diff options
| -rw-r--r-- | src/network/access/qhttpheaderparser.cpp | 84 | ||||
| -rw-r--r-- | tests/auto/network/access/qhttpnetworkreply/tst_qhttpnetworkreply.cpp | 74 |
2 files changed, 135 insertions, 23 deletions
diff --git a/src/network/access/qhttpheaderparser.cpp b/src/network/access/qhttpheaderparser.cpp index 4a6bbd49a7..5caa541cb2 100644 --- a/src/network/access/qhttpheaderparser.cpp +++ b/src/network/access/qhttpheaderparser.cpp @@ -39,8 +39,16 @@ #include "qhttpheaderparser_p.h" +#include <algorithm> + QT_BEGIN_NAMESPACE +// both constants are taken from the default settings of Apache +// see: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize and +// http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfields +static const int MAX_HEADER_FIELD_SIZE = 8 * 1024; +static const int MAX_HEADER_FIELDS = 100; + QHttpHeaderParser::QHttpHeaderParser() : statusCode(100) // Required by tst_QHttpNetworkConnection::ignoresslerror(failure) , majorVersion(0) @@ -57,36 +65,66 @@ void QHttpHeaderParser::clear() fields.clear(); } +static bool fieldNameCheck(QByteArrayView name) +{ + static constexpr QByteArrayView otherCharacters("!#$%&'*+-.^_`|~"); + static const auto fieldNameChar = [](char c) { + return ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z') || ('0' <= c && c <= '9') + || otherCharacters.contains(c); + }; + + return name.size() > 0 && std::all_of(name.begin(), name.end(), fieldNameChar); +} + bool QHttpHeaderParser::parseHeaders(QByteArrayView header) { // see rfc2616, sec 4 for information about HTTP/1.1 headers. // allows relaxed parsing here, accepts both CRLF & LF line endings - int i = 0; - while (i < header.size()) { - int j = header.indexOf(':', i); // field-name - if (j == -1) - break; - QByteArrayView field = header.sliced(i, j - i).trimmed(); - j++; - // any number of LWS is allowed before and after the value + Q_ASSERT(fields.isEmpty()); + const auto hSpaceStart = [](QByteArrayView h) { + return h.startsWith(' ') || h.startsWith('\t'); + }; + // Headers, if non-empty, start with a non-space and end with a newline: + if (hSpaceStart(header) || (header.size() && !header.endsWith('\n'))) + return false; + + while (int tail = header.endsWith("\n\r\n") ? 2 : header.endsWith("\n\n") ? 1 : 0) + header.chop(tail); + + QList<QPair<QByteArray, QByteArray>> result; + while (header.size()) { + const int colon = header.indexOf(':'); + if (colon == -1) // if no colon check if empty headers + return result.size() == 0 && (header == "\n" || header == "\r\n"); + if (result.size() >= MAX_HEADER_FIELDS) + return false; + QByteArrayView name = header.first(colon); + if (!fieldNameCheck(name)) + return false; + header = header.sliced(colon + 1); QByteArray value; + int valueSpace = MAX_HEADER_FIELD_SIZE - name.size() - 1; do { - i = header.indexOf('\n', j); - if (i == -1) - break; - if (!value.isEmpty()) - value += ' '; - // check if we have CRLF or only LF - bool hasCR = i && header[i - 1] == '\r'; - int length = i - (hasCR ? 1: 0) - j; - value += header.sliced(j, length).trimmed(); - j = ++i; - } while (i < header.size() && (header.at(i) == ' ' || header.at(i) == '\t')); - if (i == -1) - return false; // something is wrong - - fields.append(qMakePair(field.toByteArray(), value)); + const int endLine = header.indexOf('\n'); + Q_ASSERT(endLine != -1); + auto line = header.first(endLine); // includes space + valueSpace -= line.size() - (line.endsWith('\r') ? 1 : 0); + if (valueSpace < 0) + return false; + line = line.trimmed(); + if (line.size()) { + if (value.size()) + value += ' ' + line.toByteArray(); + else + value = line.toByteArray(); + } + header = header.sliced(endLine + 1); + } while (hSpaceStart(header)); + Q_ASSERT(name.size() + 1 + value.size() <= MAX_HEADER_FIELD_SIZE); + result.append(qMakePair(name.toByteArray(), value)); } + + fields = result; return true; } diff --git a/tests/auto/network/access/qhttpnetworkreply/tst_qhttpnetworkreply.cpp b/tests/auto/network/access/qhttpnetworkreply/tst_qhttpnetworkreply.cpp index 50132dde35..eca81ba4ea 100644 --- a/tests/auto/network/access/qhttpnetworkreply/tst_qhttpnetworkreply.cpp +++ b/tests/auto/network/access/qhttpnetworkreply/tst_qhttpnetworkreply.cpp @@ -40,6 +40,9 @@ private Q_SLOTS: void parseHeader_data(); void parseHeader(); + void parseHeaderVerification_data(); + void parseHeaderVerification(); + void parseEndOfHeader_data(); void parseEndOfHeader(); }; @@ -50,6 +53,7 @@ void tst_QHttpNetworkReply::parseHeader_data() QTest::addColumn<QStringList>("fields"); QTest::addColumn<QStringList>("values"); + QTest::newRow("no-fields") << QByteArray("\r\n") << QStringList() << QStringList(); QTest::newRow("empty-field") << QByteArray("Set-Cookie: \r\n") << (QStringList() << "Set-Cookie") << (QStringList() << ""); @@ -60,6 +64,9 @@ void tst_QHttpNetworkReply::parseHeader_data() " charset=utf-8\r\n") << (QStringList() << "Content-Type") << (QStringList() << "text/html; charset=utf-8"); + QTest::newRow("single-field-on-five-lines") + << QByteArray("Name:\r\n first\r\n \r\n \r\n last\r\n") << (QStringList() << "Name") + << (QStringList() << "first last"); QTest::newRow("multi-field") << QByteArray("Content-Type: text/html; charset=utf-8\r\n" "Content-Length: 1024\r\n" @@ -101,6 +108,73 @@ void tst_QHttpNetworkReply::parseHeader() } } +// both constants are taken from the default settings of Apache +// see: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize and +// http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfields +const int MAX_HEADER_FIELD_SIZE = 8 * 1024; +const int MAX_HEADER_FIELDS = 100; + +void tst_QHttpNetworkReply::parseHeaderVerification_data() +{ + QTest::addColumn<QByteArray>("headers"); + QTest::addColumn<bool>("success"); + + QTest::newRow("no-header-fields") << QByteArray("\r\n") << true; + QTest::newRow("starting-with-space") << QByteArray(" Content-Encoding: gzip\r\n") << false; + QTest::newRow("starting-with-tab") << QByteArray("\tContent-Encoding: gzip\r\n") << false; + QTest::newRow("only-colon") << QByteArray(":\r\n") << false; + QTest::newRow("colon-and-value") << QByteArray(": only-value\r\n") << false; + QTest::newRow("name-with-space") << QByteArray("Content Length: 10\r\n") << false; + QTest::newRow("missing-colon-1") << QByteArray("Content-Encoding\r\n") << false; + QTest::newRow("missing-colon-2") + << QByteArray("Content-Encoding\r\nContent-Length: 10\r\n") << false; + QTest::newRow("missing-colon-3") + << QByteArray("Content-Encoding: gzip\r\nContent-Length\r\n") << false; + QTest::newRow("header-field-too-long") + << (QByteArray("Content-Type: ") + QByteArray(MAX_HEADER_FIELD_SIZE, 'a') + + QByteArray("\r\n")) + << false; + + QByteArray name = "Content-Type: "; + QTest::newRow("max-header-field-size") + << (name + QByteArray(MAX_HEADER_FIELD_SIZE - name.size(), 'a') + QByteArray("\r\n")) + << true; + + QByteArray tooManyHeaders = QByteArray("Content-Type: text/html; charset=utf-8\r\n") + .repeated(MAX_HEADER_FIELDS + 1); + QTest::newRow("too-many-headers") << tooManyHeaders << false; + + QByteArray maxHeaders = + QByteArray("Content-Type: text/html; charset=utf-8\r\n").repeated(MAX_HEADER_FIELDS); + QTest::newRow("max-headers") << maxHeaders << true; + + QByteArray firstValue(MAX_HEADER_FIELD_SIZE / 2, 'a'); + constexpr int obsFold = 1; + QTest::newRow("max-continuation-size") + << (name + firstValue + QByteArray("\r\n ") + + QByteArray(MAX_HEADER_FIELD_SIZE - name.size() - firstValue.size() - obsFold, 'b') + + QByteArray("\r\n")) + << true; + QTest::newRow("too-long-continuation-size") + << (name + firstValue + QByteArray("\r\n ") + + QByteArray(MAX_HEADER_FIELD_SIZE - name.size() - firstValue.size() - obsFold + 1, + 'b') + + QByteArray("\r\n")) + << false; +} + +void tst_QHttpNetworkReply::parseHeaderVerification() +{ + QFETCH(QByteArray, headers); + QFETCH(bool, success); + QHttpNetworkReply reply; + reply.parseHeader(headers); + if (success && QByteArrayView(headers).trimmed().size()) + QVERIFY(reply.header().size() > 0); + else + QCOMPARE(reply.header().size(), 0); +} + class TestHeaderSocket : public QAbstractSocket { public: |