Only allow a single Location to be set in RESTEasy Reactive

Fixes: quarkusio#38523
yrodiere · Feb 9, 2024 · 086cc01 · 086cc01
1 parent 45e6c57
commit 086cc01
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...rver/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/ServerSerialisers.java b/...rver/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/ServerSerialisers.java
@@ -80,6 +80,7 @@ public void accept(ResteasyReactiveRequestContext context) {
 
     private static final String CONTENT = "Content";
     private static final String CONTENT_LOWER = "content";
+    private static final String LOCATION = "Location";
     private static final String TYPE = "Type";
     private static final String TYPE_LOWER = "type";
     private static final String LENGTH = "Length";
@@ -532,7 +533,7 @@ public static void encodeResponseHeaders(ResteasyReactiveRequestContext requestC
     }
 
     private static boolean requireSingleHeader(String header) {
-        if (!(header.startsWith(CONTENT) || header.startsWith(CONTENT_LOWER))) {
+        if (!(header.startsWith(CONTENT) || header.startsWith(CONTENT_LOWER) || header.startsWith(LOCATION))) {
             return false;
         }
         if (header.length() < CONTENT.length() + 2) {