Changeset 210077 in webkit


Ignore:
Timestamp:
Dec 21, 2016 2:06:22 PM (7 years ago)
Author:
wilander@apple.com
Message:

Switch to a blacklist model for restricted Accept headers in simple CORS requests
​https://bugs.webkit.org/show_bug.cgi?id=166363

Reviewed by Alex Christensen.

Source/WebCore:

Updated existing tests.

  • platform/network/HTTPParsers.cpp:

(WebCore::isDelimiterCharacter):

Convenience function for checking delimiter characters according to:
​https://tools.ietf.org/html/rfc7230#section-3.2.6

(WebCore::isValidAcceptHeaderValue):

Now uses WebCore::isDelimiterCharacter() to blacklist delimiter characters
instead of a whitelist of accepted non-alphanumeric characters.

LayoutTests:

  • http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight-expected.txt:
  • http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html:
Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r210072 r210077  
     12016-12-21  John Wilander  <wilander@apple.com>
     2
     3        Switch to a blacklist model for restricted Accept headers in simple CORS requests
     4        https://bugs.webkit.org/show_bug.cgi?id=166363
     5
     6        Reviewed by Alex Christensen.
     7
     8        * http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight-expected.txt:
     9        * http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html:
     10
    1112016-12-21  Wenson Hsieh  <wenson_hsieh@apple.com>
    212

  • trunk/LayoutTests/http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight-expected.txt

    r209261 r210077  
    44CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Content-Language is not allowed by Access-Control-Allow-Headers.
    55CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
    6 PASS Accept header with normal value SHOULD NOT cause a preflight
    7 PASS Accept header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight
    8 PASS Accept-Language header with normal value SHOULD NOT cause a preflight
     6CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     7CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     8CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     9CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     10CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     11CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     12CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     13CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     14CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     15CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     16CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     17CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     18CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php. Request header field Accept is not allowed by Access-Control-Allow-Headers.
     19PASS Accept header value 'application/json,text/*,*/*' SHOULD NOT cause a preflight
     20PASS Accept header with normal value 'application/vnd.api+json' SHOULD NOT cause a preflight
     21PASS Accept header with normal value 'text/plain; q=0.5, text/html, text/x-dvi; q=0.8, text/x-c' SHOULD NOT cause a preflight
     22PASS Accept header with normal value 'text/*;q=0.3, text/html;q=0.7, text/html;level=1, text/html;level=2;q=0.4, */*;q=0.5' SHOULD NOT cause a preflight
     23PASS Accept header value with all allowed delimiter characters SHOULD NOT cause a preflight
     24PASS Accept-Language header value 'en-US,en;q=0.8' SHOULD NOT cause a preflight
     25PASS Accept-Language header value 'zh-Latn-CN-variant1-a-extend1-x-wadegile-private1' SHOULD NOT cause a preflight
    926PASS Accept-Language header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight
    10 PASS Content-Language header with normal value SHOULD NOT cause a preflight
     27PASS Content-Language header value 'en-US,en;q=0.8' SHOULD NOT cause a preflight
     28PASS Content-Language header value 'zh-Latn-CN-variant1-a-extend1-x-wadegile-private1' SHOULD NOT cause a preflight
    1129PASS Content-Language header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight
    1230PASS Accept header with abnormal value SHOULD cause a preflight
    … …  
    1937PASS Accept header with normal value, Accept-Language header with normal value, Content-Language header with abnormal value, and explicitly allowed headers SHOULD be allowed
    2038PASS Accept header with normal value, then another Accept header with abnormal value, and explicitly allowed headers SHOULD be allowed
     39PASS Accept header with disallowed delimiter '"' SHOULD cause a preflight
     40PASS Accept header with disallowed delimiter '(' SHOULD cause a preflight
     41PASS Accept header with disallowed delimiter ')' SHOULD cause a preflight
     42PASS Accept header with disallowed delimiter ':' SHOULD cause a preflight
     43PASS Accept header with disallowed delimiter '<' SHOULD cause a preflight
     44PASS Accept header with disallowed delimiter '>' SHOULD cause a preflight
     45PASS Accept header with disallowed delimiter '?' SHOULD cause a preflight
     46PASS Accept header with disallowed delimiter '@' SHOULD cause a preflight
     47PASS Accept header with disallowed delimiter '[' SHOULD cause a preflight
     48PASS Accept header with disallowed delimiter '\' SHOULD cause a preflight
     49PASS Accept header with disallowed delimiter ']' SHOULD cause a preflight
     50PASS Accept header with disallowed delimiter '{' SHOULD cause a preflight
     51PASS Accept header with disallowed delimiter '}' SHOULD cause a preflight
    2152

