• antirez's avatar
    Security: Cross Protocol Scripting protection. · a81a92ca
    antirez authored
    This is an attempt at mitigating problems due to cross protocol
    scripting, an attack targeting services using line oriented protocols
    like Redis that can accept HTTP requests as valid protocol, by
    discarding the invalid parts and accepting the payloads sent, for
    example, via a POST request.
    
    For this to be effective, when we detect POST and Host: and terminate
    the connection asynchronously, the networking code was modified in order
    to never process further input. It was later verified that in a
    pipelined request containing a POST command, the successive commands are
    not executed.
    a81a92ca
server.h 80.2 KB