Changeset 285810 in webkit

Timestamp:

Nov 15, 2021, 10:36:44 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Null bytes aren't percent-encoded on urlencoded over POST
​https://bugs.webkit.org/show_bug.cgi?id=220780

Patch by Andreu Botella <​andreu@andreubotella.com> on 2021-11-15
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

• web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt:

Source/WebCore:

This change fixes a bug where strchr was being used to match a character against a set
character list, without checking whether the character was NUL. This resulted in NUL bytes
being passed through in the urlencoded enctype over POST, rather than being percent-escaped.

Tests: imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window.html

• platform/network/FormDataBuilder.cpp:

(WebCore::FormDataBuilder::appendFormURLEncoded):

Location:

trunk

Files:

• LayoutTests/imported/w3c/ChangeLog (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/network/FormDataBuilder.cpp (modified) (1 diff)

trunk/LayoutTests/imported/w3c/ChangeLog

@@ +1 @@
+2021-11-15  Andreu Botella  <andreu@andreubotella.com>
+
+        Null bytes aren't percent-encoded on urlencoded over POST
+        https://bugs.webkit.org/show_bug.cgi?id=220780
+
+        Reviewed by Alex Christensen.
+
+        * web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt:
+
 2021-11-15  Andreu Botella  <andreu@andreubotella.com>
 

trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt

@@ -4 +4 @@
 PASS application/x-www-form-urlencoded: Basic File test (normal form)
 FAIL application/x-www-form-urlencoded: Basic File test (formdata event) assert_equals: expected "basic=file-test.txt" but got ""
-FAIL application/x-www-form-urlencoded: 0x00 in name (normal form) assert_equals: expected "a%00b=c" but got "a\0b=c"
-FAIL application/x-www-form-urlencoded: 0x00 in name (formdata event) assert_equals: expected "a%00b=c" but got "a\0b=c"
-FAIL application/x-www-form-urlencoded: 0x00 in value (normal form) assert_equals: expected "a=b%00c" but got "a=b\0c"
-FAIL application/x-www-form-urlencoded: 0x00 in value (formdata event) assert_equals: expected "a=b%00c" but got "a=b\0c"
-FAIL application/x-www-form-urlencoded: 0x00 in filename (normal form) assert_equals: expected "a=b%00c" but got "a=b\0c"
+PASS application/x-www-form-urlencoded: 0x00 in name (normal form)
+PASS application/x-www-form-urlencoded: 0x00 in name (formdata event)
+PASS application/x-www-form-urlencoded: 0x00 in value (normal form)
+PASS application/x-www-form-urlencoded: 0x00 in value (formdata event)
+PASS application/x-www-form-urlencoded: 0x00 in filename (normal form)
 FAIL application/x-www-form-urlencoded: 0x00 in filename (formdata event) assert_equals: expected "a=b%00c" but got ""
 PASS application/x-www-form-urlencoded: \n in name (normal form)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-15  Andreu Botella  <andreu@andreubotella.com>
+
+        Null bytes aren't percent-encoded on urlencoded over POST
+        https://bugs.webkit.org/show_bug.cgi?id=220780
+
+        Reviewed by Alex Christensen.
+
+        This change fixes a bug where strchr was being used to match a character against a set
+        character list, without checking whether the character was NUL. This resulted in NUL bytes
+        being passed through in the urlencoded enctype over POST, rather than being percent-escaped.
+
+        Tests: imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window.html
+
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::FormDataBuilder::appendFormURLEncoded):
+
 2021-11-15  Andreu Botella  <andreu@andreubotella.com>
 

trunk/Source/WebCore/platform/network/FormDataBuilder.cpp

@@ -91 +91 @@
     for (size_t i = 0; i < length; ++i) {
         auto character = string[i];
-        if (isASCIIAlphanumeric(character) || strchr(safeCharacters, character))
+        if (isASCIIAlphanumeric(character)
+            || (character != '\0' && strchr(safeCharacters, character)))
             append(buffer, character);
         else if (character == ' ')