Repository navigation
Conversation
292a408 rejects a request header block with more than one Host header (GHSA-6hr6-w5qg-qmwg), and 92b925e added a test case for it. That case puts the mismatching Host last, so the older :authority/Host mismatch check already rejects it: the test still passes with the new check taken out. Add two cases only the duplicate check catches: the matching Host header last, and two Host headers with no :authority. Both are accepted without the fix. Assisted-by: Claude Code
Member
|
Thanks - good catch! 🎉 |
Move the duplicate Host header cases into their own list and add a test that checks the ProtocolError says "Request header block has multiple Host headers", so it fails if any other header check rejects these blocks instead. The cases stay in the general invalid header list too. Assisted-by: Claude Code
Author
|
Sure, done in b7b20fa. I moved the three duplicate Host cases into their own list and added a test that checks the I used Claude Code to check that the new test fails on all six cases with the fix from 292a408 taken out, and that it passes with the fix in. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
292a408 rejects request headers with more than one Host header (GHSA-6hr6-w5qg-qmwg), and 92b925e added a test case for it. That case puts the mismatching Host header last, so the older :authority/Host mismatch check already rejects it. The test still passes with the new duplicate check taken out.
This adds two cases that only the duplicate check catches:
Both are accepted without the fix and rejected with it. Tests only.
I wrote this with help from Claude Code (noted in the commit message).