Re: Bug: committers can set arbitrary HTTP Headers on any file

On 2007-08-10 13:24:17 -0500, Brian W. Fitzpatrick wrote:
> $ curl -I http://svn.red-bean.com/repos/test/foo.txt
[...]
> Content-Type: text/plain; charset=UTF-8
> X-Fitz-Rules: Totally
> X-Cheeseburger: kthxbai
>
>
> I suggest that we do two things to fix this:
>
> - Fix libsvn_subr/validate.c:svn_mime_type_validate to allow at most one newline
> - Fix mod_dav_svn to truncate the svn:mime-type at the first newline
> (since we can't really rely on the client's validation).
>
> Thoughts?

another option would be to use header folding
[[[
$ curl -I http://svn.red-bean.com/repos/test/foo.txt
[...]
Content-Type: text/plain; charset=UTF-8
  X-Fitz-Rules: Totally
  X-Cheeseburger: kthxbai
]]]

in the end it might confuse more browsers/clients.
but it would be a proper solution for handling multiline values.

    darix

-- 
           openSUSE - SUSE Linux is my linux
               openSUSE is good for you
                   www.opensuse.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org