Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(esp_http_server): adds check for crlf in response creation

Browse Source
This commit is contained in:
Ashish Sharma
2026-04-13 10:32:41 +08:00
parent 93b9d470db
commit dba7694724
2 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_http_server/test_apps/main/test_http_server.c
+35
View File
@@ -290,6 +290,41 @@ TEST_CASE("Max Allowed Sockets Test", "[HTTP SERVER]")
TEST_ASSERT(httpd_start(&hd, &config) != ESP_OK);
}
TEST_CASE("httpd_resp_set_hdr rejects CRLF in header field and value", "[HTTP SERVER][security]")
{
httpd_req_t fake_req = {0};
/* \r\n in value */
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_hdr(&fake_req, "X-Field", "val\r\nX-Injected: pwned"));
/* bare \n in value */
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_hdr(&fake_req, "X-Field", "val\nX-Injected: pwned"));
/* \r\n in field name */
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_hdr(&fake_req, "X-Field\r\nX-Injected: pwned", "val"));
}
TEST_CASE("httpd_resp_set_status rejects CRLF in status string", "[HTTP SERVER][security]")
{
httpd_req_t fake_req = {0};
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_status(&fake_req, "200 OK\r\nX-Injected: pwned"));
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_status(&fake_req, "200 OK\nX-Injected: pwned"));
}
TEST_CASE("httpd_resp_set_type rejects CRLF in content type", "[HTTP SERVER][security]")
{
httpd_req_t fake_req = {0};
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_type(&fake_req, "text/html\r\nX-Injected: pwned"));
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG,
httpd_resp_set_type(&fake_req, "text/html\nX-Injected: pwned"));
}
void app_main(void)
{
unity_run_menu();