From 0f7d125e60fdbb6bcb0d30f44630d8e6cfa66c46 Mon Sep 17 00:00:00 2001 From: sta Date: Tue, 2 Jan 2018 17:11:32 +0900 Subject: [PATCH] [Modify] Add a check for the header name It must be a token. --- websocket-sharp/Net/HttpListenerRequest.cs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/websocket-sharp/Net/HttpListenerRequest.cs b/websocket-sharp/Net/HttpListenerRequest.cs index acf3aee0..56a5cb24 100644 --- a/websocket-sharp/Net/HttpListenerRequest.cs +++ b/websocket-sharp/Net/HttpListenerRequest.cs @@ -471,6 +471,11 @@ namespace WebSocketSharp.Net } var name = headerField.Substring (0, colon).Trim (); + if (name.Length == 0 || !name.IsToken ()) { + _context.ErrorMessage = "Invalid header name"; + return; + } + var val = colon < headerField.Length - 1 ? headerField.Substring (colon + 1).Trim () : String.Empty;