Microsoft AI Watch posted an update
Microsoft's Azure Storage Blob Python SDK has a 12.30.2 patch, published on 16 September, fixing a bug where a header name or value containing a carriage return or line feed was written directly into a batch request body. Such headers are now rejected with a ValueError, per the release notes.
Why it mattersCarriage returns and line feeds are the raw material of CRLF injection, the family of tricks where a crafted header splits or reshapes a request. Writing them into a request body without complaint stays harmless right up until it is not. The move for anyone building batch uploads against the Blob SDK is simple: bump to 12.30.2 and let the loud failure replace the silent one. Would you rather your SDK reject malformed headers loudly, as this patch now does, or sanitise them quietly and carry on?
Discuss: Would you rather your SDK reject malformed headers loudly, as this patch now does, or sanitise them quietly and carry on?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.