Fix parsing headers with a name that is a prefix of a well-known header

Authored by vkrause on May 11 2020, 3:30 PM.

Description

Fix parsing headers with a name that is a prefix of a well-known header

Summary:
That is, we ended up handling e.g. "Repl:" as "Reply-To:" here, and thus
this can have side-effects on application behavior such as determining who
to send a reply to. As this might allow bypasses of mechanisms that sign
certain subsets of relevant headers, this is rather problematic.

This is caused by only checking the length of the input string, but not
the length of the expected string for the name comparison.

Thanks to Marcus Brinkmann for discovering this.

Reviewers: mlaurent

Reviewed By: mlaurent

Subscribers: mlaurent, kde-pim

Tags: KDE PIM

Differential Revision: https://phabricator.kde.org/D29640

Details

Committed
vkrauseMay 12 2020, 2:57 PM
Reviewer
mlaurent
Differential Revision
D29640: Fix parsing headers with a name that is a prefix of a well-known header
Parents
R180:4a2f1b62a3d9: Add test case about bug 421251
Branches
Unknown
Tags
Unknown