Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-02 20:20:14 +01:00
Code Issues Projects Releases Packages Wiki Activity

Implement port-based blocking

Browse source
This commit is contained in:
Nick Price 2016-12-20 13:16:03 -05:00
parent 71b68ea0de
commit a56a7baa9a
4 changed files with 113 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
components/net/fetch/methods.rs
View file

@ -143,6 +143,18 @@ pub fn main_fetch(request: Rc<Request>,
// Step 5
// TODO this step (CSP port/content blocking)
if let Some(port) = request.url().port() {
let is_ftp = request.url().scheme() == "ftp" && (port == 20 || port == 21);
static BAD_PORTS: [u16; 64] = [1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42,
43, 53, 77, 79, 87, 95, 101, 102, 103, 104, 109, 110, 111,
113, 115, 117, 119, 123, 135, 139, 143, 179, 389, 465, 512,
513, 514, 515, 526, 530, 531, 532, 540, 556, 563, 587, 601,
636, 993, 995, 2049, 3659, 4045, 6000, 6665, 6666, 6667,
6668, 6669];
if !is_ftp && BAD_PORTS.binary_search(&port).is_ok() {
response = Some(Response::network_error(NetworkError::Internal("Request attempted on bad port".into())));
}
}
// Step 6
// TODO this step (referrer policy)

13
tests/unit/net/fetch.rs
View file

@ -23,6 +23,7 @@ use hyper::status::StatusCode;
use hyper::uri::RequestUri;
use msg::constellation_msg::TEST_PIPELINE_ID;
use net::fetch::cors_cache::CorsCache;
use net_traits::NetworkError;
use net_traits::ReferrerPolicy;
use net_traits::request::{Origin, RedirectMode, Referrer, Request, RequestMode};
use net_traits::response::{CacheState, Response, ResponseBody, ResponseType};
@ -59,6 +60,18 @@ fn test_fetch_response_is_not_network_error() {
}
}
#[test]
fn test_fetch_on_bad_port_is_network_error() {
let url = ServoUrl::parse("http://www.example.org:6667").unwrap();
let origin = Origin::Origin(url.origin());
let request = Request::new(url, Some(origin), false, None);
*request.referrer.borrow_mut() = Referrer::NoReferrer;
let fetch_response = fetch(request, None);
assert!(fetch_response.is_network_error());
let fetch_error = fetch_response.get_network_error().unwrap();
assert!(fetch_error == &NetworkError::Internal("Request attempted on bad port".into()))
}
#[test]
fn test_fetch_response_body_matches_const_message() {
static MESSAGE: &'static [u8] = b"Hello World!";

6
tests/wpt/metadata/MANIFEST.json
View file

@ -39719,6 +39719,12 @@
"url": "/cssom/shorthand-serialization.html"
}
],
"fetch/api/request/request-bad-port.html": [
{
"path": "fetch/api/request/request-bad-port.html",
"url": "/fetch/api/request/request-bad-port.html"
}
],
"html/semantics/forms/form-submission-0/submit-entity-body.html": [
{
"path": "html/semantics/forms/form-submission-0/submit-entity-body.html",

82
tests/wpt/web-platform-tests/fetch/api/request/request-bad-port.html Normal file
View file

@ -0,0 +1,82 @@
<!doctype html>
<meta charset="utf-8">
<title></title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script>
// list of bad ports according to
// https://fetch.spec.whatwg.org/#port-blocking
var BLOCKED_PORTS_LIST = [
1, // tcpmux
7, // echo
9, // discard
11, // systat
13, // daytime
15, // netstat
17, // qotd
19, // chargen
20, // ftp-data
21, // ftp
22, // ssh
23, // telnet
25, // smtp
37, // time
42, // name
43, // nicname
53, // domain
77, // priv-rjs
79, // finger
87, // ttylink
95, // supdup
101, // hostriame
102, // iso-tsap
103, // gppitnp
104, // acr-nema
109, // pop2
110, // pop3
111, // sunrpc
113, // auth
115, // sftp
117, // uucp-path
119, // nntp
123, // ntp
135, // loc-srv / epmap
139, // netbios
143, // imap2
179, // bgp
389, // ldap
465, // smtp+ssl
512, // print / exec
513, // login
514, // shell
515, // printer
526, // tempo
530, // courier
531, // chat
532, // netnews
540, // uucp
556, // remotefs
563, // nntp+ssl
587, // smtp
601, // syslog-conn
636, // ldap+ssl
993, // imap+ssl
995, // pop3+ssl
2049, // nfs
3659, // apple-sasl
4045, // lockd
6000, // x11
6665, // irc (alternate)
6666, // irc (alternate)
6667, // irc (default)
6668, // irc (alternate)
6669, // irc (alternate)
];
BLOCKED_PORTS_LIST.map(function(a){
promise_test(function(t){
return promise_rejects(t, new TypeError(), fetch("http://example.com:" + a))
}, 'Request on bad port ' + a + ' should throw TypeError.');
});
</script>