[COUCHDB-708] Newlines in document locations break header parsing

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.10.1
• Fix Version/s: 2.0.0
• Component/s: Database Core

Environment

ubuntu

• Skill Level: New Contributors Level (Easy)
• Assignee: Robert Kowalski
• Reporter: Tim
• Created: 24/Mar/10 12:25
• Updated: 30/Oct/14 22:26
• Resolved: 30/Oct/14 22:26

Description

Newlines in document locations break header parsing. Potential header injection issues?

$ curl -X DELETE http://localhost:5984/testdb

{"ok":true}

$ curl -X PUT http://localhost:5984/testdb

{"ok":true}

$ curl -i -X PUT -d '{}' 'http://localhost:5984/testdb/docid%0A'
HTTP/1.1 201 Created
Server: CouchDB/0.10.1 (Erlang OTP/R13B)
Location: http://localhost:5984/testdb/docid

Etag: "1-967a00dff5e02add41819138abb3284d"
Date: Wed, 24 Mar 2010 12:33:25 GMT
Content-Type: text/plain;charset=utf-8
Content-Length: 70
Cache-Control: must-revalidate

{"ok":true,"id":"docid\n","rev":"1-967a00dff5e02add41819138abb3284d"}