This is an automated email from the ASF dual-hosted git repository.
bcall pushed a commit to branch 9.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
The following commit(s) were added to refs/heads/9.2.x by this push:
new 5df0f05677 Stricten field name check (#11595)
5df0f05677 is described below
commit 5df0f05677c62e18dc2736bc03556413fda1668b
Author: Masakazu Kitajo <[email protected]>
AuthorDate: Tue Jul 23 14:00:53 2024 -0600
Stricten field name check (#11595)
---
include/tscore/ParseRules.h | 7 ++++---
proxy/hdrs/MIME.cc | 3 ++-
proxy/hdrs/unit_tests/test_Hdrs.cc | 21 +++++++++++++++++++--
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/include/tscore/ParseRules.h b/include/tscore/ParseRules.h
index 92bd687da0..db660fb3be 100644
--- a/include/tscore/ParseRules.h
+++ b/include/tscore/ParseRules.h
@@ -129,8 +129,8 @@ public:
static CTypeResult is_alnum(char c); // 0-9,A-Z,a-z
static CTypeResult is_space(char c); // ' ' HT,VT,NP,CR,LF
static CTypeResult is_control(char c); // 0x00-0x08, 0x0a-0x1f, 0x7f
- static CTypeResult is_mime_sep(char c); // ()<>,;\"/[]?{} \t
- static CTypeResult is_http_field_name(char c); // not : or mime_sep except
for @
+ static CTypeResult is_mime_sep(char c); // @()<>,;\"/[]?{} \t
+ static CTypeResult is_http_field_name(char c); // not :, =, 0x80+, control,
or mime_sep except for @
static CTypeResult is_http_field_value(char c); // not CR, LF, comma, or "
//////////////////
@@ -708,8 +708,9 @@ ParseRules::is_http_field_name(char c)
#ifndef COMPILE_PARSE_RULES
return (parseRulesCType[(unsigned char)c] & is_http_field_name_BIT);
#else
- if ((c == ':') || (is_mime_sep(c) && (c != '@')))
+ if (!is_char(c) || is_control(c) || (is_mime_sep(c) && c != '@') || c == '='
|| c == ':') {
return false;
+ }
return true;
#endif
}
diff --git a/proxy/hdrs/MIME.cc b/proxy/hdrs/MIME.cc
index ad888b45ba..45c16c386d 100644
--- a/proxy/hdrs/MIME.cc
+++ b/proxy/hdrs/MIME.cc
@@ -2615,7 +2615,7 @@ mime_parser_parse(MIMEParser *parser, HdrHeap *heap,
MIMEHdrImpl *mh, const char
if (field_name_wks_idx < 0) {
for (auto i : field_name) {
- if (ParseRules::is_control(i)) {
+ if (!ParseRules::is_http_field_name(i)) {
return PARSE_RESULT_ERROR;
}
}
@@ -2623,6 +2623,7 @@ mime_parser_parse(MIMEParser *parser, HdrHeap *heap,
MIMEHdrImpl *mh, const char
// RFC 9110 Section 5.5. Field Values
for (char i : field_value) {
+ // FIXME: ParseRules::is_http_field_value() should be used but the
implementation looks wrong
if (ParseRules::is_control(i)) {
return PARSE_RESULT_ERROR;
}
diff --git a/proxy/hdrs/unit_tests/test_Hdrs.cc
b/proxy/hdrs/unit_tests/test_Hdrs.cc
index 6b4ef7b7e6..1e0c43d2a9 100644
--- a/proxy/hdrs/unit_tests/test_Hdrs.cc
+++ b/proxy/hdrs/unit_tests/test_Hdrs.cc
@@ -545,6 +545,25 @@ TEST_CASE("HdrTest", "[proxy][hdrtest]")
// Field Name
{"Content-Length: 10\r\n", PARSE_RESULT_CONT},
{"Content-Length\x0b: 10\r\n", PARSE_RESULT_ERROR},
+ {"Content-Length\xff: 10\r\n", PARSE_RESULT_ERROR},
+ // Delimiters in field name
+ {"delimiter_\": 10\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_(: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_): 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_,: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_/: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_:: 0\r\n", PARSE_RESULT_CONT}, // Parsed as field name
"delimiter_" and field value ": 0", which is valid
+ {"delimiter_;: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_<: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_=: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_>: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_?: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_@: 0\r\n", PARSE_RESULT_CONT}, // Not allowed by the spec,
but we use it as internal header indicator
+ {"delimiter_[: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_\\: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_]: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_{: 0\r\n", PARSE_RESULT_ERROR},
+ {"delimiter_}: 0\r\n", PARSE_RESULT_ERROR},
////
// Field Value
// SP
@@ -882,13 +901,11 @@ TEST_CASE("HdrTest", "[proxy][hdrtest]")
"Cache-Control: private\r\n"
"accept: foo\r\n"
"accept: bar\n"
- ": (null) field name\r\n"
"aCCept: \n"
"ACCEPT\r\n"
"foo: bar\r\n"
"foo: argh\r\n"
"foo: three, four\r\n"
- "word word: word \r\n"
"accept: \"fazzle, dazzle\"\r\n"
"accept: 1, 2, 3, 4, 5, 6, 7, 8\r\n"
"continuation: part1\r\n"
