Blame SOURCES/squid-CVE-2016-4553.patch

4056b0
------------------------------------------------------------
4056b0
revno: 13240
4056b0
revision-id: squid3@treenet.co.nz-20160509131121-4saxl1wj54n20lgf
4056b0
parent: squid3@treenet.co.nz-20160508124218-6vhq4icj0fwu5aof
4056b0
fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4501
4056b0
committer: Amos Jeffries <squid3@treenet.co.nz>
4056b0
branch nick: 3.4
4056b0
timestamp: Tue 2016-05-10 01:11:21 +1200
4056b0
message:
4056b0
  Bug 4501: HTTP/1.1: normalize Host header
4056b0
------------------------------------------------------------
4056b0
# Bazaar merge directive format 2 (Bazaar 0.90)
4056b0
# revision_id: squid3@treenet.co.nz-20160509131121-4saxl1wj54n20lgf
4056b0
# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.4
4056b0
# testament_sha1: 017af15dae3e77239e9b2449dc2f2711707447d9
4056b0
# timestamp: 2016-05-09 13:13:52 +0000
4056b0
# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.4
4056b0
# base_revision_id: squid3@treenet.co.nz-20160508124218-\
4056b0
#   6vhq4icj0fwu5aof
4056b0
# 
4056b0
# Begin patch
4056b0
=== modified file 'src/client_side.cc'
4056b0
--- src/client_side.cc	2015-08-28 13:23:34 +0000
4056b0
+++ src/client_side.cc	2016-05-09 13:11:21 +0000
4056b0
@@ -2740,6 +2740,23 @@
4056b0
         goto finish;
4056b0
     }
4056b0
 
4056b0
+    // when absolute-URI is provided Host header should be ignored. However
4056b0
+    // some code still uses Host directly so normalize it.
4056b0
+    // For now preserve the case where Host is completely absent.
4056b0
+    if (request->header.has(HDR_HOST)) {
4056b0
+        const char *host = request->header.getStr(HDR_HOST);
4056b0
+        MemBuf authority;
4056b0
+        authority.init();
4056b0
+        if (request->port != urlDefaultPort(request->protocol))
4056b0
+            authority.Printf("%s:%d", request->GetHost(), request->port);
4056b0
+        else
4056b0
+            authority.Printf("%s", request->GetHost());
4056b0
+        debugs(33, 5, "URL domain " << authority.buf << " overrides header Host: " << host);
4056b0
+        // URL authority overrides Host header
4056b0
+        request->header.delById(HDR_HOST);
4056b0
+        request->header.putStr(HDR_HOST, authority.buf);
4056b0
+    }
4056b0
+
4056b0
     request->clientConnectionManager = conn;
4056b0
 
4056b0
     request->flags.accelerated = http->flags.accel;
4056b0