Re: What is WARNING: suspicious CR characters in HTTP header ?

On Mon, 14 Feb 2005, Evgeny Kotsuba wrote:

> Hi,
>
> What is WARNING: suspicious CR characters in HTTP header ?
> Say, what is wrong in
> "Set-Cookie: sbtpoll1067196868\r=1067196868\r; path=/; expires=Tue,

here: ^^^^^ ^^^^

> 15-Feb-2005 15:31:46 GMT\r\nLocation:
> http://www.metallica.kiev.ua/\r\nConnection: close\r\nContent-Type:
> text/html; charset=iso-8859-1\r\n\r\n"
>
> And why in case of "suspicious CR characters " header is not
> developed propelly ?

The header is malformed, having CR characters in the middle of the header
value. CR characters is only allowed as part of the line ending, not
alone.

> I .e. why return is made in
> -------8<---------------
> if (memchr(this_line, '\r', field_end - this_line)) {
> debug(55, 1) ("WARNING: suspicious CR characters in HTTP
> header near {%s}\n",
> getStringPrefix(field_start, header_end));
> //??EK return httpHeaderReset(hdr);
> }

Because the header can not be parsed properly without introducing
ambigouity in the HTTP protocol.

Regards
Henrik
Received on Mon Feb 14 2005 - 12:22:27 MST