diff options
| author | Micael Karlberg <[email protected]> | 2011-11-09 18:22:49 +0100 |
|---|---|---|
| committer | Micael Karlberg <[email protected]> | 2011-11-09 18:22:49 +0100 |
| commit | a7b67af7d2db9a442bd28952cca3fc61e5f0f227 (patch) | |
| tree | 93c878e712e9309469e8f1c2de80548e21f1143b /lib/inets/src/http_server/httpd_request_handler.erl | |
| parent | f561a98a9b89738467b52ab5213562de753f6ad2 (diff) | |
| parent | 53b434e40047fc4e085f57412b4e2227faddf23b (diff) | |
| download | otp-a7b67af7d2db9a442bd28952cca3fc61e5f0f227.tar.gz otp-a7b67af7d2db9a442bd28952cca3fc61e5f0f227.tar.bz2 otp-a7b67af7d2db9a442bd28952cca3fc61e5f0f227.zip | |
[httpd] XSS prevention did not work for hex-encoded URL's.
OTP-9655
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r14/OTP-9655' into bmk/inets/inets572_integration
Diffstat (limited to 'lib/inets/src/http_server/httpd_request_handler.erl')
| -rw-r--r-- | lib/inets/src/http_server/httpd_request_handler.erl | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/inets/src/http_server/httpd_request_handler.erl b/lib/inets/src/http_server/httpd_request_handler.erl index c3b47ce390..d2f22fce93 100644 --- a/lib/inets/src/http_server/httpd_request_handler.erl +++ b/lib/inets/src/http_server/httpd_request_handler.erl @@ -1,8 +1,8 @@ %% %% %CopyrightBegin% -%% +%% %% Copyright Ericsson AB 1997-2011. All Rights Reserved. -%% +%% %% The contents of this file are subject to the Erlang Public License, %% Version 1.1, (the "License"); you may not use this file except in %% compliance with the License. You should have received a copy of the @@ -355,7 +355,7 @@ handle_http_msg({Method, Uri, Version, {RecordHeaders, Headers}, Body}, Reason = io_lib:format("Forbidden URI: ~p~n", [URI]), error_log(Reason, ModData), {stop, normal, State#state{response_sent = true}}; - {error,{bad_request, {malformed_syntax, URI}}} -> + {error, {bad_request, {malformed_syntax, URI}}} -> ?hdrd("validation failed: bad request - malformed syntax", [{uri, URI}]), httpd_response:send_status(ModData#mod{http_version = Version}, |