Core: Validate header names and values to prevent CRLF injection

Open Beginner friendly
#2,180 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
security

Research direction

Start in HttpHeaders.addHeader() and trace how headers reach HttpHeaders.serializeHeaders(...). Run the named regression tests, testSerializeHeaders_crlfInjectionInName and testSerializeHeaders_crlfInjectionInValue, or add them if they are not present. Done means CRLF-containing names and values are rejected while valid headers still serialize successfully.

Written by the indexing model from the issue text.

Description

Environment details

  1. Core - HttpHeaders in google-http-client
  2. OS type and version: Any
  3. Java version: Any (Java 8+)
  4. google-http-client version: 2.1.1 and earlier

Problem Statement

HttpHeaders does not validate header names or values for carriage return (\r) or line feed (\n) characters. If untrusted input is passed into header names or values, an attacker can inject CRLF sequences leading to HTTP Response Splitting or Header Injection.

Steps to reproduce

  1. Create a HttpHeaders instance with a header name or value containing \r\n.
  2. Serialize headers into a low-level HTTP request using HttpHeaders.serializeHeaders(...).
  3. Observe that the injected header line is accepted without error.

Proposed Fix

Reject header names or values containing CRLF in HttpHeaders.addHeader():

if (name.contains("\r") || name.contains("\n") || stringValue.contains("\r") || stringValue.contains("\n")) {
  throw new IllegalArgumentException("Header name or value contains CRLF characters.");
}

Regression tests (testSerializeHeaders_crlfInjectionInName and testSerializeHeaders_crlfInjectionInValue) are included in the accompanying PR.

Dominant language
Java
Stars
1.4k
Forks
473
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from googleapis/google-http-java-client

All issues in googleapis/google-http-java-client

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.