about summary refs log tree commit homepage
diff options
context:
space:
mode:
authorEric Wong <normalperson@yhbt.net>2011-07-12 23:52:33 +0000
committerEric Wong <normalperson@yhbt.net>2011-07-13 23:51:57 +0000
commit83f72773b7242d86263a18950fca7c8101d7038d (patch)
treecac5c69c36b95543d5f46621d172cb2232c1b315
parentcc63e2ee54b4113c40631214618f51c9ef867a91 (diff)
downloadunicorn-83f72773b7242d86263a18950fca7c8101d7038d.tar.gz
RFC 2616 doesn't appear to allow most CTL bytes even though
Mongrel always did.  Rack::Lint disallows 0..31, too, though we
allow "\t" (HT, 09) since it's LWS and allowed by RFC 2616.
-rw-r--r--ext/unicorn_http/unicorn_http_common.rl5
-rw-r--r--test/unit/test_http_parser.rb18
2 files changed, 21 insertions, 2 deletions
diff --git a/ext/unicorn_http/unicorn_http_common.rl b/ext/unicorn_http/unicorn_http_common.rl
index cf93fec..cc1d455 100644
--- a/ext/unicorn_http/unicorn_http_common.rl
+++ b/ext/unicorn_http/unicorn_http_common.rl
@@ -20,6 +20,7 @@
   pchar = (uchar | ":" | "@" | "&" | "=" | "+");
   tspecials = ("(" | ")" | "<" | ">" | "@" | "," | ";" | ":" | "\\" | "\"" | "/" | "[" | "]" | "?" | "=" | "{" | "}" | " " | "\t");
   lws = (" " | "\t");
+  content = ((any -- CTL) | lws);
 
 # elements
   token = (ascii -- (CTL | tspecials));
@@ -50,9 +51,9 @@
 
   field_name = ( token -- ":" )+ >start_field $snake_upcase_field %write_field;
 
-  field_value = any* >start_value %write_value;
+  field_value = content* >start_value %write_value;
 
-  value_cont = lws+ any* >start_value %write_cont_value;
+  value_cont = lws+ content* >start_value %write_cont_value;
 
   message_header = ((field_name ":" lws* field_value)|value_cont) :> CRLF;
   chunk_ext_val = token*;
diff --git a/test/unit/test_http_parser.rb b/test/unit/test_http_parser.rb
index 27196db..41055b0 100644
--- a/test/unit/test_http_parser.rb
+++ b/test/unit/test_http_parser.rb
@@ -813,6 +813,24 @@ class HttpParserTest < Test::Unit::TestCase
     assert_equal "hello\t world", parser.env["HTTP_X_SPACE"]
   end
 
+  def test_null_byte_header
+    parser = HttpParser.new
+    get = "GET / HTTP/1.1\r\nHost: \0\r\n\r\n"
+    assert_raises(HttpParserError) { parser.add_parse(get) }
+  end
+
+  def test_null_byte_in_middle
+    parser = HttpParser.new
+    get = "GET / HTTP/1.1\r\nHost: hello\0world\r\n\r\n"
+    assert_raises(HttpParserError) { parser.add_parse(get) }
+  end
+
+  def test_null_byte_at_end
+    parser = HttpParser.new
+    get = "GET / HTTP/1.1\r\nHost: hello\0\r\n\r\n"
+    assert_raises(HttpParserError) { parser.add_parse(get) }
+  end
+
   def test_empty_header
     parser = HttpParser.new
     get = "GET / HTTP/1.1\r\nHost:  \r\n\r\n"