Skip to content

fix: escape challenge header values#6

Merged
raubrey-stripe merged 1 commit into
stripe:mainfrom
emmajam:ejh/fix-header-escaping
Jun 8, 2026
Merged

fix: escape challenge header values#6
raubrey-stripe merged 1 commit into
stripe:mainfrom
emmajam:ejh/fix-header-escaping

Conversation

@emmajam

@emmajam emmajam commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Escape backslashes and quotes in formatted WWW-Authenticate challenge values.
  • Reject CR/LF in quoted header values to prevent unsafe header emission.
  • Add regression coverage for quoted descriptions, backslash descriptions, and CRLF rejection.

This is the Java-side fix for the M7 conformance failures in tempoxyz/mpp-tools#16.

@raubrey-stripe raubrey-stripe merged commit d6164a1 into stripe:main Jun 8, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants