157157 2016-04-28 17:04:46 -0700 Allow non-standard HTTP headers in WebSocket handshake 2016-04-29 10:15:21 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 155602 1 wilander wilander ap beidson bfulgham commit-queue wilander oldest_to_newest 1188446 0 wilander 2016-04-28 17:04:46 -0700 Several reports of regressions in the wild mean we have to relax our header policy in the WebSocket handshake. 1188450 1 277666 wilander 2016-04-28 17:12:25 -0700 Created attachment 277666 Patch 1188452 2 277666 bfulgham 2016-04-28 17:15:23 -0700 Comment on attachment 277666 Patch r=me. 1188475 3 277666 commit-queue 2016-04-28 18:07:09 -0700 Comment on attachment 277666 Patch Clearing flags on attachment: 277666 Committed r200219: <http://trac.webkit.org/changeset/200219> 1188476 4 commit-queue 2016-04-28 18:07:13 -0700 All reviewed patches have been landed. Closing bug. 1188484 5 277666 ap 2016-04-28 19:44:07 -0700 Comment on attachment 277666 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=277666&action=review > Source/WebCore/ChangeLog:9 > + No new tests since https://bugs.webkit.org/show_bug.cgi?id=157095 > + tests that non-standard headers are allowed. Was there a concrete motivation for further behavior change? If that's the case, then we should have a test that verifies that the specific new case keeps working. Even if not, every behavior change should have a test, so adding a test for e.g. "Foo: bar" would be appropriate. 1188493 6 277666 bfulgham 2016-04-28 20:25:59 -0700 Comment on attachment 277666 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=277666&action=review >> Source/WebCore/ChangeLog:9 >> + tests that non-standard headers are allowed. > > Was there a concrete motivation for further behavior change? If that's the case, then we should have a test that verifies that the specific new case keeps working. > > Even if not, every behavior change should have a test, so adding a test for e.g. "Foo: bar" would be appropriate. He already created tests for the issues we knew about (Sec-WebSocket-Location, WebSocket-location, etc.), but we have since found more instances of "custom" headers being used by developers. I think it's fine to remove the tighter control on the headers, but retain the new "non-standard" tests that he added as a check that we don't start blocking them again. I don't think further tests are warranted for this specific change. 1188677 7 ap 2016-04-29 10:15:21 -0700 If our reading of the spec is that any headers are allowed, it's still somewhat valuable to test for headers that have never been called out in any version of the spec. 277666 2016-04-28 17:12:25 -0700 2016-04-28 18:07:09 -0700 Patch bug-157157-20160428171256.patch text/plain 2457 wilander SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMDIxNikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDE2LTA0LTI4ICBKb2huIFdp