From de6e91482e19c6b2aaeb0ab20e92425a71036b81 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 17 Oct 2026 17:09:15 -1000 Subject: Keep every control byte out of a header value A quoted header value escaped only the quote, the backslash, CR and LF. A web server refuses a response whose header holds any other control byte, so a file named with one could not be downloaded at all. --- source/html.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'source/html.c') diff --git a/source/html.c b/source/html.c index b6e62a6..d1e28f8 100644 --- a/source/html.c +++ b/source/html.c @@ -367,6 +367,10 @@ void html_header_arg_in_quotes(const char *txt) esc = "\\n"; else if (c == '"') esc = "\\\""; + // A header line carries no other control byte either, and a web + // server refuses the whole response over one. + else if (c < 0x20 || c == 0x7f) + esc = "?"; if (esc) { html_raw(txt, p - txt); html(esc); -- cgit