This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch base-browser-102.5.0esr-12.0-1 in repository tor-browser.
commit 7541c173889f150c0c72940f71c60f55a15c842d Author: sunil mayya smayya@mozilla.com AuthorDate: Mon Oct 24 09:17:22 2022 +0000
Bug 1790311 - update handling of request headers in Fetch/XHR. r=necko-reviewers,valentin, a=dmeehan
Differential Revision: https://phabricator.services.mozilla.com/D157729 --- dom/base/nsContentUtils.cpp | 45 ++++++++++++++++++++++++++++++++---- dom/base/nsContentUtils.h | 11 ++++++++- dom/fetch/FetchUtil.h | 1 - dom/fetch/InternalHeaders.cpp | 18 +++++++++------ dom/fetch/InternalHeaders.h | 5 ++-- dom/xhr/XMLHttpRequestMainThread.cpp | 3 ++- 6 files changed, 66 insertions(+), 17 deletions(-)
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 0562245205a3..8f8341b099ab 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -7189,15 +7189,25 @@ bool nsContentUtils::IsNodeInEditableRegion(nsINode* aNode) { }
// static -bool nsContentUtils::IsForbiddenRequestHeader(const nsACString& aHeader) { +bool nsContentUtils::IsForbiddenRequestHeader(const nsACString& aHeader, + const nsACString& aValue) { if (IsForbiddenSystemRequestHeader(aHeader)) { return true; }
- return StringBeginsWith(aHeader, "proxy-"_ns, - nsCaseInsensitiveCStringComparator) || - StringBeginsWith(aHeader, "sec-"_ns, - nsCaseInsensitiveCStringComparator); + if ((nsContentUtils::IsOverrideMethodHeader(aHeader) && + nsContentUtils::ContainsForbiddenMethod(aValue))) { + return true; + } + + if (StringBeginsWith(aHeader, "proxy-"_ns, + nsCaseInsensitiveCStringComparator) || + StringBeginsWith(aHeader, "sec-"_ns, + nsCaseInsensitiveCStringComparator)) { + return true; + } + + return false; }
// static @@ -7236,6 +7246,31 @@ bool nsContentUtils::IsForbiddenResponseHeader(const nsACString& aHeader) { aHeader.LowerCaseEqualsASCII("set-cookie2")); }
+// static +bool nsContentUtils::IsOverrideMethodHeader(const nsACString& headerName) { + return headerName.EqualsIgnoreCase("x-http-method-override") || + headerName.EqualsIgnoreCase("x-http-method") || + headerName.EqualsIgnoreCase("x-method-override"); +} + +// static +bool nsContentUtils::ContainsForbiddenMethod(const nsACString& headerValue) { + bool hasInsecureMethod = false; + nsCCharSeparatedTokenizer tokenizer(headerValue, ','); + + while (tokenizer.hasMoreTokens()) { + const nsDependentCSubstring& value = tokenizer.nextToken(); + + if (value.EqualsIgnoreCase("connect") || value.EqualsIgnoreCase("trace") || + value.EqualsIgnoreCase("track")) { + hasInsecureMethod = true; + break; + } + } + + return hasInsecureMethod; +} + // static bool nsContentUtils::IsCorsUnsafeRequestHeaderValue( const nsACString& aHeaderValue) { diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h index 739e8ca23c85..9f9e94e4b0e1 100644 --- a/dom/base/nsContentUtils.h +++ b/dom/base/nsContentUtils.h @@ -2758,7 +2758,8 @@ class nsContentUtils { * Returns whether a given header is forbidden for an XHR or fetch * request. */ - static bool IsForbiddenRequestHeader(const nsACString& aHeader); + static bool IsForbiddenRequestHeader(const nsACString& aHeader, + const nsACString& aValue);
/** * Returns whether a given header is forbidden for a system XHR @@ -2766,6 +2767,14 @@ class nsContentUtils { */ static bool IsForbiddenSystemRequestHeader(const nsACString& aHeader);
