Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encode headers as ASCII #531

Open
vojtechsimetka opened this issue Feb 2, 2022 · 0 comments
Open

Encode headers as ASCII #531

vojtechsimetka opened this issue Feb 2, 2022 · 0 comments
Labels
kind:bug A bug in existing code (including security flaws) type:issue

Comments

@vojtechsimetka
Copy link
Contributor

vojtechsimetka commented Feb 2, 2022

Problem

According to the RFC 7230, the headers should be encoded in ASCII (previously in iso-8859-1). Trying to send header in any other encoding may fail. Most browsers and nodejs allow UTF8 encoding as well but IMHO I would not rely on this. Most headers we use should be fine, but some are user defined e.g. index-document and error-document.

Reproduce

(please node the "—"in the index-document is a character from iso-8859-2)
swarm-cli upload --name test --stamp <STAMP> --index-document "test/02 — Mixed.png" test

ERROR Invalid character in header content ["swarm-index-document"]

or upload single file containing "—" in filename with bee-dashboard or gateway

Quick fix

Encode as URI (which is ASCII) and unescape the characters like space. unescape(encodeURIComponent(<HEADER>))

Proper fix

Encode headers as UTF8 and then convert them to ASCII (UTF8 is backwards compatible with ASCII). Please note that many solutions rely on buffer which is not something we want.

References

@vojtechsimetka vojtechsimetka added the kind:bug A bug in existing code (including security flaws) label Feb 2, 2022
@bee-runner bee-runner bot added the type:issue label Feb 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind:bug A bug in existing code (including security flaws) type:issue
Projects
None yet
Development

No branches or pull requests

1 participant