udo/uce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden HTTP path headers sessions and archives

Browse Source
This commit is contained in:
udo
2026-05-21 09:56:25 +00:00
parent d37517041d
commit 0d8b74930c
10 changed files with 260 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/tests/http.uce
+1 -1
View File
@@ -40,7 +40,7 @@ RENDER(Request& context)
check("uri_encode() / uri_decode()", decoded == uri_input, encoded + " => " + decoded);
check("parse_query()", query["alpha"] == "1" && query["beta"] == "two words", query_dump);
check("set_cookie()", set_cookie_dump.find("site-tests-cookie") != String::npos && set_cookie_dump.find("cookie-value") != String::npos, set_cookie_dump);
check("set_cookie()", set_cookie_dump.find("site-tests-cookie") != String::npos && set_cookie_dump.find("cookie-value") != String::npos && set_cookie_dump.find("HttpOnly") != String::npos && set_cookie_dump.find("SameSite=Lax") != String::npos, set_cookie_dump);
check("response header mutation", context.header["X-Site-Tests"] == "http-suite", header_dump);
check("session_start()", session_id != "", "session_id=" + session_id);
check("session_id_create()", generated_session.length() >= 16, generated_session);
site/tests/security_headers.uce
+6
View File
@@ -0,0 +1,6 @@
RENDER(Request& context)
{
context.header["X-UCE-Security-Test"] = "safe\r\nX-UCE-Injected: nope";
redirect("/tests/index.uce\r\nX-UCE-Redirect-Injected: nope", 299);
print("security header sanitizer test");
}