[release-branch.go1.18] net/http: don't strip whitespace from Transfer-Encoding headers

Do not accept "Transfer-Encoding: \rchunked" as a valid TE header
setting chunked encoding.

Thanks to Zeyu Zhang (https://www.zeyu2001.com/) for identifying
the issue.

For #53188
For CVE-2022-1705
Fixes #53433

Change-Id: I1a16631425159267f2eca68056b057192a7edf6c
Reviewed-on: https://go-review.googlesource.com/c/go/+/409874
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
(cherry picked from commit e5017a93fcde94f09836200bca55324af037ee5f)
Reviewed-on: https://go-review.googlesource.com/c/go/+/415218
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
index fb18cb2c6f5b2e156bb10a177b7615f8a6e40bbe..3f3e1421a938ae94515052527e33aabea6a1f719 100644 (file)
--- a/src/net/http/serve_test.go
+++ b/src/net/http/serve_test.go
@@ -6250,6 +6250,7 @@ func TestUnsupportedTransferEncodingsReturn501(t *testing.T) {
                "fugazi",
                "foo-bar",
                "unknown",
+               "\rchunked",
        }
 
        for _, badTE := range unsupportedTEs {

diff --git a/src/net/http/transfer.go b/src/net/http/transfer.go
index 6d51178ee9082dc8cdb12eba6fce8f9f0d8b1f4d..de69d835ac6e67af05310268a156e945e20055c3 100644 (file)
--- a/src/net/http/transfer.go
+++ b/src/net/http/transfer.go
@@ -640,7 +640,7 @@ func (t *transferReader) parseTransferEncoding() error {
        if len(raw) != 1 {
                return &unsupportedTEError{fmt.Sprintf("too many transfer encodings: %q", raw)}
        }
-       if !ascii.EqualFold(textproto.TrimString(raw[0]), "chunked") {
+       if !ascii.EqualFold(raw[0], "chunked") {
                return &unsupportedTEError{fmt.Sprintf("unsupported transfer encoding: %q", raw[0])}
        }