Title: [111828] trunk
Revision
111828
Author
[email protected]
Date
2012-03-22 23:04:00 -0700 (Thu, 22 Mar 2012)

Log Message

[WebSocket]The minimal number of bytes MUST be used to encode the length
https://bugs.webkit.org/show_bug.cgi?id=81443

Patch by Li Yin <[email protected]> on 2012-03-22
Reviewed by Kent Tamura.

Source/WebCore:

>From RFC 6455 http://tools.ietf.org/html/rfc6455#section-5.2
the minimal number of bytes MUST be used to encode the length

New test case : http/tests/websocket/tests/hybi/invalid-encode-length.html

* Modules/websockets/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::parseFrame):

LayoutTests:

* http/tests/websocket/tests/hybi/invalid-encode-length-expected.txt: Added.
* http/tests/websocket/tests/hybi/invalid-encode-length.html: Added.
* http/tests/websocket/tests/hybi/invalid-encode-length_wsh.py: Added.
(web_socket_do_extra_handshake):
(web_socket_transfer_data):

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (111827 => 111828)


--- trunk/LayoutTests/ChangeLog	2012-03-23 05:06:23 UTC (rev 111827)
+++ trunk/LayoutTests/ChangeLog	2012-03-23 06:04:00 UTC (rev 111828)
@@ -1,3 +1,16 @@
+2012-03-22  Li Yin  <[email protected]>
+
+        [WebSocket]The minimal number of bytes MUST be used to encode the length
+        https://bugs.webkit.org/show_bug.cgi?id=81443
+
+        Reviewed by Kent Tamura.
+
+        * http/tests/websocket/tests/hybi/invalid-encode-length-expected.txt: Added.
+        * http/tests/websocket/tests/hybi/invalid-encode-length.html: Added.
+        * http/tests/websocket/tests/hybi/invalid-encode-length_wsh.py: Added.
+        (web_socket_do_extra_handshake):
+        (web_socket_transfer_data):
+
 2012-03-22  Mao Yujie  <[email protected]>
 
         Implement strict testing criterion for callback function definition

Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length-expected.txt (0 => 111828)


--- trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length-expected.txt	2012-03-23 06:04:00 UTC (rev 111828)
@@ -0,0 +1,28 @@
+CONSOLE MESSAGE: The minimal number of bytes MUST be used to encode the length
+CONSOLE MESSAGE: The minimal number of bytes MUST be used to encode the length
+CONSOLE MESSAGE: The minimal number of bytes MUST be used to encode the length
+CONSOLE MESSAGE: The minimal number of bytes MUST be used to encode the length
+Test whether WebSocket aborts the connection when it receives an unexpected encoding length frame.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+Case 126_125: Test started.
+onopen() was called.
+onclose() was called.
+PASS closeEvent.wasClean is false
+Case 126_0: Test started.
+onopen() was called.
+onclose() was called.
+PASS closeEvent.wasClean is false
+Case 127_65535: Test started.
+onopen() was called.
+onclose() was called.
+PASS closeEvent.wasClean is false
+Case 127_0: Test started.
+onopen() was called.
+onclose() was called.
+PASS closeEvent.wasClean is false
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length.html (0 => 111828)


--- trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length.html	                        (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length.html	2012-03-23 06:04:00 UTC (rev 111828)
@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<script>
+description("Test whether WebSocket aborts the connection when it receives an unexpected encoding length frame.");
+
+window.jsTestIsAsync = true;
+if (window.layoutTestController)
+    layoutTestController.overridePreference("WebKitHixie76WebSocketProtocolEnabled", 0);
+
+var closeEvent;
+var payload_extended = ["126_125", "126_0", "127_65535", "127_0"];
+var totalTestSize = 4;
+
+function doTest(curTest)
+{
+    var url = "" + payload_extended[curTest];
+    var ws = new WebSocket(url);
+
+    debug("Case " + payload_extended[curTest] + ": Test started.");
+
+    ws._onopen_ = function()
+    {
+        debug("onopen() was called.");
+    };
+
+    ws._onmessage_ = function(event)
+    {
+        var message = event.data;
+        testFailed("onmessage() was called. (message = \"" + message + "\")");
+    };
+
+    ws._onclose_ = function(event)
+    {
+        debug("onclose() was called.");
+        closeEvent = event;
+        shouldBeFalse("closeEvent.wasClean");
+        if (curTest == totalTestSize - 1)
+            finishJSTest();
+        else
+            doTest(curTest + 1);
+    };
+}
+
+doTest(0);
+
+</script>
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length_wsh.py (0 => 111828)


--- trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length_wsh.py	                        (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/invalid-encode-length_wsh.py	2012-03-23 06:04:00 UTC (rev 111828)
@@ -0,0 +1,32 @@
+import re
+import struct
+from mod_pywebsocket import common
+
+
+def web_socket_do_extra_handshake(request):
+    pass
+
+
+def web_socket_transfer_data(request):
+    match = re.search(r'\?case=(\d+_\d+)$', request.ws_resource)
+    if match is None:
+        msgutil.send_message(request, 'FAIL: Query value is incorrect or missing')
+        return
+
+    payload_length, extended_length = (match.group(1)).split('_', 1)
+    payload_length = int(payload_length)
+    extended_length = int(extended_length)
+
+    # pywebsocket refuses to create a frame with error encode length.
+    # Thus, we need to build a frame manually.
+    header = chr(0x80 | common.OPCODE_TEXT) # 0x80 is for "fin" bit.
+    header += chr(payload_length) # No Mask and two bytes extended payload length.
+    if payload_length == 126:
+        header += struct.pack('!H', extended_length)
+    elif payload_length == 127:
+        header += struct.pack('!Q', extended_length)
+    else:
+        msgutil.send_message(request, 'FAIL: Query value is incorrect or missing')
+        return
+    request.connection.write(header)
+    request.connection.write('X' * extended_length)

Modified: trunk/Source/WebCore/ChangeLog (111827 => 111828)


--- trunk/Source/WebCore/ChangeLog	2012-03-23 05:06:23 UTC (rev 111827)
+++ trunk/Source/WebCore/ChangeLog	2012-03-23 06:04:00 UTC (rev 111828)
@@ -1,3 +1,18 @@
+2012-03-22  Li Yin  <[email protected]>
+
+        [WebSocket]The minimal number of bytes MUST be used to encode the length
+        https://bugs.webkit.org/show_bug.cgi?id=81443
+
+        Reviewed by Kent Tamura.
+
+        From RFC 6455 http://tools.ietf.org/html/rfc6455#section-5.2
+        the minimal number of bytes MUST be used to encode the length
+        
+        New test case : http/tests/websocket/tests/hybi/invalid-encode-length.html
+
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::parseFrame):
+
 2012-03-22  Adam Barth  <[email protected]>
 
         Unreviewed.  Sort xcodeproj file.

Modified: trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp (111827 => 111828)


--- trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp	2012-03-23 05:06:23 UTC (rev 111827)
+++ trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp	2012-03-23 06:04:00 UTC (rev 111828)
@@ -585,6 +585,14 @@
             payloadLength64 <<= 8;
             payloadLength64 |= static_cast<unsigned char>(*p++);
         }
+        if (extendedPayloadLengthSize == 2 && payloadLength64 <= maxPayloadLengthWithoutExtendedLengthField) {
+            fail("The minimal number of bytes MUST be used to encode the length");
+            return FrameError;
+        }
+        if (extendedPayloadLengthSize == 8 && payloadLength64 <= 0xFFFF) {
+            fail("The minimal number of bytes MUST be used to encode the length");
+            return FrameError;
+        }
     }
 
     // FIXME: UINT64_C(0x7FFFFFFFFFFFFFFF) should be used but it did not compile on Qt bots.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to