Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 06:11:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 716801: Location parsing. r=bz

Browse Source
This commit is contained in:
Jason Duell 2012-01-20 09:33:01 -08:00
parent 985bb30243
commit 3c2e185988
3 changed files with 39 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
netwerk/protocol/http/nsHttpHeaderArray.cpp
View File

@ -88,8 +88,12 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, const nsACString &value)
index = LookupEntry(header, &entry);
if (!entry) {
if (value.IsEmpty())
return NS_OK; // ignore empty headers
if (value.IsEmpty()) {
if (HeaderMustHaveValue(header)) {
return NS_ERROR_CORRUPTED_CONTENT;
}
return NS_OK; // ignore empty headers by default
}
entry = mHeaders.AppendElement(); //new nsEntry(header, value);
if (!entry)
return NS_ERROR_OUT_OF_MEMORY;

8
netwerk/protocol/http/nsHttpHeaderArray.h
View File

@ -113,6 +113,8 @@ private:
// Header cannot be merged: only one value possible
bool IsSingletonHeader(nsHttpAtom header);
// For some headers, we treat no value as possible CRLF attack
bool HeaderMustHaveValue(nsHttpAtom header);
// Subset of singleton headers: should never see multiple, different
// instances of these, else something fishy may be going on (like CLRF
@ -156,6 +158,12 @@ nsHttpHeaderArray::IsSingletonHeader(nsHttpAtom header)
header == nsHttp::Max_Forwards;
}
inline bool
nsHttpHeaderArray::HeaderMustHaveValue(nsHttpAtom header)
{
return header == nsHttp::Location;
}
inline void
nsHttpHeaderArray::MergeHeader(nsHttpAtom header,
nsEntry *entry,

26
netwerk/test/unit/test_duplicate_headers.js
View File

@ -357,7 +357,31 @@ function completeTest11(request, data, ctx)
do_throw("error parsing Content-Disposition: " + ex);
}
run_test_number(12);
}
////////////////////////////////////////////////////////////////////////////////
// Bug 716801 FAIL if any/only Location: header is blank
test_flags[12] = CL_EXPECT_FAILURE;
function handler12(metadata, response)
{
var body = "012345678901234567890123456789";
response.seizePower();
response.write("HTTP/1.0 301 Moved\r\n");
response.write("Content-Type: text/plain\r\n");
response.write("Content-Length: 30\r\n");
response.write("Location:\r\n");
response.write("Connection: close/\r\n");
response.write("\r\n");
response.write(body);
response.finish();
}
function completeTest12(request, data, ctx)
{
do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
endTests();
}