diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Harden the auth filter headers and session cookie
The filters signed the request url and later wrote it into a Location
header, and the signing step re-encoded a newline that the verifying
step decoded back, so a crafted url could smuggle CR and LF into the
response. The cookie HMAC was also checked with a short-circuiting
comparison and carried no SameSite attribute.
Diffstat (limited to 'source/ui-repolist.h')
0 files changed, 0 insertions, 0 deletions