Andrew Kelley 10beb19ce7 std.http: assert against \r\n in headers ...

The HTTP specification does not provide a way to escape \r\n in headers,
so it's the API user's responsibility to ensure the header names and
values do not contain \r\n. Also header names must not contain ':'.

It's an assertion, not an error, because the calling code very likely is
using hard-coded values or server-provided values that do not need to be
checked, and the error would be unreachable anyway.

Untrusted user input must not be put directly into into HTTP headers.

2024-02-23 02:37:11 -07:00

40 KiB

Raw Blame History

View Raw