- From: Thomas Roessler <tlr@w3.org>
- Date: Thu, 17 Dec 2009 00:05:14 +0100
- To: Michal Zalewski <lcamtuf@coredump.cx>
- Cc: Thomas Roessler <tlr@w3.org>, Bil Corry <bil@corry.biz>, public-web-security@w3.org, Mark Nottingham <mnot@mnot.net>
On 16 Dec 2009, at 21:55, Michal Zalewski wrote: >> It would seem to me that using the first header would be slightly safer > > To provide some context based on off-list discussions - probably the > most common example of a HTTP header splitting vulnerability is > newline injection through user-controlled "Location" header; a close > second would be newlines in user-specified file names in > "Content-Disposition". (As an aside, one can play fun games with the same idea in e-mail -- the precedence problem applies to just about any specification that uses MIME.) > I also suspect it may be difficult to get HTTP specs to specify > precedence at any point in the future, as they tend not to focus on > such earthly things; Well, the HTTPbis Working Group might be a better place for that particular discussion than the HTML WG. Mark?
Received on Wednesday, 16 December 2009 23:05:26 UTC