CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting fix #GHSA-gv3v-92v6-m48j

jknack · jknack · commit b66e3342cf95 · 2019-10-12T10:30:52.000-03:00
diff --git a/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java b/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java
@@ -99,7 +99,7 @@
 public class NettyContext implements DefaultContext, ChannelFutureListener {
 
   private static final HttpHeaders NO_TRAILING = EmptyHttpHeaders.INSTANCE;
-  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(false);
+  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(true);
   private final int bufferSize;
   InterfaceHttpPostRequestDecoder decoder;
   private Router router;
