Title: [285810] trunk
- Revision
- 285810
- Author
- [email protected]
- Date
- 2021-11-15 10:36:44 -0800 (Mon, 15 Nov 2021)
Log Message
Null bytes aren't percent-encoded on urlencoded over POST
https://bugs.webkit.org/show_bug.cgi?id=220780
Patch by Andreu Botella <[email protected]> on 2021-11-15
Reviewed by Alex Christensen.
LayoutTests/imported/w3c:
* web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt:
Source/WebCore:
This change fixes a bug where strchr was being used to match a character against a set
character list, without checking whether the character was NUL. This resulted in NUL bytes
being passed through in the urlencoded enctype over POST, rather than being percent-escaped.
Tests: imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window.html
* platform/network/FormDataBuilder.cpp:
(WebCore::FormDataBuilder::appendFormURLEncoded):
Modified Paths
Diff
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (285809 => 285810)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2021-11-15 18:07:49 UTC (rev 285809)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2021-11-15 18:36:44 UTC (rev 285810)
@@ -1,5 +1,14 @@
2021-11-15 Andreu Botella <[email protected]>
+ Null bytes aren't percent-encoded on urlencoded over POST
+ https://bugs.webkit.org/show_bug.cgi?id=220780
+
+ Reviewed by Alex Christensen.
+
+ * web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt:
+
+2021-11-15 Andreu Botella <[email protected]>
+
Empty <input type=file> controls don't show up in the urlencoded and text/plain enctypes
https://bugs.webkit.org/show_bug.cgi?id=221549
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt (285809 => 285810)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt 2021-11-15 18:07:49 UTC (rev 285809)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window-expected.txt 2021-11-15 18:36:44 UTC (rev 285810)
@@ -3,11 +3,11 @@
PASS application/x-www-form-urlencoded: Basic test (formdata event)
PASS application/x-www-form-urlencoded: Basic File test (normal form)
FAIL application/x-www-form-urlencoded: Basic File test (formdata event) assert_equals: expected "basic=file-test.txt" but got ""
-FAIL application/x-www-form-urlencoded: 0x00 in name (normal form) assert_equals: expected "a%00b=c" but got "a\0b=c"
-FAIL application/x-www-form-urlencoded: 0x00 in name (formdata event) assert_equals: expected "a%00b=c" but got "a\0b=c"
-FAIL application/x-www-form-urlencoded: 0x00 in value (normal form) assert_equals: expected "a=b%00c" but got "a=b\0c"
-FAIL application/x-www-form-urlencoded: 0x00 in value (formdata event) assert_equals: expected "a=b%00c" but got "a=b\0c"
-FAIL application/x-www-form-urlencoded: 0x00 in filename (normal form) assert_equals: expected "a=b%00c" but got "a=b\0c"
+PASS application/x-www-form-urlencoded: 0x00 in name (normal form)
+PASS application/x-www-form-urlencoded: 0x00 in name (formdata event)
+PASS application/x-www-form-urlencoded: 0x00 in value (normal form)
+PASS application/x-www-form-urlencoded: 0x00 in value (formdata event)
+PASS application/x-www-form-urlencoded: 0x00 in filename (normal form)
FAIL application/x-www-form-urlencoded: 0x00 in filename (formdata event) assert_equals: expected "a=b%00c" but got ""
PASS application/x-www-form-urlencoded: \n in name (normal form)
PASS application/x-www-form-urlencoded: \n in name (formdata event)
Modified: trunk/Source/WebCore/ChangeLog (285809 => 285810)
--- trunk/Source/WebCore/ChangeLog 2021-11-15 18:07:49 UTC (rev 285809)
+++ trunk/Source/WebCore/ChangeLog 2021-11-15 18:36:44 UTC (rev 285810)
@@ -1,5 +1,21 @@
2021-11-15 Andreu Botella <[email protected]>
+ Null bytes aren't percent-encoded on urlencoded over POST
+ https://bugs.webkit.org/show_bug.cgi?id=220780
+
+ Reviewed by Alex Christensen.
+
+ This change fixes a bug where strchr was being used to match a character against a set
+ character list, without checking whether the character was NUL. This resulted in NUL bytes
+ being passed through in the urlencoded enctype over POST, rather than being percent-escaped.
+
+ Tests: imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/urlencoded2.window.html
+
+ * platform/network/FormDataBuilder.cpp:
+ (WebCore::FormDataBuilder::appendFormURLEncoded):
+
+2021-11-15 Andreu Botella <[email protected]>
+
Empty <input type=file> controls don't show up in the urlencoded and text/plain enctypes
https://bugs.webkit.org/show_bug.cgi?id=221549
Modified: trunk/Source/WebCore/platform/network/FormDataBuilder.cpp (285809 => 285810)
--- trunk/Source/WebCore/platform/network/FormDataBuilder.cpp 2021-11-15 18:07:49 UTC (rev 285809)
+++ trunk/Source/WebCore/platform/network/FormDataBuilder.cpp 2021-11-15 18:36:44 UTC (rev 285810)
@@ -90,7 +90,8 @@
static const char safeCharacters[] = "-._*";
for (size_t i = 0; i < length; ++i) {
auto character = string[i];
- if (isASCIIAlphanumeric(character) || strchr(safeCharacters, character))
+ if (isASCIIAlphanumeric(character)
+ || (character != '\0' && strchr(safeCharacters, character)))
append(buffer, character);
else if (character == ' ')
append(buffer, '+');
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
