Ensure that only byte values are sent by sockets and web sockets

sdk/lib/io/websocket_impl.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 const String _webSocketGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 
 class _WebSocketMessageType {
   static const int NONE = 0;
@@ skipping 507 matching lines @@
       header[index++] = 127;
       lengthBytes = 8;
     } else if (dataLength > 125) {
       header[index++] = 126;
       lengthBytes = 2;
     }
     // Write the length in network byte order into the header.
     for (int i = 0; i < lengthBytes; i++) {
       header[index++] = dataLength >> (((lengthBytes - 1) - i) * 8) & 0xFF;
     }
     if (mask) {

[Anders Johnsen, 2013/06/12 06:13:58]

What if it's not masked?

[Søren Gjesse, 2013/06/12 08:34:00]

If it is not masked it will be send directly on the socket and checked there.
The tests should cover this as data send from the server side is not masked.

       header[1] |= 1 << 7;
       var maskBytes = _IOCrypto.getRandomBytes(4);
       header.setRange(index, index + 4, maskBytes);
       index += 4;
       if (data != null) {
         var list = new Uint8List(data.length);

[Anders Johnsen, 2013/06/12 06:13:58]

If we check if it's a string here, we could just assign data to list in that
case.

[Søren Gjesse, 2013/06/12 08:34:00]

Good point. Done.

-        for (int i = 0; i < data.length; i++) {
-          list[i] = data[i] ^ maskBytes[i % 4];
+        if (data is Uint8List) {
+          for (int i = 0; i < data.length; i++) {
+            list[i] = data[i] ^ maskBytes[i % 4];
+          }
+        } else {
+          for (int i = 0; i < data.length; i++) {
+            if (data[i] < 0 || 255 < data[0]) {

[Anders Johnsen, 2013/06/12 06:13:58]

This reads odd, as you have two '<'. Also, second data index should be data[i].

[Søren Gjesse, 2013/06/12 08:34:00]

This reads nicely :-) data[i] is outside the interval [0..255].

Fixed data[0].

+              throw new ArgumentError("Illegal byte value ${data[0]}");
+            }
+            list[i] = data[i] ^ maskBytes[i % 4];
+          }
         }
         data = list;
       }
     }
     assert(index == headerSize);
     if (data == null) {
       return [header];
     } else {
       return [header, data];
     }
@@ skipping 249 matching lines @@
            (code < WebSocketStatus.NORMAL_CLOSURE ||
             code == WebSocketStatus.RESERVED_1004 ||
             code == WebSocketStatus.NO_STATUS_RECEIVED ||
             code == WebSocketStatus.ABNORMAL_CLOSURE ||
             (code > WebSocketStatus.INTERNAL_SERVER_ERROR &&
              code < WebSocketStatus.RESERVED_1015) ||
             (code >= WebSocketStatus.RESERVED_1015 &&
              code < 3000));
   }
 }