Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0a265382662595a6e9f299b5aa61dd4a8f7f3b31
https://github.com/WebKit/WebKit/commit/0a265382662595a6e9f299b5aa61dd4a8f7f3b31
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-13 (Sun, 13 Sep 2026)
Changed paths:
M Source/WebCore/platform/network/RFC7230.cpp
M Tools/TestWebKitAPI/Tests/WebCore/HTTPHeaderField.cpp
Log Message:
-----------
RFC7230::isValidValue() consumes a token's terminating octet without
validating it, accepting control characters and DEL
https://bugs.webkit.org/show_bug.cgi?id=324056
rdar://187288970
Reviewed by Chris Dumez.
In RFC7230::isValidValue()'s State::Token, hitting a non-token character
transitioned to State::OptionalWhitespace and continued to the next
character without validating the octet that ended the token. That octet
could be anything, so control characters and DEL slipped through: e.g.
"a\x01 b" and a DEL after a token were wrongly accepted as valid header
field values.
Per the RFC 7230 field-value grammar, field-content is built from
field-vchar = VCHAR (%x21-7E) / obs-text (%x80-FF), with SP / HTAB
permitted between vchars; a token is terminated legitimately by
whitespace, a delimiter, or the start of a quoted-string or comment.
Control characters and DEL are none of these. Validate the terminating
octet against that set instead of silently consuming it: it must be
whitespace, a visible character (token or delimiter), or obs-text,
otherwise the value is rejected. Re-feeding the octet to
State::OptionalWhitespace would instead reject legitimate values such as
"text/html" and "foo,bar", since that state does not accept bare
delimiters, so the terminator is validated in place.
RFC 7230, Section 3.2:
https://datatracker.ietf.org/doc/html/rfc7230#section-3.2
RFC 7230, Section 3.2.6:
https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
Test: Tools/TestWebKitAPI/Tests/WebCore/HTTPHeaderField.cpp
* Source/WebCore/platform/network/RFC7230.cpp:
(RFC7230::isValidValue): Reject a token terminator that is not
whitespace, a visible character, or obs-text.
* Tools/TestWebKitAPI/Tests/WebCore/HTTPHeaderField.cpp:
(TestWebKitAPI::TEST): Add coverage for a control character and DEL
after a token being invalid, and for delimiters and obs-text after a
token remaining valid.
Canonical link: https://commits.webkit.org/321019@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
