a23da6eb57
Add sanitation step for `Access-Control-Allow-Headers` when echoing back user supplied headers
44 lines
704 B
Go
44 lines
704 B
Go
package proxy
|
|
|
|
import (
|
|
"strings"
|
|
)
|
|
|
|
func isTokenChar(r rune) bool {
|
|
switch {
|
|
case r >= 'a' && r <= 'z':
|
|
case r >= 'A' && r <= 'Z':
|
|
case r >= '0' && r <= '9':
|
|
case strings.ContainsRune("!#$%&'*+-.^_`|~", r):
|
|
default:
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
func SanitizeAccessControlRequestHeaderValues(headerValues string) string {
|
|
parts := strings.Split(headerValues, ",")
|
|
valid := make([]string, 0, len(parts))
|
|
|
|
for _, p := range parts {
|
|
v := strings.TrimSpace(p)
|
|
if v == "" {
|
|
continue
|
|
}
|
|
|
|
validPart := true
|
|
for _, c := range v {
|
|
if !isTokenChar(c) {
|
|
validPart = false
|
|
break
|
|
}
|
|
}
|
|
|
|
if validPart {
|
|
valid = append(valid, v)
|
|
}
|
|
}
|
|
|
|
return strings.Join(valid, ", ")
|
|
}
|