Skip to content

Commit 584632f

Browse files
pimterrypimterry
committed
Add more escaping cases for header keys
Most examples already handle this correctly, just tweaks required for R and HTTPie. I had assumed these were invalid header names, but apparently that's not actually correct!
1 parent 65658c1 commit 584632f

File tree

39 files changed

+208
-8
lines changed

39 files changed

+208
-8
lines changed

‎src/targets/r/httr.js

+6-1
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,12 @@ module.exports = function (source, options) {
106106
const otherHeaders = Object.entries(source.allHeaders)
107107
// These headers are all handled separately:
108108
.filter(([key]) => !['cookie', 'accept', 'content-type'].includes(key.toLowerCase()))
109-
.map(([key, value]) => `${key.replace(/-/g, '_')} = '${escape(value, { delimiter: "'" })}'`)
109+
.map(([key, value]) => {
110+
const safeKey = key.match(/^[a-zA-Z][a-zA-Z0-9_.-]*$/)
111+
? key.replace(/-/g, '_')
112+
: '"' + escape(key) + '"'
113+
return `${safeKey} = '${escape(value, { delimiter: "'" })}'`
114+
})
110115
.join(', ')
111116

112117
const setHeaders = otherHeaders

‎src/targets/shell/httpie.js

+7-2
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ module.exports = function (source, options) {
9090

9191
// construct headers
9292
Object.keys(source.allHeaders).sort().forEach(function (key) {
93-
code.push('%s:%s', key, shell.quote(source.allHeaders[key]))
93+
code.push('%s:%s', shell.quote(key), shell.quote(source.allHeaders[key]))
9494
})
9595

9696
if (source.postData.mimeType === 'application/x-www-form-urlencoded') {
@@ -109,7 +109,12 @@ module.exports = function (source, options) {
109109
code.unshift('http %s%s %s', flags.length ? flags.join(' ') + ' ' : '', source.method, shell.quote(opts.queryParams ? source.url : source.fullUrl))
110110

111111
if (raw && source.postData.text) {
112-
code.unshift('echo %s | ', shell.quote(source.postData.text))
112+
if (source.postData.text.includes('\\')) {
113+
// Printf handles escape characters more clearly & portably than echo
114+
code.unshift("printf '%%s' %s | ", shell.quote(source.postData.text))
115+
} else {
116+
code.unshift('echo %s | ', shell.quote(source.postData.text))
117+
}
113118
}
114119

115120
return code.join()

‎test/fixtures/output/c/libcurl/malicious.c

+5
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,16 @@ curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
44
curl_easy_setopt(hnd, CURLOPT_URL, "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C");
55

66
struct curl_slist *headers = NULL;
7+
headers = curl_slist_append(headers, "': squote-key-test");
78
headers = curl_slist_append(headers, "squote-value-test: '");
89
headers = curl_slist_append(headers, "dquote-value-test: \"");
10+
headers = curl_slist_append(headers, "`: backtick-key-test");
911
headers = curl_slist_append(headers, "backtick-value-test: `");
12+
headers = curl_slist_append(headers, "$: dollar-key-test");
1013
headers = curl_slist_append(headers, "dollar-parenthesis-value-test: $(");
14+
headers = curl_slist_append(headers, "#: hash-key-test");
1115
headers = curl_slist_append(headers, "hash-brace-value-test: #{");
16+
headers = curl_slist_append(headers, "%: percent-key-test");
1217
headers = curl_slist_append(headers, "percent-parenthesis-value-test: %(");
1318
headers = curl_slist_append(headers, "percent-brace-value-test: %{");
1419
headers = curl_slist_append(headers, "double-brace-value-test: {{");

‎test/fixtures/output/clojure/clj_http/malicious.clj

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
(require '[clj-http.client :as client])
22

3-
(client/post "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//" {:headers {:squote-value-test "'"
3+
(client/post "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//" {:headers {"'" "squote-key-test"
4+
:squote-value-test "'"
45
:dquote-value-test "\""
6+
"`" "backtick-key-test"
57
:backtick-value-test "`"
8+
"$" "dollar-key-test"
69
:dollar-parenthesis-value-test "$("
10+
"#" "hash-key-test"
711
:hash-brace-value-test "#{"
12+
"%" "percent-key-test"
813
:percent-parenthesis-value-test "%("
914
:percent-brace-value-test "%{"
1015
:double-brace-value-test "{{"

