View Details Raw Unified Return to Bug 165566

Collapse All Expand All



2016-12-07  John Wilander  <wilander@apple.com>

        Allow commas in Accept, Accept-Language, and Content-Language request headers for simple CORS
        https://bugs.webkit.org/show_bug.cgi?id=165566
        <rdar://problem/29560983>

        Reviewed by NOBODY (OOPS!).

        Updated the existing tests.

        * platform/network/HTTPParsers.cpp:
        (WebCore::isValidAcceptHeaderValue):
            Now also accepts ','.
        (WebCore::isValidLanguageHeaderValue):
            Ditto.

2016-12-07  Dave Hyatt  <hyatt@apple.com>

        [CSS Parser] Consolidate string/ident/url serialization functions

Lines 132-138 bool isValidAcceptHeaderValue(const Stri Source/WebCore/platform/network/HTTPParsers.cpp_sec1
- Source/WebCore/platform/network/HTTPParsers.cpp -2 / +2 lines
132	{	132	{
133	for (unsigned i = 0; i < value.length(); ++i) {	133	for (unsigned i = 0; i < value.length(); ++i) {
134	UChar c = value[i];	134	UChar c = value[i];
135	if (isASCIIAlphanumeric(c) \|\| c == ' ' \|\| c == '*' \|\| c == '.' \|\| c == '/' \|\| c == ';' \|\| c == '=')	135	if (isASCIIAlphanumeric(c) \|\| c == ' ' \|\| c == '*' \|\| c == ',' \|\| c == '.' \|\| c == '/' \|\| c == ';' \|\| c == '=')
136	continue;	136	continue;
137	return false;	137	return false;
138	}	138	}
Lines 145-151 bool isValidLanguageHeaderValue(const St Source/WebCore/platform/network/HTTPParsers.cpp_sec2
145	{	145	{
146	for (unsigned i = 0; i < value.length(); ++i) {	146	for (unsigned i = 0; i < value.length(); ++i) {
147	UChar c = value[i];	147	UChar c = value[i];
148	if (isASCIIAlphanumeric(c) \|\| c == ' ' \|\| c == '*' \|\| c == '-' \|\| c == '.' \|\| c == ';' \|\| c == '=')	148	if (isASCIIAlphanumeric(c) \|\| c == ' ' \|\| c == '*' \|\| c == ',' \|\| c == '-' \|\| c == '.' \|\| c == ';' \|\| c == '=')
149	continue;	149	continue;
150	return false;	150	return false;
151	}	151	}



2016-12-07  John Wilander  <wilander@apple.com>

        Allow commas in Accept, Accept-Language, and Content-Language request headers for simple CORS
        https://bugs.webkit.org/show_bug.cgi?id=165566
        <rdar://problem/29560983>

        Reviewed by NOBODY (OOPS!).

        * http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html:
            Added ',' to the tests as well as two examples from
            two sites where we found a regression.

2016-12-07  Ryan Haddad  <ryanhaddad@apple.com>

        Marking two compositing tests as failing.



    }

    var abnormalSimpleCorsHeaderValue = "() { :;};"
    var allAllowedNonAlphanumericCharactersForAcceptHeader = " *,./;="
    var allAllowedNonAlphanumericCharactersForAcceptAndContentLanguageHeader = " *,-.;="
    var testCases = [
        // Positive test cases with normal headers
        {
            headersToAdd: [{ name : "Accept", value: "application/json,text/*,*/*" }],
            explicitlyAllowHeaders: false,
            shouldCausePreflight: false,
            description: "Accept header with normal value SHOULD NOT cause a preflight"

            description: "Accept header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight"
        }
        ,{
            headersToAdd: [{ name : "Accept-Language", value: "en-US,en;q=0.8" }],
            explicitlyAllowHeaders: false,
            shouldCausePreflight: false,
            description: "Accept-Language header with normal value SHOULD NOT cause a preflight"

