Messed up parsing for X-Matrix Authorization header
The parsing of X-Matrix
Authorization
headers here is highly dubious and will be wrong for maliciously crafted inputs with silly quoting/escaping.
The format is described in RFC7235 using the standard quoted-string
from RFC7230, yet I've not found any library functions in http
to deal with those.
The creation of X-Matrix
Authorization
headers here is similarly dubious and will escape weird key IDs and signatures incorrectly, but since we just generated them immediately prior, that shouldn't be an issue.
Edited by Lambda