+ /** + * Checks whether the header overrides any http methods + */ + static bool IsOverrideMethodHeader(const nsACString& headerName); + /** + * Checks whether the header value contains any forbidden method + */ + static bool ContainsForbiddenMethod(const nsACString& headerValue); /** * Returns whether a given header has characters that aren't permitted */ diff --git a/dom/fetch/FetchUtil.h b/dom/fetch/FetchUtil.h index c86019ed0b11..c0c9157a43c8 100644 --- a/dom/fetch/FetchUtil.h +++ b/dom/fetch/FetchUtil.h @@ -37,7 +37,6 @@ class FetchUtil final { */ static nsresult GetValidRequestMethod(const nsACString& aMethod, nsCString& outMethod); - /** * Extracts an HTTP header from a substring range. */ diff --git a/dom/fetch/InternalHeaders.cpp b/dom/fetch/InternalHeaders.cpp index 37a5e0fadcaa..45cb2aa5c4dc 100644 --- a/dom/fetch/InternalHeaders.cpp +++ b/dom/fetch/InternalHeaders.cpp @@ -6,6 +6,7 @@
#include "mozilla/dom/InternalHeaders.h"
+#include "FetchUtil.h" #include "mozilla/dom/FetchTypes.h" #include "mozilla/ErrorResult.h"
@@ -56,11 +57,11 @@ bool InternalHeaders::IsValidHeaderValue(const nsCString& aLowerName, }
// Step 4 - if (mGuard == HeadersGuardEnum::Request && - IsForbiddenRequestHeader(aLowerName)) { - return false; + if (mGuard == HeadersGuardEnum::Request) { + if (IsForbiddenRequestHeader(aLowerName, aNormalizedValue)) { + return false; + } } - // Step 5 if (mGuard == HeadersGuardEnum::Request_no_cors) { nsAutoCString tempValue; @@ -161,7 +162,9 @@ void InternalHeaders::Delete(const nsACString& aName, ErrorResult& aRv) { }
// Step 3 - if (IsForbiddenRequestHeader(lowerName)) { + nsAutoCString value; + GetInternal(lowerName, value, aRv); + if (IsForbiddenRequestHeader(lowerName, value)) { return; }
@@ -381,9 +384,10 @@ bool InternalHeaders::IsImmutable(ErrorResult& aRv) const { return false; }
-bool InternalHeaders::IsForbiddenRequestHeader(const nsCString& aName) const { +bool InternalHeaders::IsForbiddenRequestHeader(const nsCString& aName, + const nsACString& aValue) const { return mGuard == HeadersGuardEnum::Request && - nsContentUtils::IsForbiddenRequestHeader(aName); + nsContentUtils::IsForbiddenRequestHeader(aName, aValue); }
bool InternalHeaders::IsForbiddenRequestNoCorsHeader( diff --git a/dom/fetch/InternalHeaders.h b/dom/fetch/InternalHeaders.h index 2fac237733d7..2841844ef6da 100644 --- a/dom/fetch/InternalHeaders.h +++ b/dom/fetch/InternalHeaders.h @@ -131,7 +131,8 @@ class InternalHeaders final { bool IsValidHeaderValue(const nsCString& aLowerName, const nsCString& aNormalizedValue, ErrorResult& aRv); bool IsImmutable(ErrorResult& aRv) const; - bool IsForbiddenRequestHeader(const nsCString& aName) const; + bool IsForbiddenRequestHeader(const nsCString& aName, + const nsACString& aValue) const; bool IsForbiddenRequestNoCorsHeader(const nsCString& aName) const; bool IsForbiddenRequestNoCorsHeader(const nsCString& aName, const nsACString& aValue) const; @@ -144,7 +145,7 @@ class InternalHeaders final { bool IsInvalidMutableHeader(const nsCString& aName, const nsACString& aValue, ErrorResult& aRv) const { return IsInvalidName(aName, aRv) || IsInvalidValue(aValue, aRv) || - IsImmutable(aRv) || IsForbiddenRequestHeader(aName) || + IsImmutable(aRv) || IsForbiddenRequestHeader(aName, aValue) || IsForbiddenRequestNoCorsHeader(aName, aValue) || IsForbiddenResponseHeader(aName); } diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp index 3e68ab9e7783..cdb0792d5385 100644 --- a/dom/xhr/XMLHttpRequestMainThread.cpp +++ b/dom/xhr/XMLHttpRequestMainThread.cpp @@ -3135,7 +3135,8 @@ void XMLHttpRequestMainThread::SetRequestHeader(const nsACString& aName,
// Step 5 bool isPrivilegedCaller = IsSystemXHR(); - bool isForbiddenHeader = nsContentUtils::IsForbiddenRequestHeader(aName); + bool isForbiddenHeader = + nsContentUtils::IsForbiddenRequestHeader(aName, aValue); if (!isPrivilegedCaller && isForbiddenHeader) { AutoTArray<nsString, 1> params; CopyUTF8toUTF16(aName, *params.AppendElement());