6c52fd0e46
Adds validations in L7 rule and session cookie APIs in order to prevent authenticated and authorized users to inject code into HAProxy configuration. CR and LF (\r and \n) are no longer allowed in L7 rule keys and values. The session persistence cookie names must follow the rules described in https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie. Story: 2008994 Task: 44859 Change-Id: Ic370e9edc3fb5548e9cf0d66b85df66e01c41e79 (cherry picked from commit3cf866dbc0) (cherry picked from commit133ec4763d) (cherry picked from commitc30aa9df22)
10 lines
407 B
YAML
10 lines
407 B
YAML
---
|
|
fixes:
|
|
- |
|
|
Fixed validations in L7 rule and session cookie APIs in order to prevent
|
|
authenticated and authorized users to inject code into HAProxy
|
|
configuration. CR and LF (\r and \n) are no longer allowed in L7 rule
|
|
keys and values. The session persistence cookie names must follow the rules
|
|
described in
|
|
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie.
|