tls_validate_record_header(): Check for all HTTP methods

The change checks for all HTTP methods in ssl_record, not only GET, POST, PUT and HEAD. (additionally PATCH, DELETE, OPTIONS and TRACE) CLA: trivial Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from openssl/openssl#26968)
ibmruntimes · Mar 5, 2025 · 30fbc68 · 30fbc68
1 parent e599893
commit 30fbc68
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/ssl/record/methods/tlsany_meth.c b/ssl/record/methods/tlsany_meth.c
@@ -67,6 +67,10 @@ static int tls_validate_record_header(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
                     if (HAS_PREFIX((char *)p, "GET ") ||
                         HAS_PREFIX((char *)p, "POST ") ||
                         HAS_PREFIX((char *)p, "HEAD ") ||
+                        HAS_PREFIX((char *)p, "PATCH") ||
+                        HAS_PREFIX((char *)p, "OPTIO") ||
+                        HAS_PREFIX((char *)p, "DELET") ||
+                        HAS_PREFIX((char *)p, "TRACE") ||
                         HAS_PREFIX((char *)p, "PUT ")) {
                         RLAYERfatal(rl, SSL_AD_NO_ALERT, SSL_R_HTTP_REQUEST);
                         return 0;