  • trunk/LayoutTests/http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html

    r209510 r210077  
    3535
    3636    var abnormalSimpleCorsHeaderValue = "() { :;};"
    37     var allAllowedNonAlphanumericCharactersForAcceptHeader = " *,./;="
     37    var allAllowedDelimiterCharactersForAcceptHeader = ",/;="
     38    var allDisallowedDelimiterCharactersForAcceptHeader = ['"', '(', ')', ':', '<', '>', '?', '@', '[', '\\', ']', '{', '}'];
    3839    var allAllowedNonAlphanumericCharactersForAcceptAndContentLanguageHeader = " *,-.;="
    3940    var testCases = [
    … …  
    4344            explicitlyAllowHeaders: false,
    4445            shouldCausePreflight: false,
    45             description: "Accept header with normal value SHOULD NOT cause a preflight"
    46         }
    47         ,{
    48             headersToAdd: [{ name : "Accept", value: allAllowedNonAlphanumericCharactersForAcceptHeader }],
    49             explicitlyAllowHeaders: false,
    50             shouldCausePreflight: false,
    51             description: "Accept header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight"
     46            description: "Accept header value 'application/json,text/*,*/*' SHOULD NOT cause a preflight"
     47        }
     48        ,{
     49            headersToAdd: [{ name : "Accept", value: "application/vnd.api+json" }],
     50            explicitlyAllowHeaders: false,
     51            shouldCausePreflight: false,
     52            description: "Accept header with normal value 'application/vnd.api+json' SHOULD NOT cause a preflight"
     53        }
     54        ,{
     55            headersToAdd: [{ name : "Accept", value: "text/plain; q=0.5, text/html, text/x-dvi; q=0.8, text/x-c" }],
     56            explicitlyAllowHeaders: false,
     57            shouldCausePreflight: false,
     58            description: "Accept header with normal value 'text/plain; q=0.5, text/html, text/x-dvi; q=0.8, text/x-c' SHOULD NOT cause a preflight"
     59        }
     60        ,{
     61            headersToAdd: [{ name : "Accept", value: "text/*;q=0.3, text/html;q=0.7, text/html;level=1, text/html;level=2;q=0.4, */*;q=0.5" }],
     62            explicitlyAllowHeaders: false,
     63            shouldCausePreflight: false,
     64            description: "Accept header with normal value 'text/*;q=0.3, text/html;q=0.7, text/html;level=1, text/html;level=2;q=0.4, */*;q=0.5' SHOULD NOT cause a preflight"
     65        }
     66        ,{
     67            headersToAdd: [{ name : "Accept", value: allAllowedDelimiterCharactersForAcceptHeader }],
     68            explicitlyAllowHeaders: false,
     69            shouldCausePreflight: false,
     70            description: "Accept header value with all allowed delimiter characters SHOULD NOT cause a preflight"
    5271        }
    5372        ,{
    … …  
    5574            explicitlyAllowHeaders: false,
    5675            shouldCausePreflight: false,
    57             description: "Accept-Language header with normal value SHOULD NOT cause a preflight"
     76            description: "Accept-Language header value 'en-US,en;q=0.8' SHOULD NOT cause a preflight"
     77        }
     78        ,{
     79            headersToAdd: [{ name : "Accept-Language", value: "zh-Latn-CN-variant1-a-extend1-x-wadegile-private1" }],
     80            explicitlyAllowHeaders: false,
     81            shouldCausePreflight: false,
     82            description: "Accept-Language header value 'zh-Latn-CN-variant1-a-extend1-x-wadegile-private1' SHOULD NOT cause a preflight"
    5883        }
    5984        ,{
    … …  
    6489        }
    6590        ,{
    66             headersToAdd: [{ name : "Content-Language", value: "en" }],
    67             explicitlyAllowHeaders: false,
    68             shouldCausePreflight: false,
    69             description: "Content-Language header with normal value SHOULD NOT cause a preflight"
     91            headersToAdd: [{ name : "Content-Language", value: "en-US,en;q=0.8" }],
     92            explicitlyAllowHeaders: false,
     93            shouldCausePreflight: false,
     94            description: "Content-Language header value 'en-US,en;q=0.8' SHOULD NOT cause a preflight"
     95        }
     96        ,{
     97            headersToAdd: [{ name : "Content-Language", value: "zh-Latn-CN-variant1-a-extend1-x-wadegile-private1" }],
     98            explicitlyAllowHeaders: false,
     99            shouldCausePreflight: false,
     100            description: "Content-Language header value 'zh-Latn-CN-variant1-a-extend1-x-wadegile-private1' SHOULD NOT cause a preflight"
    70101        }
    71102        ,{
    … …  
    132163        }
    133164    ];
     165
     166    // Individual negative test cases for each disallowed delimiter character in Accept header values.
     167    for (var i = 0; i < allDisallowedDelimiterCharactersForAcceptHeader.length; i++) {
     168        var disallowedDelimiter = allDisallowedDelimiterCharactersForAcceptHeader[i];
     169        testCases.push(
     170            {
     171                headersToAdd: [{ name : "Accept", value: disallowedDelimiter }],
     172                explicitlyAllowHeaders: false,
     173                shouldCausePreflight: true,
     174                description: "Accept header with disallowed delimiter '" + disallowedDelimiter + "' SHOULD cause a preflight"
     175            }
     176        );
     177    }
    134178
    135179    function runTestCase(testNumber) {

