Changeset 94128 in webkit

Timestamp:

Aug 30, 2011, 4:55:52 PM (14 years ago)

Author:

commit-queue@webkit.org

Message:

This patch makes the XMLHttpRequest method/header validation logic available as
static methods so URL loaders can perform the same checks for untrusted HTTP requests
coming from plugins.
​https://bugs.webkit.org/show_bug.cgi?id=66909

Patch by Bill Budge <​bbudge@chromium.org> on 2011-08-30
Reviewed by David Levin.

No new tests. Exposes no new functionality.

• CMakeLists.txt:
• GNUmakefile.list.am:
• WebCore.gypi:
• WebCore.pro:
• WebCore.vcproj/WebCore.vcproj:
• platform/network/HTTPValidation.cpp: Added.

(WebCore::isValidHTTPToken):
(WebCore::isValidHTTPHeaderValue):

• platform/network/HTTPValidation.h: Added.
• xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::isAllowedHTTPMethod):
(WebCore::XMLHttpRequest::uppercaseKnownHTTPMethod):
(WebCore::XMLHttpRequest::isAllowedHTTPHeader):
(WebCore::XMLHttpRequest::open):
(WebCore::XMLHttpRequest::setRequestHeader):

• xml/XMLHttpRequest.h:

Location:

trunk/Source/WebCore

Files:

• CMakeLists.txt (modified) (1 diff)
• ChangeLog (modified) (1 diff)
• GNUmakefile.list.am (modified) (1 diff)
• WebCore.gypi (modified) (1 diff)
• WebCore.pro (modified) (2 diffs)
• WebCore.vcproj/WebCore.vcproj (modified) (1 diff)
• platform/network/HTTPValidation.cpp (added)
• platform/network/HTTPValidation.h (added)
• xml/XMLHttpRequest.cpp (modified) (8 diffs)
• xml/XMLHttpRequest.h (modified) (3 diffs)

trunk/Source/WebCore/CMakeLists.txt

@@ -1134 +1134 @@
     platform/network/HTTPHeaderMap.cpp
     platform/network/HTTPParsers.cpp
+    platform/network/HTTPValidation.cpp
     platform/network/MIMEHeader.cpp
     platform/network/NetworkStateNotifier.cpp

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-08-30  Bill Budge  <bbudge@chromium.org>
+
+        This patch makes the XMLHttpRequest method/header validation logic available as
+        static methods so URL loaders can perform the same checks for untrusted HTTP requests
+        coming from plugins. 
+        https://bugs.webkit.org/show_bug.cgi?id=66909
+
+        Reviewed by David Levin.
+
+        No new tests. Exposes no new functionality.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/HTTPValidation.cpp: Added.
+        (WebCore::isValidHTTPToken):
+        (WebCore::isValidHTTPHeaderValue):
+        * platform/network/HTTPValidation.h: Added.
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::isAllowedHTTPMethod):
+        (WebCore::XMLHttpRequest::uppercaseKnownHTTPMethod):
+        (WebCore::XMLHttpRequest::isAllowedHTTPHeader):
+        (WebCore::XMLHttpRequest::open):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        * xml/XMLHttpRequest.h:
+
 2011-08-30  Chris Rogers  <crogers@google.com>
 

trunk/Source/WebCore/GNUmakefile.list.am

@@ -2707 +2707 @@
         Source/WebCore/platform/network/HTTPParsers.cpp \
         Source/WebCore/platform/network/HTTPParsers.h \
+        Source/WebCore/platform/network/HTTPValidation.cpp \
+        Source/WebCore/platform/network/HTTPValidation.h \
         Source/WebCore/platform/network/MIMEHeader.cpp \
         Source/WebCore/platform/network/MIMEHeader.h \

trunk/Source/WebCore/WebCore.gypi

@@ -4139 +4139 @@
             'platform/network/HTTPParsers.cpp',
             'platform/network/HTTPParsers.h',
+            'platform/network/HTTPValidation.cpp',
+            'platform/network/HTTPValidation.h',
             'platform/network/MIMEHeader.cpp',
             'platform/network/NetworkStateNotifier.cpp',

trunk/Source/WebCore/WebCore.pro

@@ -1051 +1051 @@
     platform/network/HTTPHeaderMap.cpp \
     platform/network/HTTPParsers.cpp \
+    platform/network/HTTPValidation.cpp \
     platform/network/MIMEHeader.cpp \
     platform/network/NetworkStateNotifier.cpp \
@@ -2062 +2063 @@
     platform/network/HTTPHeaderMap.h \
     platform/network/HTTPParsers.h \
+    platform/network/HTTPValidation.h \
     platform/network/HTTPStatusCodes.h \
     platform/network/MIMESniffing.h \

trunk/Source/WebCore/WebCore.vcproj/WebCore.vcproj

@@ -30446 +30446 @@
                                 </File>
                                 <File
+                                        RelativePath="..\platform\network\HTTPValidation.cpp"
+                                        >
+                                </File>
+                                <File
+                                        RelativePath="..\platform\network\HTTPValidation.h"
+                                        >
+                                </File>
+                                <File
                                         RelativePath="..\platform\network\MIMEHeader.cpp"
                                         >

trunk/Source/WebCore/xml/XMLHttpRequest.cpp

@@ -3 +3 @@
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
- *  Copyright (C) 2008 David Levin <levin@chromium.org>
+ *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
@@ -37 +37 @@
 #include "File.h"
 #include "HTTPParsers.h"
+#include "HTTPValidation.h"
 #include "InspectorInstrumentation.h"
 #include "ResourceError.h"
@@ -105 +106 @@
 }
 
