github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-01-09 15:38:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: sanitize invalid custom protocol headers (#18854)

Browse Source
This commit is contained in:
Micha Hanselmann
2019-06-21 09:23:57 -07:00
committed by Shelley Vohr
parent 236d552d6a
commit 81497c7f2e
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
shell/browser/net/url_request_async_asar_job.cc
View File

@@ -38,6 +38,20 @@ void BeforeStartInUI(base::WeakPtr<URLRequestAsyncAsarJob> job,
error = net::ERR_NOT_IMPLEMENTED;
}
// sanitize custom headers
if (request_options && request_options->is_dict()) {
const base::Value* headersDict = request_options->FindDictKey("headers");
if (headersDict) {
for (const auto& iter : headersDict->DictItems()) {
if (!iter.second.is_string()) {
args->ThrowError("Value of '" + iter.first +
"' header has to be a string");
return;
}
}
}
}
base::PostTaskWithTraits(
FROM_HERE, {content::BrowserThread::IO},
base::BindOnce(&URLRequestAsyncAsarJob::StartAsync, job,