Skip to content

Commit 584632f

Browse files
pimterrypimterry
committed
Add more escaping cases for header keys
Most examples already handle this correctly, just tweaks required for R and HTTPie. I had assumed these were invalid header names, but apparently that's not actually correct!
1 parent 65658c1 commit 584632f

File tree

39 files changed

+208
-8
lines changed

39 files changed

+208
-8
lines changed

‎src/targets/r/httr.js‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,12 @@ module.exports = function (source, options) {
106106
const otherHeaders = Object.entries(source.allHeaders)
107107
// These headers are all handled separately:
108108
.filter(([key]) => !['cookie', 'accept', 'content-type'].includes(key.toLowerCase()))
109-
.map(([key, value]) => `${key.replace(/-/g, '_')} = '${escape(value, { delimiter: "'" })}'`)
109+
.map(([key, value]) => {
110+
const safeKey = key.match(/^[a-zA-Z][a-zA-Z0-9_.-]*$/)
111+
? key.replace(/-/g, '_')
112+
: '"' + escape(key) + '"'
113+
return `${safeKey} = '${escape(value, { delimiter: "'" })}'`
114+
})
110115
.join(', ')
111116

112117
const setHeaders = otherHeaders

‎src/targets/shell/httpie.js‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ module.exports = function (source, options) {
9090

9191
// construct headers
9292
Object.keys(source.allHeaders).sort().forEach(function (key) {
93-
code.push('%s:%s', key, shell.quote(source.allHeaders[key]))
93+
code.push('%s:%s', shell.quote(key), shell.quote(source.allHeaders[key]))
9494
})
9595

9696
if (source.postData.mimeType === 'application/x-www-form-urlencoded') {
@@ -109,7 +109,12 @@ module.exports = function (source, options) {
109109
code.unshift('http %s%s %s', flags.length ? flags.join(' ') + ' ' : '', source.method, shell.quote(opts.queryParams ? source.url : source.fullUrl))
110110

111111
if (raw && source.postData.text) {
112-
code.unshift('echo %s | ', shell.quote(source.postData.text))
112+
if (source.postData.text.includes('\\')) {
113+
// Printf handles escape characters more clearly & portably than echo
114+
code.unshift("printf '%%s' %s | ", shell.quote(source.postData.text))
115+
} else {
116+
code.unshift('echo %s | ', shell.quote(source.postData.text))
117+
}
113118
}
114119

115120
return code.join()

‎test/fixtures/output/c/libcurl/malicious.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,16 @@ curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
44
curl_easy_setopt(hnd, CURLOPT_URL, "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C");
55

66
struct curl_slist *headers = NULL;
7+
headers = curl_slist_append(headers, "': squote-key-test");
78
headers = curl_slist_append(headers, "squote-value-test: '");
89
headers = curl_slist_append(headers, "dquote-value-test: \"");
10+
headers = curl_slist_append(headers, "`: backtick-key-test");
911
headers = curl_slist_append(headers, "backtick-value-test: `");
12+
headers = curl_slist_append(headers, "$: dollar-key-test");
1013
headers = curl_slist_append(headers, "dollar-parenthesis-value-test: $(");
14+
headers = curl_slist_append(headers, "#: hash-key-test");
1115
headers = curl_slist_append(headers, "hash-brace-value-test: #{");
16+
headers = curl_slist_append(headers, "%: percent-key-test");
1217
headers = curl_slist_append(headers, "percent-parenthesis-value-test: %(");
1318
headers = curl_slist_append(headers, "percent-brace-value-test: %{");
1419
headers = curl_slist_append(headers, "double-brace-value-test: {{");

‎test/fixtures/output/clojure/clj_http/malicious.clj‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
(require '[clj-http.client :as client])
22

3-
(client/post "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//" {:headers {:squote-value-test "'"
3+
(client/post "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//" {:headers {"'" "squote-key-test"
4+
:squote-value-test "'"
45
:dquote-value-test "\""
6+
"`" "backtick-key-test"
57
:backtick-value-test "`"
8+
"$" "dollar-key-test"
69
:dollar-parenthesis-value-test "$("
10+
"#" "hash-key-test"
711
:hash-brace-value-test "#{"
12+
"%" "percent-key-test"
813
:percent-parenthesis-value-test "%("
914
:percent-brace-value-test "%{"
1015
:double-brace-value-test "{{"

