Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Be strict on request's Content-Type #829

Merged
merged 1 commit into from
Nov 9, 2018
Merged

Be strict on request's Content-Type #829

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 27 additions & 18 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,18 +438,7 @@ each other by 0x2C 0x20, in order.
<dl class=switch>
<dt>`<code>accept</code>`
<dd>
<p>If one of the following is true

<ul class=brief>
<li><p><var>value</var> contains a byte less than 0x20 that is not 0x09 HT
<li><p><var>value</var> contains 0x22 ("), 0x28 (left parenthesis), 0x29 (right parenthesis),
0x3A (:), 0x3C (&lt;), 0x3E (>), 0x3F (?), 0x40 (@), 0x5B ([), 0x5C (\), 0x5D (]), 0x7B ({),
0x7D (}), or 0x7F DEL
</ul>
<!-- Delimiters from https://tools.ietf.org/html/rfc7230#section-3.2.6 except for ,/;= and
including DEL -->

<p>then return false.
<p>If <var>value</var> contains a <a>CORS-unsafe request-header byte</a>, then return false.

<dt>`<code>accept-language</code>`
<dt>`<code>content-language</code>`
Expand All @@ -460,12 +449,20 @@ each other by 0x2C 0x20, in order.
<!-- Maybe give Infra "byte-alphanumeric"? -->

<dt>`<code>content-type</code>`
<dd><p>If <var>value</var>, <a lt="extract header values">once extracted</a>, does not have a
MIME type (ignoring parameters) that is <code>application/x-www-form-urlencoded</code>,
<code>multipart/form-data</code>, or <code>text/plain</code>, then return false.
<!-- XXX * needs better xref
* ignoring parameters has been the standard for a long time now
* interesting test: "Content-Type: text/plain;" -->
<dd>
<ol>
<li><p>If <var>value</var> contains a <a>CORS-unsafe request-header byte</a>, then return
false.

<li><p>Let <var>mimeType</var> be the result of <a lt="parse a MIME type">parsing</a>
<var>value</var>.

<li><p>If <var>mimeType</var> is falure, then return false.

<li><p>If <var>mimeType</var>'s <a for="MIME type">essence</a> is not
"<code>application/x-www-form-urlencoded</code>", "<code>multipart/form-data</code>", or
"<code>text/plain</code>", then return false.
</ol>
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be good to add a note here illustrating that this is very different from how response Content-Type is parsed, but maybe that should wait until that's actually defined properly.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll do this as part of #529.


<dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#dpr>DPR</a></code>`
<dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#downlink>Downlink</a></code>`
Expand All @@ -488,6 +485,18 @@ each other by 0x2C 0x20, in order.
<p class="note">There are limited exceptions to the `<code>Content-Type</code>` header safelist, as
documented in <a href=#cors-protocol-exceptions>CORS protocol exceptions</a>.

<p>A <dfn>CORS-unsafe request-header byte</dfn> is a byte <var>byte</var> for which one of the
following is true:

<ul class=brief>
<li><p><var>byte</var> is less than 0x20 and is not 0x09 HT
<li><p><var>byte</var> is 0x22 ("), 0x28 (left parenthesis), 0x29 (right parenthesis), 0x3A (:),
0x3C (&lt;), 0x3E (>), 0x3F (?), 0x40 (@), 0x5B ([), 0x5C (\), 0x5D (]), 0x7B ({), 0x7D (}), or
0x7F DEL.
<!-- Delimiters from https://tools.ietf.org/html/rfc7230#section-3.2.6 except for ,/;= and
including DEL -->
</ul>

<p>The <dfn noexport>CORS-unsafe request-header names</dfn>, given a <a for=/>header list</a>
<var>headers</var>, are determined as follows:

Expand Down