From f609f41a7cb32114277f61c9a527d6cac71af754 Mon Sep 17 00:00:00 2001 From: Stephen Halter Date: Tue, 31 May 2016 15:53:20 -0700 Subject: [PATCH] Reject non-ASCII chars in headers in addition to control chars --- .../Http/FrameHeaders.cs | 4 ++-- .../FrameResponseHeadersTests.cs | 17 ++++++++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/src/Microsoft.AspNetCore.Server.Kestrel/Http/FrameHeaders.cs b/src/Microsoft.AspNetCore.Server.Kestrel/Http/FrameHeaders.cs index 4bba23dbd3..ee7c1c562b 100644 --- a/src/Microsoft.AspNetCore.Server.Kestrel/Http/FrameHeaders.cs +++ b/src/Microsoft.AspNetCore.Server.Kestrel/Http/FrameHeaders.cs @@ -224,9 +224,9 @@ namespace Microsoft.AspNetCore.Server.Kestrel.Http { foreach (var ch in headerCharacters) { - if (ch < 0x20) + if (ch < 0x20 || ch > 0x7E) { - throw new InvalidOperationException(string.Format("Invalid control character in header: 0x{0:X2}", (byte)ch)); + throw new InvalidOperationException(string.Format("Invalid non-ASCII or control character in header: 0x{0:X4}", (ushort)ch)); } } } diff --git a/test/Microsoft.AspNetCore.Server.KestrelTests/FrameResponseHeadersTests.cs b/test/Microsoft.AspNetCore.Server.KestrelTests/FrameResponseHeadersTests.cs index fa5f446267..3118a008f1 100644 --- a/test/Microsoft.AspNetCore.Server.KestrelTests/FrameResponseHeadersTests.cs +++ b/test/Microsoft.AspNetCore.Server.KestrelTests/FrameResponseHeadersTests.cs @@ -49,12 +49,27 @@ namespace Microsoft.AspNetCore.Server.KestrelTests [InlineData("Server\r", "Data")] [InlineData("Ser\0ver", "Data")] [InlineData("Server\r\n", "Data")] + [InlineData("\u0000Server", "Data")] + [InlineData("Server", "Data\u0000")] [InlineData("\u001FServer", "Data")] [InlineData("Unknown-Header\r\n", "Data")] [InlineData("\0Unknown-Header", "Data")] [InlineData("Unknown\r-Header", "Data")] [InlineData("Unk\nown-Header", "Data")] - public void AddingControlCharactersToHeadersThrows(string key, string value) + [InlineData("Server", "Da\u007Fta")] + [InlineData("Unknown\u007F-Header", "Data")] + [InlineData("Ser\u0080ver", "Data")] + [InlineData("Server", "Da\u0080ta")] + [InlineData("Unknown\u0080-Header", "Data")] + [InlineData("Ser™ver", "Data")] + [InlineData("Server", "Da™ta")] + [InlineData("Unknown™-Header", "Data")] + [InlineData("Ser™ver", "Data")] + [InlineData("šerver", "Data")] + [InlineData("Server", "Dašta")] + [InlineData("Unknownš-Header", "Data")] + [InlineData("Seršver", "Data")] + public void AddingControlOrNonAsciiCharactersToHeadersThrows(string key, string value) { var responseHeaders = new FrameResponseHeaders();