tree f36e7984dfafff98613209e96bbe56d5009a98d6
parent 20760cff001e9acc05627dfeab42ea50b57920e6
author Damien Neil <dneil@google.com> 1654107427 -0700
committer Damien Neil <dneil@google.com> 1656534130 +0000

net/http: don't strip whitespace from Transfer-Encoding headers

Do not accept "Transfer-Encoding: \rchunked" as a valid TE header
setting chunked encoding.

Thanks to Zeyu Zhang (https://www.zeyu2001.com/) for identifying
the issue.

Fixes #53188
Fixes CVE-2022-1705

Change-Id: I1a16631425159267f2eca68056b057192a7edf6c
Reviewed-on: https://go-review.googlesource.com/c/go/+/409874
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>