View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002181 | NoesisGUI | C# SDK | public | 2021-11-06 05:53 | 2021-11-10 20:04 |
| Reporter | DavidYawCSpeed | Assigned To | hcpizzi | ||
| Priority | normal | Severity | crash | ||
| Status | resolved | Resolution | fixed | ||
| Product Version | 3.1.1 | ||||
| Target Version | 3.1.2 | Fixed in Version | 3.1.2 | ||
| Summary | 0002181: WebBrowser: Invalid characters in the header crash the entire application | ||||
| Description | Seen with WebBrowser 1.0.3. If browsing to a web page that returns a bad character in a header, the entire application crashes. Yes, such a header is violating the HTTP spec, but it shouldn't take down the app. Seen in an unhandled exception handler:
| ||||
| Steps To Reproduce | AppDomain.CurrentDomain.UnhandledException += AppDomain_UnhandledException, and log the exception. Visit a web page that returns an invalid character in a header. I noticed this with http://www.bakerhughes.com, which returns a header with a 0x01 character in it, which isn't valid. According to https://source.dot.net/#System.Net.Requests/HttpValidationHelpers.cs,78, the invalid characters are 0x7F and 0x00 through 0x1F, with the exception of 0x09 Tab. (The exact code is "if (c == 127 || (c < ' ' && c != '\t'))".) When I visit that URL, in method NoesisResourceRequestHandler.GetHeaders(), the header map contains the "Set-Cookie" header, which has 5 values, one of which is "utmvavFuIMDBZ=RNYVuUr; path=/; Max-Age=900", or "utmvavFuIMDBZ=RNY\x01VuUr; path=/; Max-Age=900". It's hard to tell because much of the code is optimized, but it looks like that's the character that's tripping it up. (The exact cookie returned by that page changes, but it seems to always return one with a "\x01" in it. Unfortunately, it doesn't look like there's a nice way to check that the string is valid. HttpValidationHelpers is an internal class to the System.Net.WebHeaderCollection assembly, so we can't call that. So it looks like attempting to do WebHeaderCollection.Add() and catching the exception is the only solution. if there are multiple headers with the same name (multiple cookies, in this case), it would be nice to preserve the valid ones, and only skip the invalid ones. It looks like WebHeaderCollection.Add can be called multiple times, and responseHeaders.GetValues(headername) can return a string array. I haven't checked if iterating over that array and calling Add on each one is equivalent to calling Add on responseHeaders.Get(headername). | ||||
| Platform | Any | ||||
|
Resolved by cleaning the invalid characters of the value before adding it to the headers. |
|
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2021-11-06 05:53 | DavidYawCSpeed | New Issue | |
| 2021-11-06 18:04 | DavidYawCSpeed | Steps to Reproduce Updated | |
| 2021-11-09 10:57 | sfernandez | Assigned To | => hcpizzi |
| 2021-11-09 10:57 | sfernandez | Status | new => assigned |
| 2021-11-09 10:57 | sfernandez | Target Version | => 3.1.2 |
| 2021-11-10 20:04 | sfernandez | Status | assigned => resolved |
| 2021-11-10 20:04 | sfernandez | Resolution | open => fixed |
| 2021-11-10 20:04 | sfernandez | Fixed in Version | => 3.1.2 |
| 2021-11-10 20:04 | sfernandez | Note Added: 0007563 |