bGFuZGVyICA8d2lsYW5kZXJAYXBwbGUuY29tPgorCisgICAgICAgIEFsbG93IG5vbi1zdGFuZGFy ZCBIVFRQIGhlYWRlcnMgaW4gV2ViU29ja2V0IGhhbmRzaGFrZQorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU3MTU3CisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTm8gbmV3IHRlc3RzIHNpbmNlIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTcwOTUKKyAgICAgICAgdGVzdHMgdGhh dCBub24tc3RhbmRhcmQgaGVhZGVycyBhcmUgYWxsb3dlZC4KKworICAgICAgICAqIE1vZHVsZXMv d2Vic29ja2V0cy9XZWJTb2NrZXRIYW5kc2hha2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6V2Vi U29ja2V0SGFuZHNoYWtlOjpyZWFkSFRUUEhlYWRlcnMpOgorICAgICAgICAgICAgQ2hhbmdlZCBm cm9tIGZhaWwgdG8gYWxsb3cgZm9yIHVucmVjb2duaXplZCBoZWFkZXJzLgorICAgICAgICAgICAg VGhpcyB3YXMgdGhlIGJlaGF2aW9yIGJlZm9yZSBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTU1NjAyLgorICAgICAgICAqIHBsYXRmb3JtL25ldHdvcmsvSFRUUEhlYWRl ck5hbWVzLmluOgorICAgICAgICAgICAgUmVtb3ZlZCB3aGl0ZWxpc3RlZCBsZWdhY3kgaGVhZGVy cyBzaW5jZSB3ZSBub3cgYWxsb3cgYWxsIG5vbi1zdGFuZGFyZCBoZWFkZXJzLgorCiAyMDE2LTA0 LTI3ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgogCiAgICAgICAgIE1ha2Ug c3VyZSB3ZSBkb24ndCBtaXNoYW5kbGUgSFRNTEZyYW1lT3duZXJFbGVtZW50IGxpZmVjeWNsZQpJ bmRleDogU291cmNlL1dlYkNvcmUvTW9kdWxlcy93ZWJzb2NrZXRzL1dlYlNvY2tldEhhbmRzaGFr ZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvTW9kdWxlcy93ZWJzb2NrZXRzL1dl YlNvY2tldEhhbmRzaGFrZS5jcHAJKHJldmlzaW9uIDIwMDIxMSkKKysrIFNvdXJjZS9XZWJDb3Jl L01vZHVsZXMvd2Vic29ja2V0cy9XZWJTb2NrZXRIYW5kc2hha2UuY3BwCSh3b3JraW5nIGNvcHkp CkBAIC01MjksOCArNTI5LDkgQEAgY29uc3QgY2hhciogV2ViU29ja2V0SGFuZHNoYWtlOjpyZWFk SFRUUAogCiAgICAgICAgIEhUVFBIZWFkZXJOYW1lIGhlYWRlck5hbWU7CiAgICAgICAgIGlmICgh ZmluZEhUVFBIZWFkZXJOYW1lKG5hbWUsIGhlYWRlck5hbWUpKSB7Ci0gICAgICAgICAgICBtX2Zh aWx1cmVSZWFzb24gPSBtYWtlU3RyaW5nKCJVbmtub3duIGhlYWRlciBuYW1lICIsIG5hbWUsICIg aW4gSFRUUCByZXNwb25zZSIpOwotICAgICAgICAgICAgcmV0dXJuIG51bGxwdHI7CisgICAgICAg ICAgICAvLyBFdmlkZW5jZSBpbiB0aGUgd2lsZCBzaG93cyB0aGF0IHNlcnZpY2VzIG1ha2UgdXNl IG9mIGN1c3RvbSBoZWFkZXJzIGluIHRoZSBoYW5kc2hha2UKKyAgICAgICAgICAgIG1fc2VydmVy SGFuZHNoYWtlUmVzcG9uc2UuYWRkSFRUUEhlYWRlckZpZWxkKG5hbWUudG9TdHJpbmcoKSwgdmFs dWUpOworICAgICAgICAgICAgY29udGludWU7CiAgICAgICAgIH0KIAogICAgICAgICAvLyBodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzIzMCNzZWN0aW9uLTMuMi40CkluZGV4OiBTb3Vy Y2UvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL0hUVFBIZWFkZXJOYW1lcy5pbgo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL0hUVFBIZWFkZXJOYW1lcy5pbgko cmV2aXNpb24gMjAwMjExKQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbmV0d29yay9IVFRQ SGVhZGVyTmFtZXMuaW4JKHdvcmtpbmcgY29weSkKQEAgLTEwOCwxMCArMTA4LDMgQEAgSWN5LU1l dGFkYXRhCiBJY3ktTmFtZQogSWN5LVRpdGxlCiBJY3ktVVJMCi0KLS8vIFRoZXNlIGFyZSBzcGVj aWZpYyB0byBsZWdhY3kgV2ViU29ja2V0cyBpbXBsZW1lbnRhdGlvbnMKLS8vIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTcwNTcKLVNlYy1XZWJTb2NrZXQtTG9jYXRp b24KLVNlYy1XZWJTb2NrZXQtT3JpZ2luCi1XZWJTb2NrZXQtTG9jYXRpb24KLVdlYlNvY2tldC1P cmlnaW4K