Vary header cache key collision from missing delimiter

[Jake Howard]

When a cached view varies on multiple headers, the values of those headers are concatenated together in the cache key. There is no delimiter, meaning the cache keys could overlap:

   X-Region: US
   X-Tenant: victim-corp

   X-Region: U
   X-Tenant: Svictim-corp

The above 2 examples would result in the same cache key, despite being different values. Changes to the cache key should be made to ensure values in this way don't collide.

---

This was previously reported to the Security Team by GeonHa. However, because it requires in depth knowledge of the system, a lack of user validation and similar values, it is not considered a vulnerability.

[Jason Judkins]

@Gonas Hey, are you still working on this? Happy to collaborate or take it over if you've moved on.

[Jacob Walls]

We're hoping to land a fix for this before the 6.1 beta (June 24), so if we don't have a PR by early next week, I'll need to pick it up myself. Happy for you to make a start, Jason.

[Jacob Walls]

​PR

[Jacob Walls <jacobtylerwalls@…>]

In 65acb3cc:

Fixed #37101 -- Used netstring delimiter between vary on headers for cached pages.

This prevents collisions between header values that concatenate to the same thing.

[Jacob Walls <jacobtylerwalls@…>]

In 02f94d2:

Refs #37101, #37174 -- Added release note for cache misses when varying on arguments.

Thanks Natalia Bidart for the review.

[Jacob Walls <jacobtylerwalls@…>]

In 8ae64fc:

[6.1.x] Fixed #37101 -- Used netstring delimiter between vary on headers for cached pages.

This prevents collisions between header values that concatenate to the same thing.

Backport of 65acb3cc2e76c238f5aee38d22626d92171a2f7c from main.

[Jacob Walls <jacobtylerwalls@…>]

In e4cda2e:

[6.1.x] Refs #37101, #37174 -- Added release note for cache misses when varying on arguments.

Thanks Natalia Bidart for the review.

Backport of 02f94d2a899b6573f90dee5417afb8a763ee7f25 from main.