mirror of
https://github.com/puma/puma.git
synced 2022-11-09 13:48:40 -05:00
c36491756f
header value could inject a CR or LF and inject their own HTTP response.
11 lines
252 B
Ruby
11 lines
252 B
Ruby
require 'securerandom'
|
|
|
|
long_header_hash = {}
|
|
|
|
25.times do |i|
|
|
long_header_hash["X-My-Header-#{i}"] = SecureRandom.hex(25)
|
|
end
|
|
|
|
response = SecureRandom.hex(100_000) # A 100kb document
|
|
|
|
run lambda { |env| [200, long_header_hash.dup, [response.dup]] }
|