‎test/fixtures/output/csharp/httpclient/malicious.cs

+5
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,16 @@
55
RequestUri = new Uri("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C"),
66
Headers =
77
{
8+
{ "'", "squote-key-test" },
89
{ "squote-value-test", "'" },
910
{ "dquote-value-test", "\"" },
11+
{ "`", "backtick-key-test" },
1012
{ "backtick-value-test", "`" },
13+
{ "$", "dollar-key-test" },
1114
{ "dollar-parenthesis-value-test", "$(" },
15+
{ "#", "hash-key-test" },
1216
{ "hash-brace-value-test", "#{" },
17+
{ "%", "percent-key-test" },
1318
{ "percent-parenthesis-value-test", "%(" },
1419
{ "percent-brace-value-test", "%{" },
1520
{ "double-brace-value-test", "{{" },

‎test/fixtures/output/csharp/restsharp/malicious.cs

+5
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
var client = new RestClient("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C");
22
var request = new RestRequest(Method.POST);
3+
request.AddHeader("'", "squote-key-test");
34
request.AddHeader("squote-value-test", "'");
45
request.AddHeader("dquote-value-test", "\"");
6+
request.AddHeader("`", "backtick-key-test");
57
request.AddHeader("backtick-value-test", "`");
8+
request.AddHeader("$", "dollar-key-test");
69
request.AddHeader("dollar-parenthesis-value-test", "$(");
10+
request.AddHeader("#", "hash-key-test");
711
request.AddHeader("hash-brace-value-test", "#{");
12+
request.AddHeader("%", "percent-key-test");
813
request.AddHeader("percent-parenthesis-value-test", "%(");
914
request.AddHeader("percent-brace-value-test", "%{");
1015
request.AddHeader("double-brace-value-test", "{{");

‎test/fixtures/output/go/native/malicious.go

+5
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,16 @@ func main() {
1515

1616
req, _ := http.NewRequest("POST", url, payload)
1717

18+
req.Header.Add("'", "squote-key-test")
1819
req.Header.Add("squote-value-test", "'")
1920
req.Header.Add("dquote-value-test", "\"")
21+
req.Header.Add("`", "backtick-key-test")
2022
req.Header.Add("backtick-value-test", "`")
23+
req.Header.Add("$", "dollar-key-test")
2124
req.Header.Add("dollar-parenthesis-value-test", "$(")
25+
req.Header.Add("#", "hash-key-test")
2226
req.Header.Add("hash-brace-value-test", "#{")
27+
req.Header.Add("%", "percent-key-test")
2328
req.Header.Add("percent-parenthesis-value-test", "%(")
2429
req.Header.Add("percent-brace-value-test", "%{")
2530
req.Header.Add("double-brace-value-test", "{{")

‎test/fixtures/output/http/1.1/malicious

+5
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
POST /%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C HTTP/1.1
2+
': squote-key-test
23
Squote-Value-Test: '
34
Dquote-Value-Test: "
5+
`: backtick-key-test
46
Backtick-Value-Test: `
7+
$: dollar-key-test
58
Dollar-Parenthesis-Value-Test: $(
9+
#: hash-key-test
610
Hash-Brace-Value-Test: #{
11+
%: percent-key-test
712
Percent-Parenthesis-Value-Test: %(
813
Percent-Brace-Value-Test: %{
914
Double-Brace-Value-Test: {{

‎test/fixtures/output/java/asynchttp/malicious.java

+5
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
AsyncHttpClient client = new DefaultAsyncHttpClient();
22
client.prepare("POST", "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C")
3+
.setHeader("'", "squote-key-test")
34
.setHeader("squote-value-test", "'")
45
.setHeader("dquote-value-test", "\"")
6+
.setHeader("`", "backtick-key-test")
57
.setHeader("backtick-value-test", "`")
8+
.setHeader("$", "dollar-key-test")
69
.setHeader("dollar-parenthesis-value-test", "$(")
10+
.setHeader("#", "hash-key-test")
711
.setHeader("hash-brace-value-test", "#{")
12+
.setHeader("%", "percent-key-test")
813
.setHeader("percent-parenthesis-value-test", "%(")
914
.setHeader("percent-brace-value-test", "%{")
1015
.setHeader("double-brace-value-test", "{{")

