-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Validate content type header parameter #176
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -4,6 +4,7 @@ import ( | |
"errors" | ||
"fmt" | ||
"math/big" | ||
"strings" | ||
|
||
"github.com/fxamacker/cbor/v2" | ||
) | ||
|
@@ -471,9 +472,24 @@ func validateHeaderParameters(h map[any]any, protected bool) error { | |
return fmt.Errorf("header parameter: crit: %w", err) | ||
} | ||
case HeaderLabelContentType: | ||
if !canTstr(value) && !canUint(value) { | ||
is_tstr := canTstr(value) | ||
if !is_tstr && !canUint(value) { | ||
return errors.New("header parameter: content type: require tstr / uint type") | ||
} | ||
if is_tstr { | ||
v := value.(string) | ||
if len(v) == 0 { | ||
return errors.New("header parameter: content type: require non-empty string") | ||
} | ||
if v[0] == ' ' || v[len(v)-1] == ' ' { | ||
return errors.New("header parameter: content type: require no leading/trailing whitespace") | ||
} | ||
// Basic check that the content type is of form type/subtype. | ||
// We don't check the precise definition though (RFC 6838 Section 4.2). | ||
Comment on lines
+487
to
+488
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I am OK with a quick and dirty sanity check, but it seems it wouldn't be prohibitively difficult to do the full sanitisation. 6838
we'd be done? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Nop. It can also contain parameters and subparameters. As per RFC 6838 Section 4.3, parameter names must conform to There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. ah, this bit of the spec is confusing: "Text values follow the syntax of "<type-name>/<subtype-name>", where <type-name> and <subtype-name> are defined in Section 4.2 of [RFC6838]. as it seems to suggest cty would use a subset of the media type string... But in any case, that's possibly even better from our perspective because we can use There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
It is confusing, indeed.
We could be being too restrictive by using that method, as MIME is not the only allowed content type format, and it might impose additional restrictions, as noted in RFC 6838 Section 4.2:
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
😄
note that
While theoretically true, MIME and HTTP really cover a lot of ground -- i.e., I'd be surprised if we hit a case that'd need special treatment. Anyway, I should have made clearer that this is non-blocking 👍 There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks, @thomas-fossati for the dialog and non-blocking comment. |
||
if strings.Count(v, "/") != 1 { | ||
return errors.New("header parameter: content type: require text of form type/subtype") | ||
} | ||
} | ||
case HeaderLabelKeyID: | ||
if !canBstr(value) { | ||
return errors.New("header parameter: kid: require bstr type") | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you please clarify the comment on line 433
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Testing that the content type conforms to RFC 6838 Section 4.2 is not trivial, and other COSE libraries are not enforcing that neither, i.e.: google/coset. That's why I'm just doing some basic validations.