103 lines
3.6 KiB
Diff
103 lines
3.6 KiB
Diff
From c73d875661b96789047dd5cdccff82f1f639924d Mon Sep 17 00:00:00 2001
|
|
From: Jan Odvarko <odvarko@gmail.com>
|
|
Date: Wed, 12 Feb 2020 11:52:30 +0000
|
|
Subject: [PATCH] Bug 1607742 - Escape method argument r=Gijs
|
|
|
|
Differential Revision: https://phabricator.services.mozilla.com/D60413
|
|
|
|
--HG--
|
|
extra : moz-landing-system : lando
|
|
---
|
|
devtools/client/shared/curl.js | 33 ++++++++++++++++++++++-----------
|
|
1 file changed, 22 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
|
|
index 30d8382..6d862be 100644
|
|
--- a/devtools/client/shared/curl.js
|
|
+++ b/devtools/client/shared/curl.js
|
|
@@ -59,6 +59,17 @@ const Curl = {
|
|
const utils = CurlUtils;
|
|
|
|
let command = ["curl"];
|
|
+ // Make sure to use the following helpers to sanitize arguments before execution.
|
|
+ const addParam = value => {
|
|
+ const safe = /^[a-zA-Z-]+$/.test(value) ? value : escapeString(value);
|
|
+ command.push(safe);
|
|
+ };
|
|
+
|
|
+ const addPostData = value => {
|
|
+ const safe = /^[a-zA-Z-]+$/.test(value) ? value : escapeString(value);
|
|
+ postData.push(safe);
|
|
+ };
|
|
+
|
|
const ignoredHeaders = new Set();
|
|
|
|
// The cURL command is expected to run on the same platform that Firefox runs
|
|
@@ -67,7 +78,7 @@ const Curl = {
|
|
utils.escapeStringWin : utils.escapeStringPosix;
|
|
|
|
// Add URL.
|
|
- command.push(escapeString(data.url));
|
|
+ addParam(data.url);
|
|
|
|
let postDataText = null;
|
|
const multipartRequest = utils.isMultipartRequest(data);
|
|
@@ -77,15 +88,15 @@ const Curl = {
|
|
if (utils.isUrlEncodedRequest(data) ||
|
|
["PUT", "POST", "PATCH"].includes(data.method)) {
|
|
postDataText = data.postDataText;
|
|
- postData.push("--data");
|
|
- postData.push(escapeString(utils.writePostDataTextParams(postDataText)));
|
|
+ addPostData("--data");
|
|
+ addPostData(utils.writePostDataTextParams(postDataText));
|
|
ignoredHeaders.add("content-length");
|
|
} else if (multipartRequest) {
|
|
postDataText = data.postDataText;
|
|
- postData.push("--data-binary");
|
|
+ addPostData("--data-binary");
|
|
const boundary = utils.getMultipartBoundary(data);
|
|
const text = utils.removeBinaryDataFromMultipartText(postDataText, boundary);
|
|
- postData.push(escapeString(text));
|
|
+ addPostData(text);
|
|
ignoredHeaders.add("content-length");
|
|
}
|
|
// curl generates the host header itself based on the given URL
|
|
@@ -95,13 +106,13 @@ const Curl = {
|
|
// For servers that supports HEAD.
|
|
// This will fetch the header of a document only.
|
|
if (data.method == "HEAD") {
|
|
- command.push("-I");
|
|
+ addParam("-I");
|
|
} else if (!(data.method == "GET" || data.method == "POST")) {
|
|
// Add method.
|
|
// For HEAD, GET and POST requests this is not necessary. GET is the
|
|
// default, if --data or --binary is added POST is used, -I implies HEAD.
|
|
- command.push("-X");
|
|
- command.push(data.method);
|
|
+ addParam("-X");
|
|
+ addParam(data.method);
|
|
}
|
|
|
|
// Add request headers.
|
|
@@ -113,14 +124,14 @@ const Curl = {
|
|
for (let i = 0; i < headers.length; i++) {
|
|
const header = headers[i];
|
|
if (header.name.toLowerCase() === "accept-encoding") {
|
|
- command.push("--compressed");
|
|
+ addParam("--compressed");
|
|
continue;
|
|
}
|
|
if (ignoredHeaders.has(header.name.toLowerCase())) {
|
|
continue;
|
|
}
|
|
- command.push("-H");
|
|
- command.push(escapeString(header.name + ": " + header.value));
|
|
+ addParam("-H");
|
|
+ addParam(header.name + ": " + header.value);
|
|
}
|
|
|
|
// Add post data.
|
|
--
|
|
2.23.0
|
|
|