1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
From 23e5bd6ffab4b6fa17a92d0bc58fbd185e9a7e6e Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Tue, 13 Oct 2015 11:10:26 +0200
Subject: [PATCH] Bug 1199430 - Reject hostnames containing @. r=mcmanus, a=al
---
docshell/test/unit/test_nsDefaultURIFixup_info.js | 16 ++++++------
netwerk/base/nsStandardURL.cpp | 30 ++++++++++++++---------
netwerk/base/nsStandardURL.h | 2 +-
3 files changed, 27 insertions(+), 21 deletions(-)
diff --git a/docshell/test/unit/test_nsDefaultURIFixup_info.js b/docshell/test/unit/test_nsDefaultURIFixup_info.js
index b178ea9..dbb55c6 100644
--- a/docshell/test/unit/test_nsDefaultURIFixup_info.js
+++ b/docshell/test/unit/test_nsDefaultURIFixup_info.js
@@ -199,12 +199,10 @@ let testcases = [ {
protocolChange: true
}, {
input: "[::1][100",
- fixedURI: "http://[::1][100/",
- alternateURI: "http://[::1][100/",
+ fixedURI: null,
+ alternateURI: null,
keywordLookup: true,
- protocolChange: true,
- affectedByWhitelist: true,
- affectedByDNSForSingleHosts: true,
+ protocolChange: true
}, {
input: "[::1]]",
keywordLookup: true,
@@ -514,15 +512,15 @@ if (Services.appinfo.OS.toLowerCase().startsWith("win")) {
input: "//mozilla",
fixedURI: "file:////mozilla",
protocolChange: true,
- });
+ }); // \ is an invalid character in the hostname until bug 652186 is implemented
testcases.push({
input: "mozilla\\",
- fixedURI: "http://mozilla\\/",
- alternateURI: "http://www.mozilla/",
+ // fixedURI: "http://mozilla\\/",
+ // alternateURI: "http://www.mozilla/",
keywordLookup: true,
protocolChange: true,
affectedByWhitelist: true,
- affectedByDNSForSingleHosts: true,
+ // affectedByDNSForSingleHosts: true,
});
}
diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
index f5f516f..cff90fc 100644
--- a/netwerk/base/nsStandardURL.cpp
+++ b/netwerk/base/nsStandardURL.cpp
@@ -427,14 +427,16 @@ nsStandardURL::NormalizeIDN(const nsCSubstring &host, nsCString &result)
}
bool
-nsStandardURL::ValidIPv6orHostname(const char *host)
+nsStandardURL::ValidIPv6orHostname(const char *host, uint32_t length)
{
- if (!host || !*host) {
- // Should not be NULL or empty string
+ if (!host) {
return false;
}
- int32_t length = strlen(host);
+ if (length != strlen(host)) {
+ // Embedded null
+ return false;
+ }
bool openBracket = host[0] == '[';
bool closeBracket = host[length - 1] == ']';
@@ -448,8 +450,9 @@ nsStandardURL::ValidIPv6orHostname(const char *host)
return false;
}
- if (PL_strchr(host, ':')) {
- // Hostnames should not contain a colon
+ const char *end = host + length;
+ if (end != net_FindCharInSet(host, end, "\t\n\v\f\r #/:?@[\\]")) {
+ // % is allowed because we don't do hostname percent decoding yet.
return false;
}
@@ -587,6 +590,11 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
approxLen += encHost.Length();
else
approxLen += mHost.mLen;
+
+ if ((useEncHost && !ValidIPv6orHostname(encHost.BeginReading(), encHost.Length())) ||
+ (!useEncHost && !ValidIPv6orHostname(tempHost.BeginReading(), tempHost.Length()))) {
+ return NS_ERROR_MALFORMED_URI;
+ }
}
//
@@ -1580,14 +1588,10 @@ nsStandardURL::SetHost(const nsACString &input)
if (strchr(host, ' '))
return NS_ERROR_MALFORMED_URI;
- if (!ValidIPv6orHostname(host)) {
- return NS_ERROR_MALFORMED_URI;
- }
-
InvalidateCache();
mHostEncoding = eEncoding_ASCII;
- int32_t len;
+ uint32_t len;
nsAutoCString hostBuf;
if (NormalizeIDN(flat, hostBuf)) {
host = hostBuf.get();
@@ -1596,6 +1600,10 @@ nsStandardURL::SetHost(const nsACString &input)
else
len = flat.Length();
+ if (!ValidIPv6orHostname(host, len)) {
+ return NS_ERROR_MALFORMED_URI;
+ }
+
if (mHost.mLen < 0) {
int port_length = 0;
if (mPort != -1) {
diff --git a/netwerk/base/nsStandardURL.h b/netwerk/base/nsStandardURL.h
index 179a618..c56426e 100644
--- a/netwerk/base/nsStandardURL.h
+++ b/netwerk/base/nsStandardURL.h
@@ -173,7 +173,7 @@ private:
void Clear();
void InvalidateCache(bool invalidateCachedFile = true);
- bool ValidIPv6orHostname(const char *host);
+ bool ValidIPv6orHostname(const char *host, uint32_t aLen);
bool NormalizeIDN(const nsCSubstring &host, nsCString &result);
void CoalescePath(netCoalesceFlags coalesceFlag, char *path);
--
2.5.0
|
