1453318 - Disallow responses when a response header value contains 0x00

Status: RESOLVED FIXED

(Core :: Networking: HTTP, enhancement, P3)

Description

[Anne (:annevk)]

In bug 1277019 we fixed an issue whereby we dropped part of an header value if the header value included a 0x00. This fixed several failures in the CORS test suite.

Based on discussion with Google in https://github.com/whatwg/xhr/issues/165 I'd like to suggest that when we encounter a 0x00 in a header value we consider it a network error, rather than an acceptable response.

(Network response header values are the only place where 0x00 can occur at the moment with respect to headers and Edge already does not seem to handle them whatsoever (results in infinite loading). Thus the discussion concluded that it would best if we tried to outlaw them there for consistency and somewhat closer alignment to the RFC.)

I adjusted the test added in that bug here: https://github.com/w3c/web-platform-tests/pull/10424.

Comment 1

[Anne (:annevk)]

More tests at https://github.com/web-platform-tests/wpt/pull/21019.

Comment 2

[Thomas Wisniewski [:twisniewski]]

https://treeherder.mozilla.org/jobs?repo=try&revision=b76c159a1b3d15e2210e1c9a1467ca10a969bec1

Comment 3

[Thomas Wisniewski [:twisniewski]]

Attachment: Bug 1453318 - Disallow responses when a response header value contains 0x00; r?kershaw,sunil

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a86a27857ef6
Disallow responses when a response header value contains 0x00; r=kershaw,sunil,necko-reviewers

Comment 5

[Iulian Moraru]

Backed out for causing multiple wpt failures.

• Push with failures

• Failure log

• Failure log on cookies/name/name-ctl.html

• Failure log on cookies/value/value-ctl.html

• Backout link

Comment 6

[Thomas Wisniewski [:twisniewski]]

How rare to be backed out for passing more web platform tests than expected. I'll push the patch again with the test metadata updated appropriately.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cb9938ab6bca
Disallow responses when a response header value contains 0x00; r=kershaw,sunil,necko-reviewers

Comment 8

[Cosmin Sabou [:CosminS]]

Backed out for causing cookies related failures.

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&resultStatus=testfailed%2Cbusted%2Cexception%2Cusercancel&revision=6d877fdb9a1e892fe6528a26aab81b53cfae55c5&searchStr=wpt&selectedTaskRun=aOdSzcVTSKaQvmWA3AQeeQ.0

Failure logs:

• https://treeherder.mozilla.org/logviewer?job_id=425124521&repo=autoland
• https://treeherder.mozilla.org/logviewer?job_id=425125764&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/f4f211db29dd3b8d9a15bdede2a23dc22033af73

Comment 9

[Thomas Wisniewski [:twisniewski]]

I suspect that I just didn't quite get the test-annotations right in the last patch. I'll do my own try-run today to check, then re-land.

https://treeherder.mozilla.org/jobs?repo=try&revision=cff7d8f7f2447d641124e896d0d620d46c5ab3b7

Comment 10

[Thomas Wisniewski [:twisniewski]]

Ok, the try-run seems clean, so let's try landing one more time.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8c3b9498c831
Disallow responses when a response header value contains 0x00; r=kershaw,sunil,necko-reviewers

Comment 12

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/8c3b9498c831