc-complete