‎test/fixtures/output/java/nethttp/malicious.java

+5
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
HttpRequest request = HttpRequest.newBuilder()
22
.uri(URI.create("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C"))
3+
.header("'", "squote-key-test")
34
.header("squote-value-test", "'")
45
.header("dquote-value-test", "\"")
6+
.header("`", "backtick-key-test")
57
.header("backtick-value-test", "`")
8+
.header("$", "dollar-key-test")
69
.header("dollar-parenthesis-value-test", "$(")
10+
.header("#", "hash-key-test")
711
.header("hash-brace-value-test", "#{")
12+
.header("%", "percent-key-test")
813
.header("percent-parenthesis-value-test", "%(")
914
.header("percent-brace-value-test", "%{")
1015
.header("double-brace-value-test", "{{")

‎test/fixtures/output/java/okhttp/malicious.java

+5
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,16 @@
55
Request request = new Request.Builder()
66
.url("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C")
77
.post(body)
8+
.addHeader("'", "squote-key-test")
89
.addHeader("squote-value-test", "'")
910
.addHeader("dquote-value-test", "\"")
11+
.addHeader("`", "backtick-key-test")
1012
.addHeader("backtick-value-test", "`")
13+
.addHeader("$", "dollar-key-test")
1114
.addHeader("dollar-parenthesis-value-test", "$(")
15+
.addHeader("#", "hash-key-test")
1216
.addHeader("hash-brace-value-test", "#{")
17+
.addHeader("%", "percent-key-test")
1318
.addHeader("percent-parenthesis-value-test", "%(")
1419
.addHeader("percent-brace-value-test", "%{")
1520
.addHeader("double-brace-value-test", "{{")

‎test/fixtures/output/java/unirest/malicious.java

+5
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
HttpResponse<String> response = Unirest.post("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C")
2+
.header("'", "squote-key-test")
23
.header("squote-value-test", "'")
34
.header("dquote-value-test", "\"")
5+
.header("`", "backtick-key-test")
46
.header("backtick-value-test", "`")
7+
.header("$", "dollar-key-test")
58
.header("dollar-parenthesis-value-test", "$(")
9+
.header("#", "hash-key-test")
610
.header("hash-brace-value-test", "#{")
11+
.header("%", "percent-key-test")
712
.header("percent-parenthesis-value-test", "%(")
813
.header("percent-brace-value-test", "%{")
914
.header("double-brace-value-test", "{{")

‎test/fixtures/output/javascript/axios/malicious.js

+5
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,16 @@ const options = {
2828
'slash-value-test': '\\'
2929
},
3030
headers: {
31+
'\'': 'squote-key-test',
3132
'squote-value-test': '\'',
3233
'dquote-value-test': '"',
34+
'`': 'backtick-key-test',
3335
'backtick-value-test': '`',
36+
$: 'dollar-key-test',
3437
'dollar-parenthesis-value-test': '$(',
38+
'#': 'hash-key-test',
3539
'hash-brace-value-test': '#{',
40+
'%': 'percent-key-test',
3641
'percent-parenthesis-value-test': '%(',
3742
'percent-brace-value-test': '%{',
3843
'double-brace-value-test': '{{',

‎test/fixtures/output/javascript/fetch/malicious.js

+5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
const options = {
22
method: 'POST',
33
headers: {
4+
'\'': 'squote-key-test',
45
'squote-value-test': '\'',
56
'dquote-value-test': '"',
7+
'`': 'backtick-key-test',
68
'backtick-value-test': '`',
9+
$: 'dollar-key-test',
710
'dollar-parenthesis-value-test': '$(',
11+
'#': 'hash-key-test',
812
'hash-brace-value-test': '#{',
13+
'%': 'percent-key-test',
914
'percent-parenthesis-value-test': '%(',
1015
'percent-brace-value-test': '%{',
1116
'double-brace-value-test': '{{',

‎test/fixtures/output/javascript/jquery/malicious.js

+5
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,16 @@ const settings = {
44
"url": "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C",
55
"method": "POST",
66
"headers": {
7+
"'": "squote-key-test",
78
"squote-value-test": "'",
89
"dquote-value-test": "\"",
10+
"`": "backtick-key-test",
911
"backtick-value-test": "`",
12+
"$": "dollar-key-test",
1013
"dollar-parenthesis-value-test": "$(",
14+
"#": "hash-key-test",
1115
"hash-brace-value-test": "#{",
16+
"%": "percent-key-test",
1217
"percent-parenthesis-value-test": "%(",
1318
"percent-brace-value-test": "%{",
1419
"double-brace-value-test": "{{",

