View Issue Details

IDProjectCategoryView StatusLast Update
0002181NoesisGUIC# SDKpublic2021-11-10 20:04
ReporterDavidYawCSpeed Assigned Tohcpizzi  
PrioritynormalSeveritycrash 
Status resolvedResolutionfixed 
Product Version3.1.1 
Target Version3.1.2Fixed in Version3.1.2 
Summary0002181: WebBrowser: Invalid characters in the header crash the entire application
Description

Seen with WebBrowser 1.0.3.

If browsing to a web page that returns a bad character in a header, the entire application crashes. Yes, such a header is violating the HTTP spec, but it shouldn't take down the app.

Seen in an unhandled exception handler:


2021-11-05 23:37:24.8841|FATAL|Unhandled exception, IsTerminating = True
System.ArgumentException: Specified value has invalid Control characters. (Parameter 'value')
at System.Net.HttpValidationHelpers.CheckBadHeaderValueChars(String value)
at System.Net.WebHeaderCollection.Add(String name, String value)
at System.Net.WebHeaderCollection.Add(HttpResponseHeader header, String value)
at NoesisApp.NoesisResourceRequestHandler.GetHeaders(NameValueCollection responseHeaders)
at NoesisApp.NoesisResourceRequestHandler.GetWebResponse(CefRequest request, CefResponse response)
at NoesisApp.NoesisResourceRequestHandler.GetNavigationArgs(CefRequest request, CefResponse response)
at NoesisApp.NoesisResourceRequestHandler.OnResourceResponse(CefBrowser browser, CefFrame frame, CefRequest request, CefResponse response)
at Xilium.CefGlue.CefResourceRequestHandler.on_resource_response(cef_resource_request_handler_t self, cef_browser_t browser, cef_frame_t frame, cef_request_t request, cef_response_t* response)

Steps To Reproduce

AppDomain.CurrentDomain.UnhandledException += AppDomain_UnhandledException, and log the exception.

Visit a web page that returns an invalid character in a header. I noticed this with http://www.bakerhughes.com, which returns a header with a 0x01 character in it, which isn't valid. According to https://source.dot.net/#System.Net.Requests/HttpValidationHelpers.cs,78, the invalid characters are 0x7F and 0x00 through 0x1F, with the exception of 0x09 Tab. (The exact code is "if (c == 127 || (c < ' ' && c != '\t'))".)

When I visit that URL, in method NoesisResourceRequestHandler.GetHeaders(), the header map contains the "Set-Cookie" header, which has 5 values, one of which is "utmvavFuIMDBZ=RNYVuUr; path=/; Max-Age=900", or "utmvavFuIMDBZ=RNY\x01VuUr; path=/; Max-Age=900". It's hard to tell because much of the code is optimized, but it looks like that's the character that's tripping it up. (The exact cookie returned by that page changes, but it seems to always return one with a "\x01" in it.

Unfortunately, it doesn't look like there's a nice way to check that the string is valid. HttpValidationHelpers is an internal class to the System.Net.WebHeaderCollection assembly, so we can't call that. So it looks like attempting to do WebHeaderCollection.Add() and catching the exception is the only solution.

if there are multiple headers with the same name (multiple cookies, in this case), it would be nice to preserve the valid ones, and only skip the invalid ones. It looks like WebHeaderCollection.Add can be called multiple times, and responseHeaders.GetValues(headername) can return a string array. I haven't checked if iterating over that array and calling Add on each one is equivalent to calling Add on responseHeaders.Get(headername).

PlatformAny

Activities

sfernandez

sfernandez

2021-11-10 20:04

manager   ~0007563

Resolved by cleaning the invalid characters of the value before adding it to the headers.
Fixed for WebBrowser 1.0.4

Issue History

Date Modified Username Field Change
2021-11-06 05:53 DavidYawCSpeed New Issue
2021-11-06 18:04 DavidYawCSpeed Steps to Reproduce Updated
2021-11-09 10:57 sfernandez Assigned To => hcpizzi
2021-11-09 10:57 sfernandez Status new => assigned
2021-11-09 10:57 sfernandez Target Version => 3.1.2
2021-11-10 20:04 sfernandez Status assigned => resolved
2021-11-10 20:04 sfernandez Resolution open => fixed
2021-11-10 20:04 sfernandez Fixed in Version => 3.1.2
2021-11-10 20:04 sfernandez Note Added: 0007563