[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: Bug: committers can set arbitrary HTTP Headers on any file

From: Jeremy Pereira <jeremy.pereira_at_ntlworld.com>
Date: 2007-08-16 08:20:40 CEST

On 10 Aug 2007, at 23:44, Marcus Rueckert wrote:

> On 2007-08-10 13:24:17 -0500, Brian W. Fitzpatrick wrote:
>> $ curl -I http://svn.red-bean.com/repos/test/foo.txt
> [...]
>> Content-Type: text/plain; charset=UTF-8
>> X-Fitz-Rules: Totally
>> X-Cheeseburger: kthxbai
>>
>>
>> I suggest that we do two things to fix this:
>>
>> - Fix libsvn_subr/validate.c:svn_mime_type_validate to allow at
>> most one newline
>> - Fix mod_dav_svn to truncate the svn:mime-type at the first newline
>> (since we can't really rely on the client's validation).
>>
>> Thoughts?
>
> another option would be to use header folding
> [[[
> $ curl -I http://svn.red-bean.com/repos/test/foo.txt
> [...]
> Content-Type: text/plain; charset=UTF-8
> X-Fitz-Rules: Totally
> X-Cheeseburger: kthxbai
> ]]]
>
> in the end it might confuse more browsers/clients.
> but it would be a proper solution for handling multiline values.

But you can't put just anything in the Content-Type header. The
syntax of the Content-Type header is defined by the HTTP 1.1 RFC
(RFC2616). The above Content-Type header would not conform to the
RFC definition and so it is not a proper solution in this instance

The proper solution is to fix mime type validation so that only mime
types are allowed.

>
> darix
>
> --
> openSUSE - SUSE Linux is my linux
> openSUSE is good for you
> www.opensuse.org
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: dev-help@subversion.tigris.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Thu Aug 16 08:18:51 2007

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.