Return to Bug 165566

Lines 1-3 Source/WebCore/ChangeLog_sec1
- Source/WebCore/ChangeLog +16 lines
		1	2016-12-07 John Wilander <wilander@apple.com>
		2
		3	Allow commas in Accept, Accept-Language, and Content-Language request headers for simple CORS
		4	https://bugs.webkit.org/show_bug.cgi?id=165566
		5	<rdar://problem/29560983>
		6
		7	Reviewed by NOBODY (OOPS!).
		8
		9	Updated the existing tests.
		10
		11	* platform/network/HTTPParsers.cpp:
		12	(WebCore::isValidAcceptHeaderValue):
		13	Now also accepts ','.
		14	(WebCore::isValidLanguageHeaderValue):
		15	Ditto.
		16
1	2016-12-07 Dave Hyatt <hyatt@apple.com>	17	2016-12-07 Dave Hyatt <hyatt@apple.com>
2		18
3	[CSS Parser] Consolidate string/ident/url serialization functions	19	[CSS Parser] Consolidate string/ident/url serialization functions

Lines 1-3 LayoutTests/ChangeLog_sec1
- LayoutTests/ChangeLog +12 lines
		1	2016-12-07 John Wilander <wilander@apple.com>
		2
		3	Allow commas in Accept, Accept-Language, and Content-Language request headers for simple CORS
		4	https://bugs.webkit.org/show_bug.cgi?id=165566
		5	<rdar://problem/29560983>
		6
		7	Reviewed by NOBODY (OOPS!).
		8
		9	* http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html:
		10	Added ',' to the tests as well as two examples from
		11	two sites where we found a regression.
		12
1	2016-12-07 Ryan Haddad <ryanhaddad@apple.com>	13	2016-12-07 Ryan Haddad <ryanhaddad@apple.com>
2		14
3	Marking two compositing tests as failing.	15	Marking two compositing tests as failing.

Lines 34-45 LayoutTests/http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html_sec1
- LayoutTests/http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html -4 / +4 lines
34	}	34	}
35		35
36	var abnormalSimpleCorsHeaderValue = "() { :;};"	36	var abnormalSimpleCorsHeaderValue = "() { :;};"
37	var allAllowedNonAlphanumericCharactersForAcceptHeader = " *./;="	37	var allAllowedNonAlphanumericCharactersForAcceptHeader = " *,./;="
38	var allAllowedNonAlphanumericCharactersForAcceptAndContentLanguageHeader = " *-.;="	38	var allAllowedNonAlphanumericCharactersForAcceptAndContentLanguageHeader = " *,-.;="
39	var testCases = [	39	var testCases = [
40	// Positive test cases with normal headers	40	// Positive test cases with normal headers
41	{	41	{
42	headersToAdd: [{ name : "Accept", value: "text/*" }],	42	headersToAdd: [{ name : "Accept", value: "application/json,text/,/*" }],
43	explicitlyAllowHeaders: false,	43	explicitlyAllowHeaders: false,
44	shouldCausePreflight: false,	44	shouldCausePreflight: false,
45	description: "Accept header with normal value SHOULD NOT cause a preflight"	45	description: "Accept header with normal value SHOULD NOT cause a preflight"
Lines 51-57 LayoutTests/http/tests/xmlhttprequest/cors-non-standard-safelisted-headers-should-trigger-preflight.html_sec2
51	description: "Accept header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight"	51	description: "Accept header value with all allowed non-alphanumeric characters SHOULD NOT cause a preflight"
52	}	52	}
53	,{	53	,{
54	headersToAdd: [{ name : "Accept-Language", value: "en" }],	54	headersToAdd: [{ name : "Accept-Language", value: "en-US,en;q=0.8" }],
55	explicitlyAllowHeaders: false,	55	explicitlyAllowHeaders: false,
56	shouldCausePreflight: false,	56	shouldCausePreflight: false,
57	description: "Accept-Language header with normal value SHOULD NOT cause a preflight"	57	description: "Accept-Language header with normal value SHOULD NOT cause a preflight"