  • trunk/Source/WebCore/ChangeLog

    r210075 r210077  
     12016-12-21  John Wilander  <wilander@apple.com>
     2
     3        Switch to a blacklist model for restricted Accept headers in simple CORS requests
     4        https://bugs.webkit.org/show_bug.cgi?id=166363
     5
     6        Reviewed by Alex Christensen.
     7
     8        Updated existing tests.
     9
     10        * platform/network/HTTPParsers.cpp:
     11        (WebCore::isDelimiterCharacter):
     12            Convenience function for checking delimiter characters according to:
     13            https://tools.ietf.org/html/rfc7230#section-3.2.6
     14        (WebCore::isValidAcceptHeaderValue):
     15            Now uses WebCore::isDelimiterCharacter() to blacklist delimiter characters
     16            instead of a whitelist of accepted non-alphanumeric characters.
     17
    1182016-12-21  Beth Dakin  <bdakin@apple.com>
    219

  • trunk/Source/WebCore/platform/network/HTTPParsers.cpp

    r209510 r210077  
    128128}
    129129
    130 // See RFC 7231, Section 5.3.2
     130// See RFC 7230, Section 3.2.6.
     131static bool isDelimiterCharacter(const UChar c)
     132{
     133    // DQUOTE and "(),/:;<=>?@[\]{}"
     134    return (c == '"' || c == '(' || c == ')' || c == ',' || c == '/' || c == ':' || c == ';'
     135        || c == '<' || c == '=' || c == '>' || c == '?' || c == '@' || c == '[' || c == '\\'
     136        || c == ']' || c == '{' || c == '}');
     137}
     138
     139// See RFC 7231, Section 5.3.2.
    131140bool isValidAcceptHeaderValue(const String& value)
    132141{
    133142    for (unsigned i = 0; i < value.length(); ++i) {
    134143        UChar c = value[i];
    135         if (isASCIIAlphanumeric(c) || c == ' ' || c == '*' || c == ',' || c == '.' || c == '/' || c == ';' || c == '=')
     144        // First check for alphanumeric for performance reasons then whitelist four delimiter characters.
     145        if (isASCIIAlphanumeric(c) || c == ',' || c == '/' || c == ';' || c == '=')
    136146            continue;
    137         return false;
     147        if (isDelimiterCharacter(c))
     148            return false;
    138149    }
    139150   
    … …  
    141152}
    142153
    143 // See RFC 7231, Section 5.3.5 and 3.1.3.2
     154// See RFC 7231, Section 5.3.5 and 3.1.3.2.
    144155bool isValidLanguageHeaderValue(const String& value)
    145156{
Note: See TracChangeset for help on using the changeset viewer.