[Security] CRLF Header Splitting

[Fenny]

The default library seems to serialize &%0d%0a replace it with empty spaces

// net/http
func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		q := r.URL.Query().Get("redirect")
		w.Header().Set("Location", q)
	})
}
// GET http://localhost:3000/?redirect=foo%0d%0aSet-Cookie:%20SESSIONID=MaliciousValue%0d%0a

// HTTP/1.1 200 OK
// Location: foo  Set-Cookie: SESSIONID=MaliciousValue
// Date: Wed, 09 Sep 2020 13:17:50 GMT
// Content-Length: 0

Where fasthttp does not, I'm wondering if this should be either documented or fixed asap.

// fasthttp
func main() {
	fasthttp.ListenAndServe(":3000", func(c *fasthttp.RequestCtx) {
		q := string(c.QueryArgs().Peek("redirect"))
		c.Response.Header.Set("Location", q)
	})
}
// GET http://localhost:3000/?redirect=foo%0d%0aSet-Cookie:%20SESSIONID=MaliciousValue%0d%0a

// HTTP/1.1 200 OK
// Server: fasthttp
// Date: Wed, 09 Sep 2020 13:18:12 GMT
// Content-Length: 0
// Location: foo
// Set-Cookie: SESSIONID=MaliciousValue

[erikdubbelboer]

I think this should be documented. net/http seems to make sure that header values don't contain newlines. I don't think fasthttp users want to have this overhead. The fasthttp API is much more raw which allows it to be faster.

[Fenny]

Possible to merge #909 and close this issue? Thanks @erikdubbelboer

[erikdubbelboer]

It's merged, I'll tag a release.