svn commit: r1936260 - in httpd/httpd/trunk: changes-entries modules/metadata

Author: jorton
Date: Fri Jul 17 12:12:23 2026
New Revision: 1936260

Log:
mod_cern_meta: reject HTTP framing headers in metadata files

* modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500
  error if a framing header is found in a .meta file rather than
  merging it into the response headers.

Assisted-by: Claude Sonnet 4.6 <[email protected]>
GitHub: PR #685

Added:
   httpd/httpd/trunk/changes-entries/cern-meta-header-injection.txt
Modified:
   httpd/httpd/trunk/modules/metadata/mod_cern_meta.c

Added: httpd/httpd/trunk/changes-entries/cern-meta-header-injection.txt
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/trunk/changes-entries/cern-meta-header-injection.txt	Fri Jul 17 12:12:23 2026	(r1936260)
@@ -0,0 +1,2 @@
+  *) mod_cern_meta: Reject HTTP framing headers in metadata files to prevent
+     response splitting.  [Joe Orton]

Modified: httpd/httpd/trunk/modules/metadata/mod_cern_meta.c
==============================================================================
--- httpd/httpd/trunk/modules/metadata/mod_cern_meta.c	Fri Jul 17 12:12:12 2026	(r1936259)
+++ httpd/httpd/trunk/modules/metadata/mod_cern_meta.c	Fri Jul 17 12:12:23 2026	(r1936260)
@@ -256,6 +256,18 @@ static int scan_meta_file(request_rec *r
             sscanf(l, "%d", &r->status);
             r->status_line = apr_pstrdup(r->pool, l);
         }
+        else if (!ap_cstr_casecmp(w, "Transfer-Encoding")
+                 || !ap_cstr_casecmp(w, "Content-Length")
+                 || !ap_cstr_casecmp(w, "Connection")
+                 || !ap_cstr_casecmp(w, "Trailer")
+                 || !ap_cstr_casecmp(w, "Upgrade")
+                 || !ap_cstr_casecmp(w, "Keep-Alive")
+                 || !ap_cstr_casecmp(w, "TE")) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10596)
+                          "forbidden HTTP framing header '%s' in meta file: %s",
+                          w, r->filename);
+            return HTTP_INTERNAL_SERVER_ERROR;
+        }
         else {
             apr_table_set(tmp_headers, w, l);
         }