Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] HSTS header parsing does not accept spaces between directives #2466

Open
funkdoodle opened this issue Feb 13, 2024 · 0 comments
Open
Labels
3.0 old branch 3.2 upcoming release bug:minor

Comments

@funkdoodle
Copy link

I am running version

./testssl.sh -v | grep from
    testssl.sh       3.2rc3 from https://testssl.sh/dev/

A site that returns a HSTS header with spaces between directives gets reported as a misconfigured HSTS header.
e.g.

Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Expected Behaviour
The header above is valid as per RFC6797, and should have passed the test.

Additional Context
Debug log shows:

|2726>  run_hsts(): hsts_age_sec='31536000 ; includeSubDomains'
|2727>  run_hsts(): hsts_age_sec='31536000 '
|2728>  run_hsts(): [[ 31536000  =~ " ]]
|2733>  run_hsts(): debugme echo 'hsts_age_sec: 31536000 '
|815>   debugme(): [[ 0 -ge 2 ]]
|816>   debugme(): return 0
|2734>  run_hsts(): is_number '31536000 '
|879>   is_number(): [[ 31536000  =~ ^[1-9][0-9]*$ ]]
|881>   is_number(): return 1

The following patch should fix the issue:

diff --git a/testssl.sh b/testssl.sh
index 99cc71b..a0d5578 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -2724,6 +2724,7 @@ run_hsts() {
           # strict parsing now as suggested in #2381
           hsts_age_sec="${HEADERVALUE#*=}"
           hsts_age_sec=${hsts_age_sec%%;*}
+          hsts_age_sec=$(strip_trailing_space "$hsts_age_sec")
           if [[ $hsts_age_sec =~ \" ]]; then
                # remove first an last " in $hsts_age_sec (borrowed from strip_trailing_space/strip_leading_space):
                hsts_age_sec=$(printf "%s" "${hsts_age_sec#"${hsts_age_sec%%[!\"]*}"}")
@drwetter drwetter added bug:minor 3.2 upcoming release 3.0 old branch labels Feb 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.0 old branch 3.2 upcoming release bug:minor
Projects
None yet
Development

No branches or pull requests

2 participants