From 6ede48b578f89f3b21ea29d7a591ed63c2977275 Mon Sep 17 00:00:00 2001 From: Damien Neil Date: Wed, 1 Jun 2022 11:17:07 -0700 Subject: [PATCH 14/16] [go-1.16.15-eks] net/http: don't strip whitespace from Transfer-Encoding headers # AWS EKS Backported To: go-1.16.15-eks Backported On: Tue, 04 Oct 2022 Backported By: budris@amazon.com Backported From: release-branch.go1.17 EKS Patch Source Commit: https://github.com/danbudris/go/commit/d51c4334f584e7f85ad482cc8d0b27de878050d9 Upstream Source Commit: https://github.com/tailscale/go/commit/61d05bded952c393b2f964e5c5c08edbd1a56f4f # Original Information EKS: retain original use of strings.ToLower present in 1.16. See: https://github.com/golang/go/commit/5c489514bc5e61ad9b5b07bd7d8ec65d66a0512a Do not accept "Transfer-Encoding: \rchunked" as a valid TE header setting chunked encoding. Thanks to Zeyu Zhang (https://www.zeyu2001.com/) for identifying the issue. For #53188 For CVE-2022-1705 Fixes #53432 Change-Id: I1a16631425159267f2eca68056b057192a7edf6c Reviewed-on: https://go-review.googlesource.com/c/go/+/409874 Reviewed-by: Roland Shoemaker Reviewed-by: Brad Fitzpatrick (cherry picked from commit e5017a93fcde94f09836200bca55324af037ee5f) Reviewed-on: https://go-review.googlesource.com/c/go/+/415217 Reviewed-by: Dmitri Shuralyov Run-TryBot: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov TryBot-Result: Gopher Robot --- src/net/http/serve_test.go | 1 + src/net/http/transfer.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go index f8687416fe..341602ea3e 100644 --- a/src/net/http/serve_test.go +++ b/src/net/http/serve_test.go @@ -6188,6 +6188,7 @@ func TestUnsupportedTransferEncodingsReturn501(t *testing.T) { "fugazi", "foo-bar", "unknown", + "\rchunked", } for _, badTE := range unsupportedTEs { diff --git a/src/net/http/transfer.go b/src/net/http/transfer.go index fbb0c39829..1c3dd66313 100644 --- a/src/net/http/transfer.go +++ b/src/net/http/transfer.go @@ -638,7 +638,7 @@ func (t *transferReader) parseTransferEncoding() error { if len(raw) != 1 { return &unsupportedTEError{fmt.Sprintf("too many transfer encodings: %q", raw)} } - if strings.ToLower(textproto.TrimString(raw[0])) != "chunked" { + if strings.ToLower(raw[0]) != "chunked" { return &unsupportedTEError{fmt.Sprintf("unsupported transfer encoding: %q", raw[0])} } -- 2.30.1 (Apple Git-130)