ebddeca11d (master): [ruby/net-http] Reject control characters and colon in header field names

[Hiroshi SHIBATA]

Hiroshi SHIBATA 2026-06-10 00:58:06 +0000 (Wed, 10 Jun 2026)

New Revision: ebddeca11d

https://github.com/ruby/ruby/commit/ebddeca11d

Log:
[ruby/net-http] Reject control characters and colon in header field names

Field values and the request line are already validated against CR/LF,
but field names were interpolated into the request as-is, allowing
header injection via the key. Validate names in set_field and
initialize_http_header, which cover all paths into @header with a
user-supplied key.

https://github.com/ruby/net-http/commit/4f13ea5047

Co-Authored-By: Claude Fable 5 <nor...@anthropic.com>

Modified files:
lib/net/http/header.rb
test/net/http/test_httpheader.rb