Bug 175178 - EventSource: ignore IDs with U+0000
Summary: EventSource: ignore IDs with U+0000
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL: https://github.com/whatwg/html/pull/2849
Keywords: InRadar
Depends on: 175556
  Show dependency treegraph
Reported: 2017-08-04 01:02 PDT by Anne van Kesteren
Modified: 2017-08-16 10:31 PDT (History)
7 users (show)

See Also:

WIP Patch (943 bytes, patch)
2017-08-14 16:34 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff
WIP Patch (4.44 KB, patch)
2017-08-15 09:36 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (6.47 KB, patch)
2017-08-16 09:12 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Anne van Kesteren 2017-08-04 01:02:05 PDT
Change to standard: https://github.com/whatwg/html/pull/2849

Proposed tests (still need review): https://github.com/w3c/web-platform-tests/pull/6584

It seems good to fix this as this is the only way for someone to smuggle a U+0000 into a header value.
Comment 1 Chris Dumez 2017-08-14 16:34:12 PDT
Created attachment 318082 [details]
WIP Patch
Comment 2 Chris Dumez 2017-08-15 09:36:08 PDT
Created attachment 318125 [details]
WIP Patch

WPT fails for some reason. I am not sure why so I asked for clarification upstream.
Comment 3 Chris Dumez 2017-08-16 09:12:03 PDT
Created attachment 318264 [details]
Comment 4 WebKit Commit Bot 2017-08-16 10:30:42 PDT
Comment on attachment 318264 [details]

Clearing flags on attachment: 318264

Committed r220799: <http://trac.webkit.org/changeset/220799>
Comment 5 WebKit Commit Bot 2017-08-16 10:30:44 PDT
All reviewed patches have been landed.  Closing bug.
Comment 6 Radar WebKit Bug Importer 2017-08-16 10:31:50 PDT