Skip to content
Permalink
Browse files
8275534: com.sun.net.httpserver.BasicAuthenticator should check wheth…
…er "realm" is a quoted string

Reviewed-by: michaelm, dfuchs
  • Loading branch information
FrauBoes committed Nov 4, 2021
1 parent 3613ce7 commit ee499632586eabb3dab209645d5b9c781a09034b
Showing 6 changed files with 317 additions and 34 deletions.
@@ -391,7 +391,6 @@ public static URLPermission permissionForServer(URI uri,
return new URLPermission(urlString, actionStringBuilder.toString());
}


// ABNF primitives defined in RFC 7230
private static final boolean[] tchar = new boolean[256];
private static final boolean[] fieldvchar = new boolean[256];
@@ -411,7 +410,7 @@ public static URLPermission permissionForServer(URI uri,
}

/*
* Validates a RFC 7230 field-name.
* Validates an RFC 7230 field-name.
*/
public static boolean isValidName(String token) {
for (int i = 0; i < token.length(); i++) {
@@ -472,7 +471,7 @@ private static boolean isLoopbackLiteral(byte[] bytes) {
}

/*
* Validates a RFC 7230 field-value.
* Validates an RFC 7230 field-value.
*
* "Obsolete line folding" rule
*
@@ -495,7 +494,6 @@ public static boolean isValidValue(String token) {
return true;
}


@SuppressWarnings("removal")
public static int getIntegerNetProperty(String name, int defaultValue) {
return AccessController.doPrivileged((PrivilegedAction<Integer>) () ->
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2006, 2013, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2006, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -29,6 +29,7 @@
import java.util.Base64;
import java.util.Objects;

import static sun.net.httpserver.Utils.isQuotedStringContent;
import static java.nio.charset.StandardCharsets.UTF_8;

/**
@@ -49,11 +50,18 @@ public abstract class BasicAuthenticator extends Authenticator {
* The Basic authentication credentials (username and password) are decoded
* using the platform's {@link Charset#defaultCharset() default character set}.
*
* @apiNote The value of the {@code realm} parameter will be embedded in a
* quoted string.
*
* @param realm the HTTP Basic authentication realm
* @throws NullPointerException if realm is {@code null}
* @throws IllegalArgumentException if realm is an empty string
* @throws IllegalArgumentException if realm is an empty string or is not
* correctly quoted, as specified in <a href="https://tools.ietf.org/html/rfc7230#section-3.2">
* RFC 7230 section-3.2</a>. Note, any {@code \} character used for
* quoting must itself be quoted in source code.
*/
public BasicAuthenticator (String realm) {
public BasicAuthenticator(String realm) {
this(realm, Charset.defaultCharset());
}

@@ -65,16 +73,23 @@ public BasicAuthenticator (String realm) {
* @apiNote {@code UTF-8} is the recommended charset because its usage is
* communicated to the client, and therefore more likely to be used also
* by the client.
* <p>The value of the {@code realm} parameter will be embedded in a quoted
* string.
*
* @param realm the HTTP Basic authentication realm
* @param charset the {@code Charset} to decode incoming credentials from the client
* @throws NullPointerException if realm or charset are {@code null}
* @throws IllegalArgumentException if realm is an empty string
* @throws IllegalArgumentException if realm is an empty string or is not
* correctly quoted, as specified in <a href="https://tools.ietf.org/html/rfc7230#section-3.2">
* RFC 7230 section-3.2</a>. Note, any {@code \} character used for
* quoting must itself be quoted in source code.
*/
public BasicAuthenticator (String realm, Charset charset) {
public BasicAuthenticator(String realm, Charset charset) {
Objects.requireNonNull(charset);
if (realm.isEmpty()) // implicit NPE check
throw new IllegalArgumentException("realm must not be empty");
if (!isQuotedStringContent(realm))
throw new IllegalArgumentException("realm invalid: " + realm);
this.realm = realm;
this.charset = charset;
this.isUTF8 = charset.equals(UTF_8);
@@ -39,6 +39,7 @@
import sun.net.httpserver.HttpConnection.State;

import static java.nio.charset.StandardCharsets.ISO_8859_1;
import static sun.net.httpserver.Utils.*;

/**
* Provides implementation for both HTTP and HTTPS
@@ -586,7 +587,7 @@ public void run () {
Headers headers = req.headers();
/* check key for illegal characters */
for (var k : headers.keySet()) {
if (!isValidHeaderKey(k)) {
if (!isValidName(k)) {
reject(Code.HTTP_BAD_REQUEST, requestLine,
"Header key contains illegal characters");
return;
@@ -934,24 +935,4 @@ static long getTimeMillis(long secs) {
return secs * 1000;
}
}

/*
* Validates a RFC 7230 header-key.
*/
static boolean isValidHeaderKey(String token) {
if (token == null) return false;

boolean isValidChar;
char[] chars = token.toCharArray();
String validSpecialChars = "!#$%&'*+-.^_`|~";
for (char c : chars) {
isValidChar = ((c >= 'a') && (c <= 'z')) ||
((c >= 'A') && (c <= 'Z')) ||
((c >= '0') && (c <= '9'));
if (!isValidChar && validSpecialChars.indexOf(c) == -1) {
return false;
}
}
return !token.isEmpty();
}
}
@@ -0,0 +1,91 @@
/*
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

package sun.net.httpserver;

/**
* Provides utility methods for checking header field names and quoted strings.
*/
public class Utils {

// ABNF primitives defined in RFC 7230
private static final boolean[] TCHAR = new boolean[256];
private static final boolean[] QDTEXT = new boolean[256];
private static final boolean[] QUOTED_PAIR = new boolean[256];

static {
char[] allowedTokenChars =
("!#$%&'*+-.^_`|~0123456789" +
"abcdefghijklmnopqrstuvwxyz" +
"ABCDEFGHIJKLMNOPQRSTUVWXYZ").toCharArray();
for (char c : allowedTokenChars) {
TCHAR[c] = true;
}
for (char c = 0x20; c <= 0xFF; c++) {
QDTEXT[c] = true;
}
QDTEXT[0x22] = false; // (") illegal
QDTEXT[0x5c] = false; // (\) illegal
QDTEXT[0x7F] = false; // (DEL) illegal

for (char c = 0x20; c <= 0xFF; c++) {
QUOTED_PAIR[c] = true;
}
QUOTED_PAIR[0x09] = true; // (\t) legal
QUOTED_PAIR[0x7F] = false; // (DEL) illegal
}

/*
* Validates an RFC 7230 field-name.
*/
public static boolean isValidName(String token) {
for (int i = 0; i < token.length(); i++) {
char c = token.charAt(i);
if (c > 255 || !TCHAR[c]) {
return false;
}
}
return !token.isEmpty();
}

/*
* Validates an RFC 7230 quoted-string.
*/
public static boolean isQuotedStringContent(String token) {
for (int i = 0; i < token.length(); i++) {
char c = token.charAt(i);
if (c > 255) {
return false;
} else if (c == 0x5c) { // check if valid quoted-pair
if (i == token.length() - 1 || !QUOTED_PAIR[token.charAt(i++)]) {
return false;
}
} else if (!QDTEXT[c]) {
return false; // illegal char
}
}
return true;
}
}

1 comment on commit ee49963

@openjdk-notifier
Copy link

@openjdk-notifier openjdk-notifier bot commented on ee49963 Nov 4, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.