Changes for version 0.12
- Strip out empty lines separated by CRLF.(markstos) Before the patch, an embedded CRLF would be allowed through with a space added after it. This is spec-compliant but appears not to be the intent, based on the regex to remove empty lines in headers. If a client accepted "CRLF\sCRLF\s" as a valid header end, then a CRLF injection attack would have been possible. (This patch was ported from the HTTP::Headers git repo. )
- The possiblity of the former behavior exploitably seems particular small
- . Apache won't even send out header that a space between the two required CRLFs.
Modules
faster implementation of HTTP::Headers