Fix security bug that allowed invalid header fields to be injected by

webkit/plugins/ppapi/ppb_url_request_info_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppb_url_request_info_impl.h"
 
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "googleurl/src/gurl.h"
 #include "googleurl/src/url_util.h"
@@ skipping 26 matching lines @@
 using WebKit::WebURLRequest;
 
 namespace webkit {
 namespace ppapi {
 
 namespace {
 
 const int32_t kDefaultPrefetchBufferUpperThreshold = 100 * 1000 * 1000;
 const int32_t kDefaultPrefetchBufferLowerThreshold = 50 * 1000 * 1000;
 
+bool IsValidToken(const std::string& token) {

[darin (slow to review), 2011/08/16 05:23:47]

It makes me a bit sad to see this validation code replicated here from webkit. 
an alternative would be to create a webkit API to invoke these validation
routines.

Or, we could even put this validation logic behind AssociatedURLLoader with an
option to disable it.

+  size_t length = token.size();
+  if (length == 0)
+    return false;
+
+  for (size_t i = 0; i < length; i++) {
+    char c = token[i];
+    if (c >= 127 || c <= 32)
+      return false;
+    if (c == '(' || c == ')' || c == '<' || c == '>' || c == '@' ||
+        c == ',' || c == ';' || c == ':' || c == '\\' || c == '\"' ||
+        c == '/' || c == '[' || c == ']' || c == '?' || c == '=' ||
+        c == '{' || c == '}')
+      return false;
+  }
+  return true;
+}
+
+// These methods are not allowed by the XMLHttpRequest standard.
+// http://www.w3.org/TR/XMLHttpRequest/#the-open-method
+const char* const kForbiddenHttpMethods[] = {
+  "connect",
+  "trace",
+  "track",
+};
+
+// These are the "known" methods in the Webkit XHR implementation. Also see
+// the XMLHttpRequest standard.
+// http://www.w3.org/TR/XMLHttpRequest/#the-open-method
+const char* const kKnownHttpMethods[] = {
+  "get",
+  "post",
+  "put",
+  "head",
+  "copy",
+  "delete",
+  "index",
+  "lock",
+  "m-post",
+  "mkcol",
+  "move",
+  "options",
+  "propfind",
+  "proppatch",
+  "unlock",
+};
+
+std::string ValidateMethod(const std::string& method) {
+  for (size_t i = 0; i < arraysize(kForbiddenHttpMethods); ++i) {
+    if (LowerCaseEqualsASCII(method, kForbiddenHttpMethods[i]))
+      return std::string();
+  }
+  for (size_t i = 0; i < arraysize(kKnownHttpMethods); ++i) {
+    if (LowerCaseEqualsASCII(method, kKnownHttpMethods[i])) {
+      // Convert the method name to upper case to match Webkit and Firefox's
+      // XHR implementation.
+      return StringToUpperASCII(std::string(kKnownHttpMethods[i]));
+    }
+  }
+  // Pass through unknown methods that are not forbidden.
+  return method;
+}
+
 // A header string containing any of the following fields will cause
 // an error. The list comes from the XMLHttpRequest standard.
 // http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method
 const char* const kForbiddenHeaderFields[] = {
   "accept-charset",
   "accept-encoding",
   "connection",
   "content-length",
   "cookie",
   "cookie2",
@@ skipping 265 matching lines @@
 }
 
 bool PPB_URLRequestInfo_Impl::SetStringProperty(PP_URLRequestProperty property,
                                                 const std::string& value) {
   // TODO(darin): Validate input.  Perhaps at a different layer?
   switch (property) {
     case PP_URLREQUESTPROPERTY_URL:
       url_ = value;  // NOTE: This may be a relative URL.
       return true;
     case PP_URLREQUESTPROPERTY_METHOD:
-      method_ = value;
-      return true;
+      if (!IsValidToken(value))
+        return false;
+      method_ = ValidateMethod(value);
+      return !method_.empty();
     case PP_URLREQUESTPROPERTY_HEADERS:
       if (!AreValidHeaders(value))
         return false;
       headers_ = value;
       return true;
     case PP_URLREQUESTPROPERTY_CUSTOMREFERRERURL:
       has_custom_referrer_url_ = true;
       custom_referrer_url_ = value;
       return true;
     case PP_URLREQUESTPROPERTY_CUSTOMCONTENTTRANSFERENCODING:
       has_custom_content_transfer_encoding_ = true;
       custom_content_transfer_encoding_ = value;
       return true;
     default:
       return false;
   }
 }
 
 }  // namespace ppapi
 }  // namespace webkit