CR/LF injection in query parameter in hackney

@@ -261,22 +261,46 @@ request(Pid, Method, Path, Headers, Body, Timeout) ->
 -spec request(pid(), binary(), binary(), list(), binary() | iolist(), timeout(), list()) ->
     {ok, integer(), list()} | {ok, integer(), list(), binary()} | {error, term()}.
 request(Pid, Method, Path, Headers, Body, Timeout, ReqOpts) ->
-    gen_statem:call(Pid, {request, Method, Path, Headers, Body, ReqOpts}, Timeout).
+    case valid_request_target(Path) of
+        ok -> gen_statem:call(Pid, {request, Method, Path, Headers, Body, ReqOpts}, Timeout);
+        Err -> Err
+    end.
+
+%% @private GHSA-j9wq: the request target (path + query) is written verbatim
+%% into the HTTP/1.1 request line and the HTTP/2 / HTTP/3 :path pseudo-header.
+%% Raw CR, LF or NUL bytes let a caller-controlled URL inject extra header
+%% lines or split the request. RFC 3986 requires those bytes to be
+%% percent-encoded; reject them rather than emit a malformed request.
+valid_request_target(Path) when is_binary(Path) ->
+    case binary:match(Path, [<<"\r">>, <<"\n">>, <<0>>]) of
+        nomatch -> ok;
+        _ -> {error, {invalid_request_target, Path}}
+    end;
+valid_request_target(Path) when is_list(Path) ->
+    valid_request_target(iolist_to_binary(Path));
+valid_request_target(_) ->
+    ok.
 
 %% @doc Send an HTTP/3 request and return headers immediately.
 %% Returns {ok, Status, Headers} and allows subsequent stream_body/1 calls.
 %% This is for pull-based body streaming over HTTP/3.
 -spec request_streaming(pid(), binary(), binary(), list(), binary() | iolist()) ->
     {ok, integer(), list()} | {error, term()}.
 request_streaming(Pid, Method, Path, Headers, Body) ->
-    gen_statem:call(Pid, {request_streaming, Method, Path, Headers, Body}, infinity).
+    case valid_request_target(Path) of
+        ok -> gen_statem:call(Pid, {request_streaming, Method, Path, Headers, Body}, infinity);
+        Err -> Err
+    end.
 
 %% @doc Send only the request headers (for streaming body mode).
 %% After this, use send_body_chunk/2 and finish_send_body/1 to send the body,
 %% then start_response/1 to receive the response.
 -spec send_request_headers(pid(), binary(), binary(), list()) -> ok | {error, term()}.
 send_request_headers(Pid, Method, Path, Headers) ->
-    gen_statem:call(Pid, {send_headers, Method, Path, Headers}, infinity).
+    case valid_request_target(Path) of
+        ok -> gen_statem:call(Pid, {send_headers, Method, Path, Headers}, infinity);
+        Err -> Err
+    end.
 
 %% @doc Send a chunk of the request body.
 -spec send_body_chunk(pid(), iodata()) -> ok | {error, term()}.
@@ -332,12 +356,18 @@ request_async(Pid, Method, Path, Headers, Body, AsyncMode, StreamTo) ->
 -spec request_async(pid(), binary(), binary(), list(), binary() | iolist(), true | once, pid(), boolean()) ->
     {ok, reference()} | {error, term()}.
 request_async(Pid, Method, Path, Headers, Body, AsyncMode, StreamTo, FollowRedirect) ->
-    gen_statem:call(Pid, {request_async, Method, Path, Headers, Body, AsyncMode, StreamTo, FollowRedirect}).
+    case valid_request_target(Path) of
+        ok -> gen_statem:call(Pid, {request_async, Method, Path, Headers, Body, AsyncMode, StreamTo, FollowRedirect});
+        Err -> Err
+    end.
 
 -spec request_async(pid(), binary(), binary(), list(), binary() | iolist(), true | once, pid(), boolean(), list()) ->
     {ok, reference()} | {error, term()}.
 request_async(Pid, Method, Path, Headers, Body, AsyncMode, StreamTo, FollowRedirect, ReqOpts) ->
-    gen_statem:call(Pid, {request_async, Method, Path, Headers, Body, AsyncMode, StreamTo, FollowRedirect, ReqOpts}).
+    case valid_request_target(Path) of
+        ok -> gen_statem:call(Pid, {request_async, Method, Path, Headers, Body, AsyncMode, StreamTo, FollowRedirect, ReqOpts});
+        Err -> Err
+    end.
 
 %% @doc Request the next message in {async, once} mode.
 -spec stream_next(pid()) -> ok | {error, term()}.

@@ -46,6 +46,7 @@ hackney_conn_integration_test_() ->
       {"stream body with stateful function", {timeout, 30, fun test_stream_body_stateful_fun/0}},
       {"stream body function returns error", {timeout, 30, fun test_stream_body_fun_error/0}},
       {"HEAD request", {timeout, 30, fun test_head_request/0}},
+      {"GHSA-j9wq: CRLF in request target rejected", {timeout, 30, fun test_crlf_request_target_rejected/0}},
       {"request returns to connected state", {timeout, 30, fun test_request_state_cycle/0}},
       %% Async tests
       {"async request continuous", {timeout, 30, fun test_async_continuous/0}},
@@ -260,6 +261,28 @@ test_get_request() ->
 
     hackney_conn:stop(Pid).
 
+%% GHSA-j9wq: a request target carrying raw CR/LF (e.g. from an
+%% unsanitised query string) must be refused before anything is written to
+%% the socket, otherwise the bytes split the request line into extra header
+%% lines.
+test_crlf_request_target_rejected() ->
+    Opts = #{
+        host => "127.0.0.1",
+        port => ?PORT,
+        transport => hackney_tcp,
+        connect_timeout => 5000,
+        recv_timeout => 5000
+    },
+    {ok, Pid} = hackney_conn:start_link(Opts),
+    ok = hackney_conn:connect(Pid),
+    Evil = <<"/get?q=x HTTP/1.1\r\nX-Injected: yes\r\nX:">>,
+    ?assertEqual({error, {invalid_request_target, Evil}},
+                 hackney_conn:request(Pid, <<"GET">>, Evil, [], <<>>)),
+    %% Connection survives the rejection and still serves a clean request.
+    {ok, Status, _} = hackney_conn:request(Pid, <<"GET">>, <<"/get">>, [], <<>>),
+    ?assert(Status >= 200 andalso Status < 400),
+    hackney_conn:stop(Pid).
+
 test_post_request() ->
     Opts = #{
         host => "127.0.0.1",