Source/WebCore/ChangeLog

 12014-02-11 Youenn Fablet <youennf@gmail.com>
 2
 3 Tighten XMLHttpRequest setRequestHeader value check
 4 https://bugs.webkit.org/show_bug.cgi?id=128593
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Added check that header values only contain ISO-8859-1 characters
 9 and do not containing control characters except tab.
 10
 11 Test: http/tests/xmlhttprequest/set-bad-headervalue.html
 12
 13 * platform/network/HTTPParsers.cpp:
 14 (WebCore::isValidHTTPHeaderValue):
 15
1162014-02-10 Zan Dobersek <zdobersek@igalia.com>
217
318 Fix a few mistakes that landed with r163749.

Source/WebCore/platform/network/HTTPParsers.cpp

@@static inline bool skipValue(const String& str, unsigned& pos)
102102 return pos != start;
103103}
104104
105 bool isValidHTTPHeaderValue(const String& name)
 105bool isValidHTTPHeaderValue(const String& characters)
106106{
107  // FIXME: This should really match name against
108  // field-value in section 4.2 of RFC 2616.
109 
110  return !name.contains('\r') && !name.contains('\n');
 107 // FIXME: Check all constraints in one loop
 108 if (!characters.containsOnlyLatin1() || characters.contains('\r') || characters.contains('\n'))
 109 return false;
 110 // FIXME: Add validation of encoding rules defined by RFC 2047.
 111 for (unsigned i = 0; i < characters.length(); ++i) {
 112 UChar c = characters[i];
 113 // Check that c is not a control character except if whitespace (reduced to 0x09 in that context)
 114 if (c <= 0x1F && c != 0x09)
 115 return false;
 116 }
 117 return true;
111118}
112119
113120// See RFC 2616, Section 2.2.

LayoutTests/ChangeLog

 12014-02-11 Youenn Fablet <youennf@gmail.com>
 2
 3 Tighten XMLHttpRequest setRequestHeader value check
 4 https://bugs.webkit.org/show_bug.cgi?id=128593
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Added a test originating from w3c-test.org to test header values checking.
 9 Testing headers with non ISO-8859-1 characters and various control characters.
 10
 11 * http/tests/xmlhttprequest/set-bad-headervalue-expected.txt: Added.
 12 * http/tests/xmlhttprequest/set-bad-headervalue.html: Added.
 13
1142014-02-10 Mihnea Ovidenie <mihnea@adobe.com>
215
316 [CSS Regions] Fix Propagating Border and Padding for Inline Replaced Elements Flowed in Regions

LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue-expected.txt

 1
 2PASS XMLHttpRequest: setRequestHeader() value argument checks
 3PASS XMLHttpRequest: setRequestHeader() value argument checks 1
 4PASS XMLHttpRequest: setRequestHeader() value argument checks 2
 5PASS XMLHttpRequest: setRequestHeader() value argument checks 3
 6PASS XMLHttpRequest: setRequestHeader() value argument checks 4
 7PASS XMLHttpRequest: setRequestHeader() value argument checks 5
 8PASS XMLHttpRequest: setRequestHeader() value argument checks 6
 9PASS XMLHttpRequest: setRequestHeader() value argument checks 7
 10

LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue.html

 1<!doctype html>
 2<html>
 3 <head>
 4 <meta charset="utf-8">
 5 <title>XMLHttpRequest: setRequestHeader() value argument checks</title>
 6 <script src="/js-test-resources/testharness.js"></script>
 7 <script src="/js-test-resources/testharnessreport.js"></script>
 8 <!-- Test based on http://w3c-test.org/web-platform-tests/master/XMLHttpRequest/setrequestheader-bogus-value.htm -->
 9 </head>
 10 <body>
 11 <div id="log"></div>
 12 <script>
 13 function try_value(value, expectError) {
 14 test(function() {
 15 var client = new XMLHttpRequest()
 16 client.open("GET", "...")
 17 if (expectError)
 18 assert_throws("SyntaxError", function() { client.setRequestHeader("x-test", value) }, ' given value ' + value+', ')
 19 else
 20 client.setRequestHeader("x-test", value)
 21 })
 22 }
 23
 24 try_value("t\rt", true)
 25 try_value("t\nt", true)
 26 try_value("ﾃｽﾄ", true)
 27 try_value("t\bt", true)
 28 try_value("t\vt", true)
 29 try_value("t\tt", false)
 30 try_value("t t", false)
 31 test(function() {
 32 var client = new XMLHttpRequest()
 33 client.open("GET", "...")
 34 assert_throws({name:'TypeError'}, function() { client.setRequestHeader("x-test") })
 35 })
 36 </script>
 37 </body>
 38</html>