‎test/fixtures/output/csharp/httpclient/malicious.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,16 @@
55
RequestUri = new Uri("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C"),
66
Headers =
77
{
8+
{ "'", "squote-key-test" },
89
{ "squote-value-test", "'" },
910
{ "dquote-value-test", "\"" },
11+
{ "`", "backtick-key-test" },
1012
{ "backtick-value-test", "`" },
13+
{ "$", "dollar-key-test" },
1114
{ "dollar-parenthesis-value-test", "$(" },
15+
{ "#", "hash-key-test" },
1216
{ "hash-brace-value-test", "#{" },
17+
{ "%", "percent-key-test" },
1318
{ "percent-parenthesis-value-test", "%(" },
1419
{ "percent-brace-value-test", "%{" },
1520
{ "double-brace-value-test", "{{" },

‎test/fixtures/output/csharp/restsharp/malicious.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
var client = new RestClient("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C");
22
var request = new RestRequest(Method.POST);
3+
request.AddHeader("'", "squote-key-test");
34
request.AddHeader("squote-value-test", "'");
45
request.AddHeader("dquote-value-test", "\"");
6+
request.AddHeader("`", "backtick-key-test");
57
request.AddHeader("backtick-value-test", "`");
8+
request.AddHeader("$", "dollar-key-test");
69
request.AddHeader("dollar-parenthesis-value-test", "$(");
10+
request.AddHeader("#", "hash-key-test");
711
request.AddHeader("hash-brace-value-test", "#{");
12+
request.AddHeader("%", "percent-key-test");
813
request.AddHeader("percent-parenthesis-value-test", "%(");
914
request.AddHeader("percent-brace-value-test", "%{");
1015
request.AddHeader("double-brace-value-test", "{{");

‎test/fixtures/output/go/native/malicious.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,16 @@ func main() {
1515

1616
req, _ := http.NewRequest("POST", url, payload)
1717

18+
req.Header.Add("'", "squote-key-test")
1819
req.Header.Add("squote-value-test", "'")
1920
req.Header.Add("dquote-value-test", "\"")
21+
req.Header.Add("`", "backtick-key-test")
2022
req.Header.Add("backtick-value-test", "`")
23+
req.Header.Add("$", "dollar-key-test")
2124
req.Header.Add("dollar-parenthesis-value-test", "$(")
25+
req.Header.Add("#", "hash-key-test")
2226
req.Header.Add("hash-brace-value-test", "#{")
27+
req.Header.Add("%", "percent-key-test")
2328
req.Header.Add("percent-parenthesis-value-test", "%(")
2429
req.Header.Add("percent-brace-value-test", "%{")
2530
req.Header.Add("double-brace-value-test", "{{")

‎test/fixtures/output/http/1.1/malicious‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
POST /%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C HTTP/1.1
2+
': squote-key-test
23
Squote-Value-Test: '
34
Dquote-Value-Test: "
5+
`: backtick-key-test
46
Backtick-Value-Test: `
7+
$: dollar-key-test
58
Dollar-Parenthesis-Value-Test: $(
9+
#: hash-key-test
610
Hash-Brace-Value-Test: #{
11+
%: percent-key-test
712
Percent-Parenthesis-Value-Test: %(
813
Percent-Brace-Value-Test: %{
914
Double-Brace-Value-Test: {{

‎test/fixtures/output/java/asynchttp/malicious.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
AsyncHttpClient client = new DefaultAsyncHttpClient();
22
client.prepare("POST", "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C")
3+
.setHeader("'", "squote-key-test")
34
.setHeader("squote-value-test", "'")
45
.setHeader("dquote-value-test", "\"")
6+
.setHeader("`", "backtick-key-test")
57
.setHeader("backtick-value-test", "`")
8+
.setHeader("$", "dollar-key-test")
69
.setHeader("dollar-parenthesis-value-test", "$(")
10+
.setHeader("#", "hash-key-test")
711
.setHeader("hash-brace-value-test", "#{")
12+
.setHeader("%", "percent-key-test")
813
.setHeader("percent-parenthesis-value-test", "%(")
914
.setHeader("percent-brace-value-test", "%{")
1015
.setHeader("double-brace-value-test", "{{")

‎test/fixtures/output/java/nethttp/malicious.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
HttpRequest request = HttpRequest.newBuilder()
22
.uri(URI.create("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C"))
3+
.header("'", "squote-key-test")
34
.header("squote-value-test", "'")
45
.header("dquote-value-test", "\"")
6+
.header("`", "backtick-key-test")
57
.header("backtick-value-test", "`")
8+
.header("$", "dollar-key-test")
69
.header("dollar-parenthesis-value-test", "$(")
10+
.header("#", "hash-key-test")
711
.header("hash-brace-value-test", "#{")
12+
.header("%", "percent-key-test")
813
.header("percent-parenthesis-value-test", "%(")
914
.header("percent-brace-value-test", "%{")
1015
.header("double-brace-value-test", "{{")

0 commit comments

Comments
 (0)