-// Determines if a string is a valid token, as defined by
-// "token" in section 2.2 of RFC 2616.
-static bool isValidToken(const String& name)
-{
-    unsigned length = name.length();
-    for (unsigned i = 0; i < length; i++) {
-        UChar c = name[i];
-
-        if (c >= 127 || c <= 32)
-            return false;
-
-        if (c == '(' || c == ')' || c == '<' || c == '>' || c == '@' ||
-            c == ',' || c == ';' || c == ':' || c == '\\' || c == '\"' ||
-            c == '/' || c == '[' || c == ']' || c == '?' || c == '=' ||
-            c == '{' || c == '}')
-            return false;
-    }
-
-    return length > 0;
-}
-
-static bool isValidHeaderValue(const String& name)
-{
-    // FIXME: This should really match name against
-    // field-value in section 4.2 of RFC 2616.
-
-    return !name.contains('\r') && !name.contains('\n');
-}
-
 static bool isSetCookieHeader(const AtomicString& name)
 {
@@ -399 +371 @@
 #endif
 
+bool XMLHttpRequest::isAllowedHTTPMethod(const String& method)
+{
+    return !equalIgnoringCase(method, "TRACE")
+        && !equalIgnoringCase(method, "TRACK")
+        && !equalIgnoringCase(method, "CONNECT");
+}
+
+String XMLHttpRequest::uppercaseKnownHTTPMethod(const String& method)
+{
+    if (equalIgnoringCase(method, "COPY") || equalIgnoringCase(method, "DELETE") || equalIgnoringCase(method, "GET")
+        || equalIgnoringCase(method, "HEAD") || equalIgnoringCase(method, "INDEX") || equalIgnoringCase(method, "LOCK")
+        || equalIgnoringCase(method, "M-POST") || equalIgnoringCase(method, "MKCOL") || equalIgnoringCase(method, "MOVE")
+        || equalIgnoringCase(method, "OPTIONS") || equalIgnoringCase(method, "POST") || equalIgnoringCase(method, "PROPFIND")
+        || equalIgnoringCase(method, "PROPPATCH") || equalIgnoringCase(method, "PUT") || equalIgnoringCase(method, "UNLOCK")) {
+        return method.upper();
+    }
+    return method;
+}
+
+bool XMLHttpRequest::isAllowedHTTPHeader(const String& name)
+{
+    initializeXMLHttpRequestStaticData();
+    return !staticData->m_forbiddenRequestHeaders.contains(name) && !name.startsWith(staticData->m_proxyHeaderPrefix, false)
+        && !name.startsWith(staticData->m_secHeaderPrefix, false);
+}
+
 void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionCode& ec)
 {
@@ -419 +417 @@
     ASSERT(m_state == UNSENT);
 
-    if (!isValidToken(method)) {
+    if (!isValidHTTPToken(method)) {
         ec = SYNTAX_ERR;
         return;
     }
 
-    // Method names are case sensitive. But since Firefox uppercases method names it knows, we'll do the same.
-    String methodUpper(method.upper());
-
-    if (methodUpper == "TRACE" || methodUpper == "TRACK" || methodUpper == "CONNECT") {
+    if (!isAllowedHTTPMethod(method)) {
         ec = SECURITY_ERR;
         return;
     }
 
+    m_method = uppercaseKnownHTTPMethod(method);
+
     m_url = url;
-
-    if (methodUpper == "COPY" || methodUpper == "DELETE" || methodUpper == "GET" || methodUpper == "HEAD"
-        || methodUpper == "INDEX" || methodUpper == "LOCK" || methodUpper == "M-POST" || methodUpper == "MKCOL" || methodUpper == "MOVE"
-        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT"
-        || methodUpper == "UNLOCK")
-        m_method = methodUpper;
-    else
-        m_method = method;
 
     m_async = async;
@@ -836 +825 @@
     }
 
-    if (!isValidToken(name) || !isValidHeaderValue(value)) {
+    if (!isValidHTTPToken(name) || !isValidHTTPHeaderValue(value)) {
         ec = SYNTAX_ERR;
         return;
@@ -842 +831 @@
 
     // A privileged script (e.g. a Dashboard widget) can set any headers.
-    if (!securityOrigin()->canLoadLocalResources() && !isSafeRequestHeader(name)) {
+    if (!securityOrigin()->canLoadLocalResources() && !isAllowedHTTPHeader(name)) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to set unsafe header \"" + name + "\"");
         return;
@@ -855 +844 @@
     if (!result.second)
         result.first->second += ", " + value;
-}
-
-bool XMLHttpRequest::isSafeRequestHeader(const String& name) const
-{
-    return !staticData->m_forbiddenRequestHeaders.contains(name) && !name.startsWith(staticData->m_proxyHeaderPrefix, false)
-        && !name.startsWith(staticData->m_secHeaderPrefix, false);
 }
 

trunk/Source/WebCore/xml/XMLHttpRequest.h

@@ -2 +2 @@
  *  Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2011 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
@@ -111 +112 @@
 #endif
 
+    // Expose HTTP validation methods for other untrusted requests.
+    static bool isAllowedHTTPMethod(const String&);
+    static String uppercaseKnownHTTPMethod(const String&);
+    static bool isAllowedHTTPHeader(const String&);
+
     void setResponseType(const String&, ExceptionCode&);
     String responseType();
@@ -164 +170 @@
     String getRequestHeader(const AtomicString& name) const;
     void setRequestHeaderInternal(const AtomicString& name, const String& value);
-    bool isSafeRequestHeader(const String&) const;
 
     void changeState(State newState);