Skip to content

Harden URI parsing against CRLF injection #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jun 18, 2025
Merged

Harden URI parsing against CRLF injection #66

merged 2 commits into from
Jun 18, 2025

Conversation

@quinnj
Copy link
Member

@quinnj quinnj commented Jun 14, 2025

Summary

  • reject CR and LF characters when constructing or parsing URIs
  • raise ParseError for CRLF characters found while parsing
  • ensure constructors validate for CRLF characters
  • add regression tests for CRLF injection attempts

Testing

  • julia --project=. -e 'using Pkg; Pkg.test()' (fails: download test mismatch)

https://chatgpt.com/codex/tasks/task_b_684d8e8db768833188c7a2d89283728e

@quinnj quinnj merged commit f8c8734 into master Jun 18, 2025
9 of 10 checks passed
@quinnj quinnj deleted the codex/add-uri-validation-for-crlf-injection branch June 18, 2025 16:55
DilumAluthge added a commit to JuliaWeb/HTTP.jl that referenced this pull request Jun 19, 2025
@DilumAluthge
Require URIs.jl >= 1.6 (so that we have JuliaWeb/URIs.jl#66)
a31978d
@DilumAluthge DilumAluthge mentioned this pull request Jun 19, 2025
Merged
quinnj pushed a commit to JuliaWeb/HTTP.jl that referenced this pull request Jun 19, 2025
@DilumAluthge
Require URIs.jl >= 1.6, and bump version from 1.10.16 to 1.10.17 (#1225)
e124953 
* Require URIs.jl >= 1.6 (so that we have JuliaWeb/URIs.jl#66)

* Bump version from 1.10.16 to 1.10.17
This was referenced Jun 20, 2025
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

codex

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@quinnj