Attachment 223839 Details for Bug 128593 – Patch

[patch] Patch

bug-128593-20140211120804.patch (text/plain), 5.52 KB, created by youenn fablet on 2014-02-11 03:41:56 PST

(hide)

Description:

Filename:

MIME Type:

Creator: youenn fablet

Created: 2014-02-11 03:41:56 PST

Size: 5.52 KB

patch

obsolete

>Subversion Revision: 163774
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index a3f790e01b73ee370a53268ef547f74e51e2288c..535561764aed9a92298e206ea838ff5556d7d7ad 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,18 @@
>+2014-02-11  Youenn Fablet  <youennf@gmail.com>
>+
>+        Tighten XMLHttpRequest setRequestHeader value check
>+        https://bugs.webkit.org/show_bug.cgi?id=128593
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Added check that header values only contain ISO-8859-1 characters 
>+        and do not containing control characters except tab. 
>+
>+        Test: http/tests/xmlhttprequest/set-bad-headervalue.html
>+
>+        * platform/network/HTTPParsers.cpp:
>+        (WebCore::isValidHTTPHeaderValue):
>+
> 2014-02-10  Zan Dobersek  <zdobersek@igalia.com>
> 
>         Fix a few mistakes that landed with r163749.
>diff --git a/Source/WebCore/platform/network/HTTPParsers.cpp b/Source/WebCore/platform/network/HTTPParsers.cpp
>index 54b85d7f1663ccab3e2786826dcbc11e3fe5c735..0e35f81e81f1906109448ee5dd2e66bae8415c60 100644
>--- a/Source/WebCore/platform/network/HTTPParsers.cpp
>+++ b/Source/WebCore/platform/network/HTTPParsers.cpp
>@@ -102,12 +102,19 @@ static inline bool skipValue(const String& str, unsigned& pos)
>     return pos != start;
> }
> 
>-bool isValidHTTPHeaderValue(const String& name)
>+bool isValidHTTPHeaderValue(const String& characters)
> {
>-    // FIXME: This should really match name against
>-    // field-value in section 4.2 of RFC 2616.
>-
>-    return !name.contains('\r') && !name.contains('\n');
>+    // FIXME: Check all constraints in one loop
>+    if (!characters.containsOnlyLatin1() || characters.contains('\r') || characters.contains('\n'))
>+        return false;
>+    // FIXME: Add validation of encoding rules defined by RFC 2047.
>+    for (unsigned i = 0; i < characters.length(); ++i) {
>+        UChar c = characters[i];
>+        // Check that c is not a control character except if whitespace (reduced to 0x09 in that context)
>+        if (c <= 0x1F && c != 0x09)
>+            return false;
>+    }
>+    return true;
> }
> 
> // See RFC 2616, Section 2.2.
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 215dc6b800b17add8b93cfb1a3ca4ed09c74ca8b..911e959f71c97ff15a776c5f56381d1f1b908f5c 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,16 @@
>+2014-02-11  Youenn Fablet  <youennf@gmail.com>
>+
>+        Tighten XMLHttpRequest setRequestHeader value check
>+        https://bugs.webkit.org/show_bug.cgi?id=128593
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Added a test originating from w3c-test.org to test header values checking.
>+        Testing headers with non ISO-8859-1 characters and various control characters. 
>+
>+        * http/tests/xmlhttprequest/set-bad-headervalue-expected.txt: Added.
>+        * http/tests/xmlhttprequest/set-bad-headervalue.html: Added.
>+
> 2014-02-10  Mihnea Ovidenie  <mihnea@adobe.com>
> 
>         [CSS Regions] Fix Propagating Border and Padding for Inline Replaced Elements Flowed in Regions
>diff --git a/LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue-expected.txt b/LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..2fbcce648ebab7fcf8760fd5be432bc2ffbf70c3
>--- /dev/null
>+++ b/LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue-expected.txt
>@@ -0,0 +1,10 @@
>+
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 1 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 2 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 3 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 4 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 5 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 6 
>+PASS XMLHttpRequest: setRequestHeader() value argument checks 7 
>+
>diff --git a/LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue.html b/LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..dd45e7582e0965ae7f043939005cbe4550285753
>--- /dev/null
>+++ b/LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue.html
>@@ -0,0 +1,38 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>XMLHttpRequest: setRequestHeader() value argument checks</title>
>+    <script src="/js-test-resources/testharness.js"></script>
>+    <script src="/js-test-resources/testharnessreport.js"></script>
>+    
>+  </head>
>+  <body>
>+    <div id="log"></div>
>+    <script>
>+      function try_value(value, expectError) {
>+        test(function() {
>+          var client = new XMLHttpRequest()
>+          client.open("GET", "...")
>+          if (expectError)
>+              assert_throws("SyntaxError", function() { client.setRequestHeader("x-test", value) }, ' given value ' + value+', ')
>+          else
>+              client.setRequestHeader("x-test", value)  
>+          })
>+      }
>+
>+      try_value("t\rt", true)
>+      try_value("t\nt", true)
>+      try_value("ï¾ï½½ï¾", true)
>+      try_value("t\bt", true)
>+      try_value("t\vt", true)
>+      try_value("t\tt", false)
>+      try_value("t t", false)
>+      test(function() {
>+        var client = new XMLHttpRequest()
>+        client.open("GET", "...")
>+        assert_throws({name:'TypeError'}, function() { client.setRequestHeader("x-test") })
>+      })
>+    </script>
>+  </body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 128593: 223839 | 239942 | 240150