#50123: fix: validate response header names and values before AddHeader
Merged
Created: Mar 8, 2026, 3:08:29 AM
Merged: Mar 8, 2026, 5:40:48 PM
5 comments
Target: main
Adds net::HttpUtil::IsValidHeaderName/IsValidHeaderValue checks before calling HttpResponseHeaders::AddHeader in:
ToResponseHead(custom protocol handler response headers) — invalid headers are droppedConverter<HttpResponseHeaders*>::FromV8(webRequest.onHeadersReceived) — conversion fails on invalid input
This matches the existing validation already applied to request headers in electron_api_url_loader.cc.
Notes: Fixed an issue where invalid characters in custom protocol or webRequest response header values were not rejected.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron