Bug 191356 – Be strict on request's Content-Type

• Component: DOM
• Status: RESOLVED FIXED

[Anne van Kesteren]

See https://github.com/whatwg/fetch/pull/829 for the change to the standard and https://github.com/web-platform-tests/wpt/pull/13921 for tests. It's particularly concerning that WebKit allows spaces around / in MIME types, but the other failures probably also need to be addressed given the previously agreed upon threat model.

[Anne van Kesteren]

See also bug 188644 btw.

[Rob Buis]

Created attachment 371652 [details]
Patch

[Rob Buis]

Created attachment 371653 [details]
Patch

[EWS Watchlist]

Comment on attachment 371653 [details]
Patch

Attachment 371653 [details] did not pass mac-ews (mac):
Output: https://webkit-queues.webkit.org/results/12418613

New failing tests:
imported/w3c/web-platform-tests/cors/client-hint-request-headers.htm
imported/w3c/web-platform-tests/cors/late-upload-events.htm

[EWS Watchlist]

Created attachment 371654 [details]
Archive of layout-test-results from ews102 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews102  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[EWS Watchlist]

Comment on attachment 371653 [details]
Patch

Attachment 371653 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/12418647

New failing tests:
imported/w3c/web-platform-tests/cors/basic.htm
imported/w3c/web-platform-tests/cors/late-upload-events.htm
imported/w3c/web-platform-tests/cors/client-hint-request-headers.htm

[EWS Watchlist]

Created attachment 371655 [details]
Archive of layout-test-results from ews115 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews115  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[Rob Buis]

Created attachment 371656 [details]
Patch

[EWS Watchlist]

Comment on attachment 371656 [details]
Patch

Attachment 371656 [details] did not pass mac-ews (mac):
Output: https://webkit-queues.webkit.org/results/12419174

New failing tests:
imported/w3c/web-platform-tests/cors/remote-origin.htm

[EWS Watchlist]

Created attachment 371658 [details]
Archive of layout-test-results from ews100 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews100  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[EWS Watchlist]

Comment on attachment 371656 [details]
Patch

Attachment 371656 [details] did not pass mac-wk2-ews (mac-wk2):
Output: https://webkit-queues.webkit.org/results/12419184

New failing tests:
imported/w3c/web-platform-tests/cors/remote-origin.htm

[EWS Watchlist]

Created attachment 371659 [details]
Archive of layout-test-results from ews107 for mac-highsierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-highsierra-wk2  Platform: Mac OS X 10.13.6

[EWS Watchlist]

Comment on attachment 371656 [details]
Patch

Attachment 371656 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/12419201

New failing tests:
imported/w3c/web-platform-tests/cors/remote-origin.htm

[EWS Watchlist]

Created attachment 371660 [details]
Archive of layout-test-results from ews114 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews114  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[EWS Watchlist]

Comment on attachment 371656 [details]
Patch

Attachment 371656 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: https://webkit-queues.webkit.org/results/12419301

New failing tests:
imported/w3c/web-platform-tests/cors/remote-origin.htm

[EWS Watchlist]

Created attachment 371661 [details]
Archive of layout-test-results from ews123 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews123  Port: ios-simulator-wk2  Platform: Mac OS X 10.14.5

[Rob Buis]

Created attachment 371663 [details]
Patch

[Rob Buis]

Created attachment 374569 [details]
Patch

[Alex Christensen]

Comment on attachment 374569 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=374569&action=review

> Source/WebCore/platform/network/HTTPParsers.cpp:161
> +static bool isCorsUnsafeRequestHeaderByte(const UChar c)

This function seems like excessive abstraction.  You could just put the values in with containsCORSUnsafeRequestHeaderBytes

[Rob Buis]

Created attachment 381526 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 381526 [details]
Patch

Rejecting attachment 381526 [details] from commit-queue.

New failing tests:
imported/w3c/web-platform-tests/websockets/bufferedAmount-unchanged-by-sync-xhr.any.worker.html
Full output: https://webkit-queues.webkit.org/results/13161760

[WebKit Commit Bot]

Created attachment 381536 [details]
Archive of layout-test-results from webkit-cq-01 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the commit-queue.
Bot: webkit-cq-01  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[Rob Buis]

Created attachment 381538 [details]
Patch

[Rob Buis]

Created attachment 381695 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 381695 [details]
Patch

Clearing flags on attachment: 381695

Committed r251490: <https://trac.webkit.org/changeset/251490>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/56550011>