- Revision
- 119945
- Author
- [email protected]
- Date
- 2012-06-10 13:18:36 -0700 (Sun, 10 Jun 2012)
Log Message
Access control allow lists starting with a comma are parsed incorrectly (CORS)
https://bugs.webkit.org/show_bug.cgi?id=88461
Patch by Pablo Flouret <[email protected]> on 2012-06-10
Reviewed by Adam Barth.
Source/WebCore:
The parsing algorithm would stop parsing at the first comma (being an
empty entry, of sorts) and bail out, effectively ignoring the whole
header.
Test: http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html
* loader/CrossOriginPreflightResultCache.cpp:
(WebCore::parseAccessControlAllowList):
LayoutTests:
* http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma-expected.txt: Added.
* http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html: Added.
* http/tests/xmlhttprequest/resources/access-control-allow-lists.php: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (119944 => 119945)
--- trunk/LayoutTests/ChangeLog 2012-06-10 19:48:56 UTC (rev 119944)
+++ trunk/LayoutTests/ChangeLog 2012-06-10 20:18:36 UTC (rev 119945)
@@ -1,3 +1,14 @@
+2012-06-10 Pablo Flouret <[email protected]>
+
+ Access control allow lists starting with a comma are parsed incorrectly (CORS)
+ https://bugs.webkit.org/show_bug.cgi?id=88461
+
+ Reviewed by Adam Barth.
+
+ * http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma-expected.txt: Added.
+ * http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html: Added.
+ * http/tests/xmlhttprequest/resources/access-control-allow-lists.php: Added.
+
2012-06-10 Mike West <[email protected]>
Removing mixed content tests' dependency on WebKitBlobBuilder:
Added: trunk/LayoutTests/http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma-expected.txt (0 => 119945)
--- trunk/LayoutTests/http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma-expected.txt 2012-06-10 20:18:36 UTC (rev 119945)
@@ -0,0 +1,15 @@
+Allow lists starting with a comma should be parsed correctly.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Sending GET request with custom headers.
+PASS xhr.send(null) is undefined.
+PASS response['x-print'] is "unicorn"
+PASS response['y-print'] is "narwhal"
+Sending PUT request.
+PASS xhr.send(null) is undefined.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html (0 => 119945)
--- trunk/LayoutTests/http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html (rev 0)
+++ trunk/LayoutTests/http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html 2012-06-10 20:18:36 UTC (rev 119945)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script type="text/_javascript_">
+description("Allow lists starting with a comma should be parsed correctly.");
+var xhr = new XMLHttpRequest();
+var url = ""
+xhr.open("GET", url, false);
+xhr.setRequestHeader('x-print', 'unicorn')
+xhr.setRequestHeader('y-print', 'narwhal')
+debug("Sending GET request with custom headers.");
+shouldBeUndefined("xhr.send(null)");
+var response = JSON.parse(xhr.response)
+shouldBeEqualToString("response['x-print']", "unicorn");
+shouldBeEqualToString("response['y-print']", "narwhal");
+
+url = ""
+xhr.open("PUT", url, false);
+debug("Sending PUT request.");
+shouldBeUndefined("xhr.send(null)");
+</script>
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/xmlhttprequest/resources/access-control-allow-lists.php (0 => 119945)
--- trunk/LayoutTests/http/tests/xmlhttprequest/resources/access-control-allow-lists.php (rev 0)
+++ trunk/LayoutTests/http/tests/xmlhttprequest/resources/access-control-allow-lists.php 2012-06-10 20:18:36 UTC (rev 119945)
@@ -0,0 +1,28 @@
+<?php
+
+$origin = isset($_GET['origin']) ? $_GET['origin'] : $_SERVER['HTTP_ORIGIN'];
+
+if ($origin != 'none')
+ header("Access-Control-Allow-Origin: $origin");
+
+if (isset($_GET['headers']))
+ header("Access-Control-Allow-Headers: {$_GET['headers']}");
+if (isset($_GET['methods']))
+ header("Access-Control-Allow-Methods: {$_GET['methods']}");
+
+foreach ($_SERVER as $name => $value)
+{
+ if (substr($name, 0, 5) == 'HTTP_')
+ {
+ $name = strtolower(str_replace('_', '-', substr($name, 5)));
+ $headers[$name] = $value;
+ } else if ($name == "CONTENT_TYPE") {
+ $headers["content-type"] = $value;
+ } else if ($name == "CONTENT_LENGTH") {
+ $headers["content-length"] = $value;
+ }
+}
+
+$headers['get_value'] = isset($_GET['get_value']) ? $_GET['get_value'] : '';
+
+echo json_encode( $headers );
Modified: trunk/Source/WebCore/ChangeLog (119944 => 119945)
--- trunk/Source/WebCore/ChangeLog 2012-06-10 19:48:56 UTC (rev 119944)
+++ trunk/Source/WebCore/ChangeLog 2012-06-10 20:18:36 UTC (rev 119945)
@@ -1,3 +1,19 @@
+2012-06-10 Pablo Flouret <[email protected]>
+
+ Access control allow lists starting with a comma are parsed incorrectly (CORS)
+ https://bugs.webkit.org/show_bug.cgi?id=88461
+
+ Reviewed by Adam Barth.
+
+ The parsing algorithm would stop parsing at the first comma (being an
+ empty entry, of sorts) and bail out, effectively ignoring the whole
+ header.
+
+ Test: http/tests/xmlhttprequest/access-control-allow-lists-starting-with-comma.html
+
+ * loader/CrossOriginPreflightResultCache.cpp:
+ (WebCore::parseAccessControlAllowList):
+
2012-06-10 Darin Adler <[email protected]>
Some additional tweaks to keep TreeShared code simple/clean
Modified: trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.cpp (119944 => 119945)
--- trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.cpp 2012-06-10 19:48:56 UTC (rev 119944)
+++ trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.cpp 2012-06-10 20:18:36 UTC (rev 119945)
@@ -77,10 +77,8 @@
unsigned start = 0;
size_t end;
while ((end = string.find(',', start)) != notFound) {
- if (start == end)
- return false;
-
- addToAccessControlAllowList(string, start, end - 1, set);
+ if (start != end)
+ addToAccessControlAllowList(string, start, end - 1, set);
start = end + 1;
}
if (start != string.length())
