Fix security bug that allowed invalid header fields to be injected by

webkit/plugins/ppapi/url_request_info_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/thunk/thunk.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrameClient.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebURLRequest.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
 #include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
@@ skipping 190 matching lines @@
   info_->SetStringProperty(PP_URLREQUESTPROPERTY_URL, url);
   ASSERT_TRUE(info_->RequiresUniversalAccess());
 }
 
 TEST_F(URLRequestInfoTest, SetMethod) {
   // Test default method is "GET".
   ASSERT_TRUE(IsExpected(GetMethod(), "GET"));
   ASSERT_TRUE(info_->SetStringProperty(
       PP_URLREQUESTPROPERTY_METHOD, "POST"));
   ASSERT_TRUE(IsExpected(GetMethod(), "POST"));
+
+  // Test that method names are converted to upper case.
+  ASSERT_TRUE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "get"));
+  ASSERT_TRUE(IsExpected(GetMethod(), "GET"));
+  ASSERT_TRUE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "post"));
+  ASSERT_TRUE(IsExpected(GetMethod(), "POST"));
+}
+
+TEST_F(URLRequestInfoTest, SetInvalidMethod) {
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "CONNECT"));
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "connect"));
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "TRACE"));
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "trace"));
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "TRACK"));
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "track"));
+
+  ASSERT_FALSE(info_->SetStringProperty(
+      PP_URLREQUESTPROPERTY_METHOD, "POST\x0d\x0ax-csrf-token:\x20test1234"));
 }
 
 TEST_F(URLRequestInfoTest, SetValidHeaders) {
   // Test default header field.
   ASSERT_TRUE(IsExpected(
       GetHeaderValue("foo"), ""));
   // Test that we can set a header field.
   ASSERT_TRUE(info_->SetStringProperty(
       PP_URLREQUESTPROPERTY_HEADERS, "foo: bar"));
   ASSERT_TRUE(IsExpected(
@@ skipping 51 matching lines @@
   ASSERT_FALSE(info_->SetStringProperty(
       PP_URLREQUESTPROPERTY_HEADERS, "foo: bar\ncookie: foo"));
   ASSERT_TRUE(IsNullOrEmpty(GetHeaderValue("cookie")));
 }
 
 // TODO(bbudge) Unit tests for AppendDataToBody, AppendFileToBody.
 
 }  // namespace ppapi
 }  // namespace webkit