2007-12-01 Julien Chaffraix <julien.chaffraix@gmail.com>

        Bug 16189: XMLHttpRequest::setRequestHeader() should not set certain headers

        Reviewed by Darin Adler.

        * xml/XMLHttpRequest.cpp:
        (WebCore::canSetRequestHeader):

        Test: http/tests/xmlhttprequest/set-dangerous-headers.html

2007-12-01  Julien Chaffraix  <julien.chaffraix@gmail.com>

        Bug 16189: XMLHttpRequest::setRequestHeader() should not set certain headers

        Reviewed by Darin Adler.

        * http/tests/xmlhttprequest/set-dangerous-headers-expected.txt:
        * http/tests/xmlhttprequest/set-dangerous-headers.html: Added tests for new headers

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28301 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 88afeb7b270f6a5164185d7426d37642261129c1..8f5c4f4e95b7fcbcf95a2498adebea991c2d23b9 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2007-12-01  Julien Chaffraix  <julien.chaffraix@gmail.com>
+
+        Bug 16189: XMLHttpRequest::setRequestHeader() should not set certain headers
+
+        Reviewed by Darin Adler.
+
+        * http/tests/xmlhttprequest/set-dangerous-headers-expected.txt:
+        * http/tests/xmlhttprequest/set-dangerous-headers.html: Added tests for new headers
+
 2007-12-01  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.

diff --git a/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers-expected.txt b/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers-expected.txt
index 3a347a6e6acee1b9c3547b613af12fb946c2d74b..c765edcc7939650d4a6951c0ed1d3f49ec793771 100644 (file)
--- a/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers-expected.txt
+++ b/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers-expected.txt
@@ -1,8 +1,10 @@
 CONSOLE MESSAGE: line 1: Refused to set unsafe header ACCEPT-CHARSET
 CONSOLE MESSAGE: line 1: Refused to set unsafe header ACCEPT-ENCODING
+CONSOLE MESSAGE: line 1: Refused to set unsafe header CONNECTION
 CONSOLE MESSAGE: line 1: Refused to set unsafe header CONTENT-LENGTH
-CONSOLE MESSAGE: line 1: Refused to set unsafe header EXPECT
+CONSOLE MESSAGE: line 1: Refused to set unsafe header CONTENT-TRANSFER-ENCODING
 CONSOLE MESSAGE: line 1: Refused to set unsafe header DATE
+CONSOLE MESSAGE: line 1: Refused to set unsafe header EXPECT
 CONSOLE MESSAGE: line 1: Refused to set unsafe header HOST
 CONSOLE MESSAGE: line 1: Refused to set unsafe header KEEP-ALIVE
 CONSOLE MESSAGE: line 1: Refused to set unsafe header REFERER
@@ -11,6 +13,9 @@ CONSOLE MESSAGE: line 1: Refused to set unsafe header TRAILER
 CONSOLE MESSAGE: line 1: Refused to set unsafe header TRANSFER-ENCODING
 CONSOLE MESSAGE: line 1: Refused to set unsafe header UPGRADE
 CONSOLE MESSAGE: line 1: Refused to set unsafe header VIA
+CONSOLE MESSAGE: line 1: Refused to set unsafe header Proxy-
+CONSOLE MESSAGE: line 1: Refused to set unsafe header Proxy-test
+CONSOLE MESSAGE: line 1: Refused to set unsafe header PROXY-FOO
 Test that setRequestHeader cannot be used to alter security-sensitive headers.
 
 SUCCESS

diff --git a/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html b/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html
index 6b7e459691d46401ad3cc8c772967f7218b5536b..29a68f9b9d4f9bc9415e1108429eca6088c260e9 100644 (file)
--- a/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html
+++ b/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html
@@ -11,9 +11,11 @@
 
     req.setRequestHeader("ACCEPT-CHARSET", "foobar");
     req.setRequestHeader("ACCEPT-ENCODING", "foobar");
+    req.setRequestHeader("CONNECTION", "foobar");
     req.setRequestHeader("CONTENT-LENGTH", "123456");
-    req.setRequestHeader("EXPECT", "100-continue");
+    req.setRequestHeader("CONTENT-TRANSFER-ENCODING", "foobar");
     req.setRequestHeader("DATE", "foobar");
+    req.setRequestHeader("EXPECT", "100-continue");
     req.setRequestHeader("HOST", "foobar");
     req.setRequestHeader("KEEP-ALIVE", "foobar");
     req.setRequestHeader("REFERER", "foobar");
@@ -23,6 +25,10 @@
     req.setRequestHeader("UPGRADE", "foobar");
     req.setRequestHeader("VIA", "foobar");
 
+    req.setRequestHeader("Proxy-", "foobar");
+    req.setRequestHeader("Proxy-test", "foobar");
+    req.setRequestHeader("PROXY-FOO", "foobar");
+
     try {
         req.send("");
         if (req.responseText.match("100-continue|foobar|123456"))

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 4841d621bbda1ca117a29bd65465498137bfcd12..ccb91fd340f01ea00c4ca9a27372603fad8f25a8 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14 @@
+2007-12-01  Julien Chaffraix  <julien.chaffraix@gmail.com>
+
+        Bug 16189: XMLHttpRequest::setRequestHeader() should not set certain headers
+
+        Reviewed by Darin Adler.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::canSetRequestHeader):
+
+        Test: http/tests/xmlhttprequest/set-dangerous-headers.html
+
 2007-12-01  Rahul Abrol  <ra5ul@comcast.net>
 
         Reviewed by Adam Roben.

diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 9e5172481c635aa4f2b07ed3aaef79d6c56eaaa2..ef816d61a49fa79143312b1393736eda11198ce8 100644 (file)
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -92,13 +92,16 @@ static void removeFromRequestsByDocument(Document* doc, XMLHttpRequest* req)
 static bool canSetRequestHeader(const String& name)
 {
     static HashSet<String, CaseInsensitiveHash<String> > forbiddenHeaders;
+    static String proxyString("proxy-");
     
     if (forbiddenHeaders.isEmpty()) {
         forbiddenHeaders.add("accept-charset");
         forbiddenHeaders.add("accept-encoding");
+        forbiddenHeaders.add("connection");
         forbiddenHeaders.add("content-length");
-        forbiddenHeaders.add("expect");
+        forbiddenHeaders.add("content-transfer-encoding");
         forbiddenHeaders.add("date");
+        forbiddenHeaders.add("expect");
         forbiddenHeaders.add("host");
         forbiddenHeaders.add("keep-alive");
         forbiddenHeaders.add("referer");
@@ -109,7 +112,7 @@ static bool canSetRequestHeader(const String& name)
         forbiddenHeaders.add("via");
     }
     
-    return !forbiddenHeaders.contains(name);
+    return !forbiddenHeaders.contains(name) && !name.startsWith(proxyString, false);
 }
 
 // Determines if a string is a valid token, as defined by