What's Changed
Security-relevant fixes
- Reject non-token methods in the client's request line.
write_request_line()checked the request target for CR/LF but wrote the method as given, so a method containing CR/LF could put a whole second request ahead of the real one, and the client would then take that request's response as its own. A method with a space, or an empty method, produced a malformed request line. The method must now be a token (RFC 9110 §9.1) before anything is written. All three callers (the regular client request path,open_stream()and the WebSocket handshake) now fail withError::Write, as they already did for a rejected request target.
Full Changelog: v0.57.0...v0.57.1