1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
<!doctype html>
<html>
<head>
<title>XMLHttpRequest: setRequestHeader() - headers that are forbidden</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<link rel="help" href="https://xhr.spec.whatwg.org/#the-setrequestheader()-method">
</head>
<body>
<div id="log"></div>
<script>
test(function() {
var client = new XMLHttpRequest()
client.open("POST", "resources/inspect-headers.py?filter_value=TEST", false)
client.setRequestHeader("Accept-Charset", "TEST")
client.setRequestHeader("Accept-Encoding", "TEST")
client.setRequestHeader("Connection", "TEST")
client.setRequestHeader("Content-Length", "TEST")
client.setRequestHeader("Cookie", "TEST")
client.setRequestHeader("Cookie2", "TEST")
client.setRequestHeader("Date", "TEST")
client.setRequestHeader("DNT", "TEST")
client.setRequestHeader("Expect", "TEST")
client.setRequestHeader("Host", "TEST")
client.setRequestHeader("Keep-Alive", "TEST")
client.setRequestHeader("Referer", "TEST")
client.setRequestHeader("TE", "TEST")
client.setRequestHeader("Trailer", "TEST")
client.setRequestHeader("Transfer-Encoding", "TEST")
client.setRequestHeader("Upgrade", "TEST")
client.setRequestHeader("Via", "TEST")
client.setRequestHeader("Proxy-", "TEST")
client.setRequestHeader("Proxy-LIES", "TEST")
client.setRequestHeader("Proxy-Authorization", "TEST")
client.setRequestHeader("Sec-", "TEST")
client.setRequestHeader("Sec-X", "TEST")
client.send(null)
assert_equals(client.responseText, "")
})
test (function() {
let forbiddenMethods = [
"TRACE",
"TRACK",
"CONNECT",
"trace",
"track",
"connect",
"trace,",
"GET,track ",
" connect",
];
let overrideHeaders = [
"x-http-method-override",
"x-http-method",
"x-method-override",
"X-HTTP-METHOD-OVERRIDE",
"X-HTTP-METHOD",
"X-METHOD-OVERRIDE",
];
for (forbiddenMethod of forbiddenMethods) {
for (overrideHeader of overrideHeaders) {
var client = new XMLHttpRequest()
client.open("POST",
`resources/inspect-headers.py?filter_value=${forbiddenMethod}`, false)
client.setRequestHeader(overrideHeader, forbiddenMethod)
client.send(null)
assert_equals(client.responseText, "")
}
}
let permittedValues = [
"GETTRACE",
"GET",
"\",TRACE\",",
];
for (permittedValue of permittedValues) {
for (overrideHeader of overrideHeaders) {
var client = new XMLHttpRequest()
client.open("POST",
`resources/inspect-headers.py?filter_name=${overrideHeader}`, false)
client.setRequestHeader(overrideHeader, permittedValue)
client.send(null)
assert_equals(client.responseText, overrideHeader + ": " + permittedValue + "\n")
}
}
})
</script>
</body>
</html>
|
