Implement port-based blocking

servo · Dec 21, 2016 · a56a7ba · a56a7ba
1 parent 71b68ea
commit a56a7ba
Show file tree

Hide file tree

Showing 4 changed files with 113 additions and 0 deletions.
diff --git a/components/net/fetch/methods.rs b/components/net/fetch/methods.rs
@@ -143,6 +143,18 @@ pub fn main_fetch(request: Rc<Request>,
 
     // Step 5
     // TODO this step (CSP port/content blocking)
+    if let Some(port) = request.url().port() {
+        let is_ftp = request.url().scheme() == "ftp" && (port == 20 || port == 21);
+        static BAD_PORTS: [u16; 64] = [1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42,
+                                       43, 53, 77, 79, 87, 95, 101, 102, 103, 104, 109, 110, 111,
+                                       113, 115, 117, 119, 123, 135, 139, 143, 179, 389, 465, 512,
+                                       513, 514, 515, 526, 530, 531, 532, 540, 556, 563, 587, 601,
+                                       636, 993, 995, 2049, 3659, 4045, 6000, 6665, 6666, 6667,
+                                       6668, 6669];
+        if !is_ftp && BAD_PORTS.binary_search(&port).is_ok() {
+            response = Some(Response::network_error(NetworkError::Internal("Request attempted on bad port".into())));
+        }
+    }
 
     // Step 6
     // TODO this step (referrer policy)

diff --git a/tests/unit/net/fetch.rs b/tests/unit/net/fetch.rs
@@ -23,6 +23,7 @@ use hyper::status::StatusCode;
 use hyper::uri::RequestUri;
 use msg::constellation_msg::TEST_PIPELINE_ID;
 use net::fetch::cors_cache::CorsCache;
+use net_traits::NetworkError;
 use net_traits::ReferrerPolicy;
 use net_traits::request::{Origin, RedirectMode, Referrer, Request, RequestMode};
 use net_traits::response::{CacheState, Response, ResponseBody, ResponseType};
@@ -59,6 +60,18 @@ fn test_fetch_response_is_not_network_error() {
     }
 }
 
+#[test]
+fn test_fetch_on_bad_port_is_network_error() {
+    let url = ServoUrl::parse("http://www.example.org:6667").unwrap();
+    let origin = Origin::Origin(url.origin());
+    let request = Request::new(url, Some(origin), false, None);
+    *request.referrer.borrow_mut() = Referrer::NoReferrer;
+    let fetch_response = fetch(request, None);
+    assert!(fetch_response.is_network_error());
+    let fetch_error = fetch_response.get_network_error().unwrap();
+    assert!(fetch_error == &NetworkError::Internal("Request attempted on bad port".into()))
+}
+
 #[test]
 fn test_fetch_response_body_matches_const_message() {
     static MESSAGE: &'static [u8] = b"Hello World!";

diff --git a/tests/wpt/metadata/MANIFEST.json b/tests/wpt/metadata/MANIFEST.json
@@ -39719,6 +39719,12 @@
             "url": "/cssom/shorthand-serialization.html"
           }
         ],
+        "fetch/api/request/request-bad-port.html": [
+          {
+            "path": "fetch/api/request/request-bad-port.html",
+            "url": "/fetch/api/request/request-bad-port.html"
+          }
+        ],
         "html/semantics/forms/form-submission-0/submit-entity-body.html": [
           {
             "path": "html/semantics/forms/form-submission-0/submit-entity-body.html",

diff --git a/tests/wpt/web-platform-tests/fetch/api/request/request-bad-port.html b/tests/wpt/web-platform-tests/fetch/api/request/request-bad-port.html
@@ -0,0 +1,82 @@
+<!doctype html>
+<meta charset="utf-8">
+<title></title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+    // list of bad ports according to
+    // https://fetch.spec.whatwg.org/#port-blocking
+    var BLOCKED_PORTS_LIST = [
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // ftp-data
+        21,   // ftp
+        22,   // ssh
+        23,   // telnet
+        25,   // smtp
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // pop2
+        110,  // pop3
+        111,  // sunrpc
+        113,  // auth
+        115,  // sftp
+        117,  // uucp-path
+        119,  // nntp
+        123,  // ntp
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // imap2
+        179,  // bgp
+        389,  // ldap
+        465,  // smtp+ssl
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // chat
+        532,  // netnews
+        540,  // uucp
+        556,  // remotefs
+        563,  // nntp+ssl
+        587,  // smtp
+        601,  // syslog-conn
+        636,  // ldap+ssl
+        993,  // imap+ssl
+        995,  // pop3+ssl
+        2049, // nfs
+        3659, // apple-sasl
+        4045, // lockd
+        6000, // x11
+        6665, // irc (alternate)
+        6666, // irc (alternate)
+        6667, // irc (default)
+        6668, // irc (alternate)
+        6669, // irc (alternate)
+    ];
+
+    BLOCKED_PORTS_LIST.map(function(a){
+    	promise_test(function(t){
+            return promise_rejects(t, new TypeError(), fetch("http://example.com:" + a))
+        }, 'Request on bad port ' + a + ' should throw TypeError.');
+    });
+</script>