‎test/fixtures/output/javascript/xhr/malicious.js

+5
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,16 @@ xhr.addEventListener("readystatechange", function () {
1010
});
1111

1212
xhr.open("POST", "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C");
13+
xhr.setRequestHeader("'", "squote-key-test");
1314
xhr.setRequestHeader("squote-value-test", "'");
1415
xhr.setRequestHeader("dquote-value-test", "\"");
16+
xhr.setRequestHeader("`", "backtick-key-test");
1517
xhr.setRequestHeader("backtick-value-test", "`");
18+
xhr.setRequestHeader("$", "dollar-key-test");
1619
xhr.setRequestHeader("dollar-parenthesis-value-test", "$(");
20+
xhr.setRequestHeader("#", "hash-key-test");
1721
xhr.setRequestHeader("hash-brace-value-test", "#{");
22+
xhr.setRequestHeader("%", "percent-key-test");
1823
xhr.setRequestHeader("percent-parenthesis-value-test", "%(");
1924
xhr.setRequestHeader("percent-brace-value-test", "%{");
2025
xhr.setRequestHeader("double-brace-value-test", "{{");

‎test/fixtures/output/kotlin/okhttp/malicious.kt

+5
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,16 @@ val body = RequestBody.create(mediaType, "' \" ` $( #{ %( %{ {{ \\0 %s \\")
55
val request = Request.Builder()
66
.url("http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?'=squote-key-test&squote-value-test='&%22=dquote-key-test&dquote-value-test=%22&%60=backtick-key-test&backtick-value-test=%60&%24(=dollar-parenthesis-key-test&dollar-parenthesis-value-test=%24(&%23%7B=hash-brace-key-test&hash-brace-value-test=%23%7B&%25(=percent-parenthesis-key-test&percent-parenthesis-value-test=%25(&%25%7B=percent-brace-key-test&percent-brace-value-test=%25%7B&%7B%7B=double-brace-key-test&double-brace-value-test=%7B%7B&%5C0=null-key-test&null-value-test=%5C0&%25s=string-fmt-key-test&string-fmt-value-test=%25s&%5C=slash-key-test&slash-value-test=%5C")
77
.post(body)
8+
.addHeader("'", "squote-key-test")
89
.addHeader("squote-value-test", "'")
910
.addHeader("dquote-value-test", "\"")
11+
.addHeader("`", "backtick-key-test")
1012
.addHeader("backtick-value-test", "`")
13+
.addHeader("$", "dollar-key-test")
1114
.addHeader("dollar-parenthesis-value-test", "$(")
15+
.addHeader("#", "hash-key-test")
1216
.addHeader("hash-brace-value-test", "#{")
17+
.addHeader("%", "percent-key-test")
1318
.addHeader("percent-parenthesis-value-test", "%(")
1419
.addHeader("percent-brace-value-test", "%{")
1520
.addHeader("double-brace-value-test", "{{")

‎test/fixtures/output/node/axios/malicious.js

+5
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,16 @@ var options = {
2828
'slash-value-test': '\\'
2929
},
3030
headers: {
31+
'\'': 'squote-key-test',
3132
'squote-value-test': '\'',
3233
'dquote-value-test': '"',
34+
'`': 'backtick-key-test',
3335
'backtick-value-test': '`',
36+
$: 'dollar-key-test',
3437
'dollar-parenthesis-value-test': '$(',
38+
'#': 'hash-key-test',
3539
'hash-brace-value-test': '#{',
40+
'%': 'percent-key-test',
3641
'percent-parenthesis-value-test': '%(',
3742
'percent-brace-value-test': '%{',
3843
'double-brace-value-test': '{{',

‎test/fixtures/output/node/fetch/malicious.js

+5
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,16 @@ let url = 'http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//?\'=squote-key-test&
55
let options = {
66
method: 'POST',
77
headers: {
8+
'\'': 'squote-key-test',
89
'squote-value-test': '\'',
910
'dquote-value-test': '"',
11+
'`': 'backtick-key-test',
1012
'backtick-value-test': '`',
13+
$: 'dollar-key-test',
1114
'dollar-parenthesis-value-test': '$(',
15+
'#': 'hash-key-test',
1216
'hash-brace-value-test': '#{',
17+
'%': 'percent-key-test',
1318
'percent-parenthesis-value-test': '%(',
1419
'percent-brace-value-test': '%{',
1520
'double-brace-value-test': '{{',

0 commit comments

Comments
 (0)