Commit 3d69ad1
src: make Sec-WebSocket-Key check case-insensitive
Current case sensitive comparison is breaking netty-based WS clients.
replace strncmp with strncasecmp
Fixes: #7247
PR-URL: #7248
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>1 parent 88b2aa3 commit 3d69ad1
4 files changed
Lines changed: 34 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,4 +1,6 @@ | |||
| 1 | 1 | #include "inspector_socket.h" | |
| 2 | + #include "util.h" | ||
| 3 | + #include "util-inl.h" | ||
| 2 | 4 | ||
| 3 | 5 | #define NODE_WANT_INTERNALS 1 | |
| 4 | 6 | #include "base64.h" | |
@@ -445,9 +447,10 @@ static int header_value_cb(http_parser* parser, const char* at, size_t length) { | |||
| 445 | 447 | struct http_parsing_state_s* state = (struct http_parsing_state_s*) | |
| 446 | 448 | (reinterpret_cast<inspector_socket_t*>(parser->data))->http_parsing_state; | |
| 447 | 449 | state->parsing_value = true; | |
| 448 | - if (state->current_header && strncmp(state->current_header, | ||
| 449 | - SEC_WEBSOCKET_KEY_HEADER, | ||
| 450 | - sizeof(SEC_WEBSOCKET_KEY_HEADER)) == 0) { | ||
| 450 | + if (state->current_header && | ||
| 451 | + node::StringEqualNoCaseN(state->current_header, | ||
| 452 | + SEC_WEBSOCKET_KEY_HEADER, | ||
| 453 | + sizeof(SEC_WEBSOCKET_KEY_HEADER))) { | ||
| 451 | 454 | append(&state->ws_key, at, length); | |
| 452 | 455 | } | |
| 453 | 456 | return 0; | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -219,6 +219,16 @@ bool StringEqualNoCase(const char* a, const char* b) { | |||
| 219 | 219 | return false; | |
| 220 | 220 | } | |
| 221 | 221 | ||
| 222 | + bool StringEqualNoCaseN(const char* a, const char* b, size_t length) { | ||
| 223 | + for (size_t i = 0; i < length; i++) { | ||
| 224 | + if (ToLower(a[i]) != ToLower(b[i])) | ||
| 225 | + return false; | ||
| 226 | + if (a[i] == '\0') | ||
| 227 | + return true; | ||
| 228 | + } | ||
| 229 | + return true; | ||
| 230 | + } | ||
| 231 | + | ||
| 222 | 232 | } // namespace node | |
| 223 | 233 | ||
| 224 | 234 | #endif // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -206,6 +206,9 @@ inline char ToLower(char c); | |||
| 206 | 206 | // strcasecmp() is locale-sensitive. Use StringEqualNoCase() instead. | |
| 207 | 207 | inline bool StringEqualNoCase(const char* a, const char* b); | |
| 208 | 208 | ||
| 209 | + // strncasecmp() is locale-sensitive. Use StringEqualNoCaseN() instead. | ||
| 210 | + inline bool StringEqualNoCaseN(const char* a, const char* b, size_t length); | ||
| 211 | + | ||
| 209 | 212 | // Allocates an array of member type T. For up to kStackStorageSize items, | |
| 210 | 213 | // the stack is used, otherwise malloc(). | |
| 211 | 214 | template <typename T, size_t kStackStorageSize = 1024> | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -68,6 +68,21 @@ TEST(UtilTest, StringEqualNoCase) { | |||
| 68 | 68 | EXPECT_FALSE(StringEqualNoCase("equals", "equal")); | |
| 69 | 69 | } | |
| 70 | 70 | ||
| 71 | + TEST(UtilTest, StringEqualNoCaseN) { | ||
| 72 | + using node::StringEqualNoCaseN; | ||
| 73 | + EXPECT_FALSE(StringEqualNoCaseN("a", "b", strlen("a"))); | ||
| 74 | + EXPECT_TRUE(StringEqualNoCaseN("", "", strlen(""))); | ||
| 75 | + EXPECT_TRUE(StringEqualNoCaseN("equal", "equal", strlen("equal"))); | ||
| 76 | + EXPECT_TRUE(StringEqualNoCaseN("equal", "EQUAL", strlen("equal"))); | ||
| 77 | + EXPECT_TRUE(StringEqualNoCaseN("EQUAL", "EQUAL", strlen("equal"))); | ||
| 78 | + EXPECT_TRUE(StringEqualNoCaseN("equal", "equals", strlen("equal"))); | ||
| 79 | + EXPECT_FALSE(StringEqualNoCaseN("equal", "equals", strlen("equals"))); | ||
| 80 | + EXPECT_TRUE(StringEqualNoCaseN("equals", "equal", strlen("equal"))); | ||
| 81 | + EXPECT_FALSE(StringEqualNoCaseN("equals", "equal", strlen("equals"))); | ||
| 82 | + EXPECT_TRUE(StringEqualNoCaseN("abc\0abc", "abc\0efg", strlen("abcdefgh"))); | ||
| 83 | + EXPECT_FALSE(StringEqualNoCaseN("abc\0abc", "abcd\0efg", strlen("abcdefgh"))); | ||
| 84 | + } | ||
| 85 | + | ||
| 71 | 86 | TEST(UtilTest, ToLower) { | |
| 72 | 87 | using node::ToLower; | |
| 73 | 88 | EXPECT_EQ('0', ToLower('0')); | |
0 commit comments