Changed regex for Validation.HTTPHeaderName to allow 50 char header name for fix ESAPI#351.

kwwall · kwwall · commit b108050e5dca · 2016-01-08T03:07:04.000-05:00
diff --git a/configuration/esapi/ESAPI.properties b/configuration/esapi/ESAPI.properties
@@ -440,7 +440,8 @@ Validator.HTTPParameterName=^[a-zA-Z0-9_]{1,32}$
 Validator.HTTPParameterValue=^[a-zA-Z0-9.\\-\\/+=@_ ]*$
 Validator.HTTPCookieName=^[a-zA-Z0-9\\-_]{1,32}$
 Validator.HTTPCookieValue=^[a-zA-Z0-9\\-\\/+=_ ]*$
-Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,32}$
+# Note that max header name capped at 150 in SecurityRequestWrapper!
+Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,50}$
 Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
 Validator.HTTPContextPath=^\\/?[a-zA-Z0-9.\\-\\/_]*$
 Validator.HTTPServletPath=^[a-zA-Z0-9.\\-\\/_]*$
@@ -456,4 +457,4 @@ Validator.DirectoryName=^[a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
 
 # Validation of dates. Controls whether or not 'lenient' dates are accepted.
 # See DataFormat.setLenient(boolean flag) for further details.
-Validator.AcceptLenientDates=false
+Validator.AcceptLenientDates=false
diff --git a/src/test/resources/esapi/ESAPI.properties b/src/test/resources/esapi/ESAPI.properties
@@ -440,7 +440,8 @@ Validator.HTTPScheme=^(http|https)$
 Validator.HTTPServerName=^[a-zA-Z0-9_.\\-]*$
 Validator.HTTPCookieName=^[a-zA-Z0-9\\-_]{1,32}$
 Validator.HTTPCookieValue=^[a-zA-Z0-9\\-\\/+=_ ]*$
-Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,32}$
+# Note that max header name capped at 150 in SecurityRequestWrapper!
+Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,50}$
 Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
 Validator.HTTPServletPath=^[a-zA-Z0-9.\\-\\/_]*$
 Validator.HTTPPath=^[a-zA-Z0-9.\\-_]*$
@@ -462,4 +463,4 @@ Validator.DirectoryName=^[a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
 
 # Validation of dates. Controls whether or not 'lenient' dates are accepted.
 # See DataFormat.setLenient(boolean flag) for further details.
-Validator.AcceptLenientDates=false
+Validator.AcceptLenientDates=false
