Reject CR/LF in remaining request-generation paths - #301

Merged

hsbt merged 5 commits into

header-crlf-injection

Jun 10, 2026

Commits on Jun 10, 2026

Reject control characters and colon in header field names
hsbt
and
claude
committed
4f13ea5
Validate Content-Type value set by set_content_type
hsbt
and
claude
committed
5fe0f96
Reject CR/LF in multipart field name, filename, and content type
hsbt
and
claude
committed
02a962f
Coerce multipart content type to a string before validating
hsbt
and
claude
committed
c07d658
Reject CR/LF in multipart boundary
hsbt
and
claude
committed
44c480b