[SLING-1344] Possible response split in SlingSafeMethodsServlet

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: API 2.0.8
• Fix Version/s: API 2.1.0
• Component/s: API
• Assignee: Ian Boston
• Reporter: Ian Boston
• Created: 02/Feb/10 12:16
• Updated: 21/Aug/10 21:35
• Resolved: 25/Mar/10 12:48

Description

Headers in the doTrace method are echoed to the response, making it potentially possible to split a response.
Would suggest encoding the headers both name part and value part correctly

IIRC Value part should be URIEncoded ?

but name part Eliminate values outside 33 - 126 as per rfc 822 ?