jruby/jruby-rack — Issue #81: Guarding against response splitting attacks
Author: igrigorik
Created: 2012-01-05 00:20:18+00:00
State: open

http://en.wikipedia.org/wiki/HTTP_response_splitting

Rack does a pass over the user-provided header values, splitting all of them on newlines:
- https://github.com/rack/rack/commit/aadfd1386132279ee06159384c385c3eee03b3bb

Based on the current servlet handler implementation (if I'm reading it correctly), this step is skipped in jruby-rack:
- https://github.com/jruby/jruby-rack/blob/master/src/main/ruby/rack/handler/servlet.rb#L48
- https://github.com/jruby/jruby-rack/blob/master/src/main/ruby/jruby/rack/response.rb#L58

I think the response handler just need to be augmented to do the newline split -- does this make sense? Want to make sure I'm on the right track and this is not handled elsewhere already.