Introduced protections against HTTP header injection / smuggling attacks

This commit is contained in:
pixeebot[bot] 2025-04-28 00:27:00 +00:00 committed by GitHub
parent 4fa280303d
commit ea18125693
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -121,7 +121,7 @@ public class UserBasedRateLimitingFilter extends OncePerRequestFilter {
if (probe.isConsumed()) { if (probe.isConsumed()) {
response.setHeader( response.setHeader(
"X-Rate-Limit-Remaining", "X-Rate-Limit-Remaining",
stripNewlines(Newlines.stripAll(Long.toString(probe.getRemainingTokens())))); Newlines.stripAll(stripNewlines(Newlines.stripAll(Long.toString(probe.getRemainingTokens())))));
filterChain.doFilter(request, response); filterChain.doFilter(request, response);
} else { } else {
long waitForRefill = probe.getNanosToWaitForRefill() / 1_000_000_000; long waitForRefill = probe.getNanosToWaitForRefill() / 1_000_000_000;