mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: sanitize invalid custom protocol headers (#18854)

Browse source
This commit is contained in:
Micha Hanselmann 2019-06-21 09:23:57 -07:00 • committed by Shelley Vohr
parent 236d552d6a
commit 81497c7f2e
2 changed files with 27 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
shell/browser/net/url_request_async_asar_job.cc
View file

@ -38,6 +38,20 @@ void BeforeStartInUI(base::WeakPtr<URLRequestAsyncAsarJob> job,
error = net::ERR_NOT_IMPLEMENTED;
}
// sanitize custom headers
if (request_options && request_options->is_dict()) {
const base::Value* headersDict = request_options->FindDictKey("headers");
if (headersDict) {
for (const auto& iter : headersDict->DictItems()) {
if (!iter.second.is_string()) {
args->ThrowError("Value of '" + iter.first +
"' header has to be a string");
return;
}
}
}
}
base::PostTaskWithTraits(
FROM_HERE, {content::BrowserThread::IO},
base::BindOnce(&URLRequestAsyncAsarJob::StartAsync, job,