elixir-mint / mint / fad091454cbb7449b19edb8e1fee12ca7cf28c3a

88%

push

github

Merge commit from fork

The HTTP/1 request encoder spliced the caller-supplied method into the
request line verbatim. An application forwarding attacker-controlled
input as the HTTP method was exposed to CRLF injection: a method
containing "\r\n" could terminate the request line early, inject
arbitrary headers, and pipeline a second attacker-chosen request onto
the same connection.

The request target has been validated since 1.7.0, but the method had
no equivalent check. Validate it as an RFC 9110 token (1*tchar), the
same production used for header names, rejecting CRLF, spaces, and other
control characters.

Fixes GHSA-2pg6-44cx-c49v.

4 of 5 new or added lines in 2 files covered. (80.0%)

1368 of 1553 relevant lines covered (88.09%)

252.75 hits per line