Source/WebCore/ChangeLog

 12014-10-16 Youenn Fablet <youenn.fablet@crf.canon.fr>
 2
 3 Tighten XMLHttpRequest setRequestHeader value check
 4 https://bugs.webkit.org/show_bug.cgi?id=128593
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Test: http/tests/xmlhttprequest/set-bad-headervalue.html
 9
 10 * platform/network/HTTPParsers.cpp:
 11 (WebCore::isValidHTTPHeaderValue): Updated header values check according RFC 7230.
 12 (WebCore::isValidHTTPToken): Renamed variable name and updated RFC related comment.
 13
1142014-10-05 Christophe Dumez <cdumez@apple.com>
215
316 Use is<>() / downcast<>() for ScrollingCoordinator / ScrollingStateNode subclasses

Source/WebCore/platform/network/HTTPParsers.cpp

@@static inline bool skipValue(const String& str, unsigned& pos)
102102 return pos != start;
103103}
104104
105 bool isValidHTTPHeaderValue(const String& name)
 105// See RFC 7230, Section 3.2.3.
 106bool isValidHTTPHeaderValue(const String& value)
106107{
107  // FIXME: This should really match name against
108  // field-value in section 4.2 of RFC 2616.
109 
110  return !name.contains('\r') && !name.contains('\n');
 108 UChar c = value[0];
 109 if (c == ' ' || c == '\t')
 110 return false;
 111 c = value[value.length()];
 112 if (c == ' ' || c == '\t')
 113 return false;
 114 for (unsigned i = 0; i < value.length(); ++i) {
 115 c = value[i];
 116 if (c == 0x7F || c > 0xFF || (c < 0x20 && c != '\t'))
 117 return false;
 118 }
 119 return true;
111120}
112121
113 // See RFC 2616, Section 2.2.
114 bool isValidHTTPToken(const String& characters)
 122// See RFC 7230, Section 3.2.6.
 123bool isValidHTTPToken(const String& value)
115124{
116  if (characters.isEmpty())
 125 if (value.isEmpty())
117126 return false;
118  for (unsigned i = 0; i < characters.length(); ++i) {
119  UChar c = characters[i];
 127 for (unsigned i = 0; i < value.length(); ++i) {
 128 UChar c = value[i];
120129 if (c <= 0x20 || c >= 0x7F
121130 || c == '(' || c == ')' || c == '<' || c == '>' || c == '@'
122131 || c == ',' || c == ';' || c == ':' || c == '\\' || c == '"'

LayoutTests/ChangeLog

 12014-10-16 Youenn Fablet <youenn.fablet@crf.canon.fr>
 2
 3 Tighten XMLHttpRequest setRequestHeader value check
 4 https://bugs.webkit.org/show_bug.cgi?id=128593
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Added a test originating from w3c-test.org to test header values checking.
 9 Testing headers with non ASCII characters and various control characters.
 10
 11 * http/tests/xmlhttprequest/set-bad-headervalue-expected.txt: Added.
 12 * http/tests/xmlhttprequest/set-bad-headervalue.html: Added.
 13
1142014-10-05 Benjamin Poulain <bpoulain@apple.com>
215
316 Add a deprecation warning for Element.webkitMatchesSelector

LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue-expected.txt

 1
 2PASS XMLHttpRequest: setRequestHeader() value argument checks
 3PASS XMLHttpRequest: setRequestHeader() value argument checks 1
 4PASS XMLHttpRequest: setRequestHeader() value argument checks 2
 5PASS XMLHttpRequest: setRequestHeader() value argument checks 3
 6PASS XMLHttpRequest: setRequestHeader() value argument checks 4
 7PASS XMLHttpRequest: setRequestHeader() value argument checks 5
 8PASS XMLHttpRequest: setRequestHeader() value argument checks 6
 9PASS XMLHttpRequest: setRequestHeader() value argument checks 7
 10

LayoutTests/http/tests/xmlhttprequest/set-bad-headervalue.html

 1<!doctype html>
 2<html>
 3 <head>
 4 <meta charset="utf-8">
 5 <title>XMLHttpRequest: setRequestHeader() value argument checks</title>
 6 <script src="/js-test-resources/testharness.js"></script>
 7 <script src="/js-test-resources/testharnessreport.js"></script>
 8 <!-- Test based on http://w3c-test.org/web-platform-tests/master/XMLHttpRequest/setrequestheader-bogus-value.htm -->
 9 </head>
 10 <body>
 11 <div id="log"></div>
 12 <script>
 13 function try_value(value, expectError) {
 14 test(function() {
 15 var client = new XMLHttpRequest()
 16 client.open("GET", "...")
 17 if (expectError)
 18 assert_throws("SyntaxError", function() { client.setRequestHeader("x-test", value) }, ' given value ' + value+', ')
 19 else
 20 client.setRequestHeader("x-test", value)
 21 })
 22 }
 23
 24 try_value("t\rt", true)
 25 try_value("t\nt", true)
 26 try_value("ﾃｽﾄ", true)
 27 try_value("t\bt", true)
 28 try_value("t\vt", true)
 29 try_value("t\tt", false)
 30 try_value("t t", false)
 31 test(function() {
 32 var client = new XMLHttpRequest()
 33 client.open("GET", "...")
 34 assert_throws({name:'TypeError'}, function() { client.setRequestHeader("x-test") })
 35 })
 36 </script>
 37 </body>
 38</html>