Validate headers when added to HttpHeaders.

sdk/lib/io/http_headers.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 class _HttpHeaders implements HttpHeaders {
   final Map<String, List<String>> _headers;
   final String protocolVersion;
 
@@ skipping 24 matching lines @@
     List<String> values = _headers[name];
     if (values == null) return null;
     if (values.length > 1) {
       throw new HttpException("More than one value for header $name");
     }
     return values[0];
   }
 
   void add(String name, value) {
     _checkMutable();
-    _addAll(name.toLowerCase(), value);
+    _addAll(_validateField(name), value);
   }
 
   void _addAll(String name, value) {

[Søren Gjesse, 2014/07/04 09:24:54]

Add

assert(name == _validateField(name));

here as well.

[Anders Johnsen, 2014/07/04 11:03:49]

Done.

     if (value is List) {

[Søren Gjesse, 2014/07/04 09:24:54]

Btw. shouldn't this be just Iterable?

[Anders Johnsen, 2014/07/04 11:03:49]

Yeah.

-      value.forEach((v) => _add(name, v));
+      value.forEach((v) => _add(name, _validateValue(v)));
     } else {
-      _add(name, value);
+      _add(name, _validateValue(value));
     }
   }
 
   void set(String name, Object value) {
     _checkMutable();
-    name = name.toLowerCase();
+    name = _validateField(name);
     _headers.remove(name);
     _addAll(name, value);
   }
 
   void remove(String name, Object value) {
     _checkMutable();
-    name = name.toLowerCase();
+    name = _validateField(name);
+    value = _validateValue(value);
     List<String> values = _headers[name];
     if (values != null) {
       int index = values.indexOf(value);
       if (index != -1) {
         values.removeRange(index, index + 1);
       }
       if (values.length == 0) _headers.remove(name);
     }
   }
 
   void removeAll(String name) {
     _checkMutable();
-    name = name.toLowerCase();
+    name = _validateField(name);
     _headers.remove(name);
   }
 
   void forEach(void f(String name, List<String> values)) {
     _headers.forEach(f);
   }
 
   void noFolding(String name) {
     if (_noFoldingHeaders == null) _noFoldingHeaders = new List<String>();
     _noFoldingHeaders.add(name);
@@ skipping 154 matching lines @@
     }
   }
 
   void set contentType(ContentType contentType) {
     _checkMutable();
     _set(HttpHeaders.CONTENT_TYPE, contentType.toString());
   }
 
   // [name] must be a lower-case version of the name.
   void _add(String name, value) {
-    assert(name == name.toLowerCase());
+    assert(name == _validateField(name));
     // Use the length as index on what method to call. This is notable
     // faster than computing hash and looking up in a hash-map.
     switch (name.length) {
       case 4:
         if (HttpHeaders.DATE == name) {
           _addDate(name, value);
           return;
         }
         if (HttpHeaders.HOST == name) {
           _addHost(name, value);
@@ skipping 128 matching lines @@
   }
 
   void _addValue(String name, Object value) {
     List<String> values = _headers[name];
     if (values == null) {
       values = new List<String>();
       _headers[name] = values;
     }
     if (value is DateTime) {
       values.add(HttpDate.format(value));
+    } else if (value is String) {
+      values.add(value);
     } else {
-      values.add(value.toString());
+      values.add(_validateValue(value.toString()));
     }
   }
 
   void _set(String name, String value) {
-    assert(name == name.toLowerCase());
+    assert(name == _validateField(name));
     List<String> values = new List<String>();
     _headers[name] = values;
     values.add(value);
   }
 
   _checkMutable() {
     if (!_mutable) throw new HttpException("HTTP headers are not mutable");
   }
 
   _updateHostHeader() {
@@ skipping 136 matching lines @@
           continue;
         }
       }
     }
     List<String> values = _headers[HttpHeaders.COOKIE];
     if (values != null) {
       values.forEach((headerValue) => parseCookieString(headerValue));
     }
     return cookies;
   }
+
+  static String _validateField(String field) {
+    for (var i = 0; i < field.length; i++) {
+      if (!_HttpParser._isTokenChar(field.codeUnitAt(i))) {
+        throw new FormatException(
+            "Invalid HTTP header field: ${JSON.encode(field)}");

[Søren Gjesse, 2014/07/04 09:24:54]

Lets be precise: field -> field name

[Anders Johnsen, 2014/07/04 11:03:49]

Done.

+      }
+    }
+    return field.toLowerCase();
+  }
+
+  static _validateValue(value) {
+    if (value is! String) return value;
+    for (var i = 0; i < value.length; i++) {
+      if (!_HttpParser._isValueChar(value.codeUnitAt(i))) {
+        throw new FormatException(
+            "Invalid HTTP header value: ${JSON.encode(value)}");

[Søren Gjesse, 2014/07/04 09:24:54]

value -> field value

[Anders Johnsen, 2014/07/04 11:03:50]

Done.

+      }
+    }
+    return value;
+  }
 }
 
 
 class _HeaderValue implements HeaderValue {
   String _value;
   Map<String, String> _parameters;
   Map<String, String> _unmodifiableParameters;
 
   _HeaderValue([String this._value = "", Map<String, String> parameters]) {
     if (parameters != null) {
@@ skipping 333 matching lines @@
             (codeUnit >= 0x23 && codeUnit <= 0x2B) ||
             (codeUnit >= 0x2D && codeUnit <= 0x3A) ||
             (codeUnit >= 0x3C && codeUnit <= 0x5B) ||
             (codeUnit >= 0x5D && codeUnit <= 0x7E))) {
         throw new FormatException(
             "Invalid character in cookie value, code unit: '$codeUnit'");
       }
     }
   }
 }