File tree Expand file tree Collapse file tree 1 file changed +4
-4
lines changed Expand file tree Collapse file tree 1 file changed +4
-4
lines changed Original file line number Diff line number Diff line change @@ -656,12 +656,12 @@ Some special characters within the name or value of an HTTP header might affect
656
656
the parsing of the serialized message in a way that the contents of unrelated
657
657
headers are changed. This misparsing can open up an application to security
658
658
vulnerabilities. A common type of vulnerability is CRLF injection, allowing
659
- an attacker to inject additional headers or end the list of headers early.
659
+ an attacker to inject additional headers or to end the list of headers early.
660
660
661
661
For this reason classes implementing the ` MessageInterface ` SHOULD strictly
662
662
validate the header names and contents according to the most recent HTTP
663
- specification ([ RFC 7230 #3 .2] [ 1 ] at the time of writing). Incorrect values
664
- SHOULD be rejected and no attempt SHOULD be made to automatically correct
663
+ specification ([ RFC 7230 #3 .2] [ 1 ] at the time of writing). The implementation
664
+ SHOULD reject invalid values and SHOULD NOT make any attempt to automatically correct
665
665
the provided values.
666
666
667
667
A minimally viable validator is expected to reject header names containing the
@@ -683,7 +683,7 @@ following characters:
683
683
- ` \n ` (0x0A)
684
684
685
685
If compatibility with older systems is desired then the sequence ` \r\n ` (0x0D0A)
686
- within a header value may be accepted, if and only if it is preceded by either
686
+ within a header value may be accepted if and only if it is preceded by either
687
687
SPACE (0x20) or ` \t ` (0x09).
688
688
689
689
Further characters or sequences in header values should be rejected according
You can’t perform that action at this time.
0 commit comments