Commits on Aug 6, 2017

1. Fix parsing the Forwarded header (#2170) …

   This fixes #2170 by parsing Forwarded more carefully, while staying about
   as fast, simple, and robust in the face of potential injection attacks.
   (Speed was measured with IPython's %timeit on my laptop on a few typical
   and pathological header values.)
   
   In particular:
   
   - commas and semicolons are allowed inside quoted-strings;
   - empty forwarded-pairs (as in "for=_1;;by=_2") are allowed;
   - non-standard parameters are allowed (although this alone could be easily
     done in the previous parser).
   
   This still doesn't parse valid headers containing obs-text, which was
   an intentional decision in the previous parser (see comments) that I did
   not change.
   
   Also, the previous parser used to bail out of forwarded-elements containing
   duplicate parameter names. No rationale was given in the code, and I don't
   think this is important, so the new parser doesn't enforce this.

   

   vfaronov committed Aug 6, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for a9ddd91
   • Browse repository at this point

   Copy the full SHA

   a9ddd91 View commit details

   Browse the repository at this point in the history