[4.0] 3bf38de Reject URLs containing white spaces

[Dridi Boukelmoune]

commit 3bf38ded667dc3143afa792f7159f54302138c6d
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Fri Mar 25 17:01:50 2016 +0100

    Reject URLs containing white spaces
    
    Refs #1862

diff --git a/bin/varnishd/cache/cache_http1_proto.c b/bin/varnishd/cache/cache_http1_proto.c
index 7247fac..1142011 100644
--- a/bin/varnishd/cache/cache_http1_proto.c
+++ b/bin/varnishd/cache/cache_http1_proto.c
@@ -382,6 +382,8 @@ htc_proto_ver(struct http *hp)
 		hp->protover = 10;
 	else if (!strcasecmp(hp->hd[HTTP_HDR_PROTO].b, "HTTP/1.1"))
 		hp->protover = 11;
+	else if (*hp->hd[HTTP_HDR_PROTO].b != '\0')
+		hp->protover = 0;
 	else
 		hp->protover = 9;
 }
@@ -410,6 +412,10 @@ HTTP1_DissectRequest(struct req *req)
 		return (retval);
 	}
 	htc_proto_ver(hp);
+	if (hp->protover == 0) {
+		VSLb(hp->vsl, SLT_Error, "Illegal URL or protocol");
+		return (400);
+	}
 
 	if (http_CountHdr(hp, H_Host) > 1) {
 		VSLb(hp->vsl, SLT_Error, "Duplicate Host header");
diff --git a/bin/varnishtest/tests/r01862.vtc b/bin/varnishtest/tests/r01862.vtc
new file mode 100644
index 0000000..86eee58
--- /dev/null
+++ b/bin/varnishtest/tests/r01862.vtc
@@ -0,0 +1,11 @@
+varnishtest "Whitespace in the request URL"
+
+server s1 "" -start
+
+varnish v1 -vcl+backend "" -start
+
+client c1 {
+	txreq -url "/foo bar"
+	rxresp
+	expect resp.status == 400
+} -run