diff options
Diffstat (limited to 'lib/http.js')
| -rw-r--r-- | lib/http.js | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/lib/http.js b/lib/http.js index aee579aad..315a9c6a2 100644 --- a/lib/http.js +++ b/lib/http.js @@ -546,6 +546,11 @@ OutgoingMessage.prototype._storeHeader = function(firstLine, headers) { var self = this; function store(field, value) { + // Protect against response splitting. The if statement is there to + // minimize the performance impact in the common case. + if (/[\r\n]/.test(value)) + value = value.replace(/[\r\n]+[ \t]*/g, ''); + messageHeader += field + ': ' + value + CRLF; if (connectionExpression.test(field)) { |