From a814d7990a5449fcc211a536119d271469cc4157 Mon Sep 17 00:00:00 2001 From: jub0bs <52325150+jub0bs@users.noreply.github.com> Date: Thu, 29 Aug 2024 13:33:59 +0200 Subject: [PATCH] Re-add support for multiple Access-Control-Request-Headers field (fixes #184) (#186) --- cors.go | 8 +- cors_test.go | 463 ++++++++++++++++++++++--------------- internal/sortedset.go | 152 +++++++++--- internal/sortedset_test.go | 233 +++++++++++++------ utils.go | 9 - 5 files changed, 562 insertions(+), 303 deletions(-) diff --git a/cors.go b/cors.go index 20a66d0..724f242 100644 --- a/cors.go +++ b/cors.go @@ -364,9 +364,11 @@ func (c *Cors) handlePreflight(w http.ResponseWriter, r *http.Request) { // Note: the Fetch standard guarantees that at most one // Access-Control-Request-Headers header is present in the preflight request; // see step 5.2 in https://fetch.spec.whatwg.org/#cors-preflight-fetch-0. - reqHeaders, found := first(r.Header, "Access-Control-Request-Headers") - if found && !c.allowedHeadersAll && !c.allowedHeaders.Subsumes(reqHeaders[0]) { - c.logf(" Preflight aborted: headers '%v' not allowed", reqHeaders[0]) + // However, some gateways split that header into multiple headers of the same name; + // see https://github.com/rs/cors/issues/184. + reqHeaders, found := r.Header["Access-Control-Request-Headers"] + if found && !c.allowedHeadersAll && !c.allowedHeaders.Accepts(reqHeaders) { + c.logf(" Preflight aborted: headers '%v' not allowed", reqHeaders) return } if c.allowedOriginsAll { diff --git a/cors_test.go b/cors_test.go index a3c0aab..46430fc 100644 --- a/cors_test.go +++ b/cors_test.go @@ -15,26 +15,63 @@ var testHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) _, _ = w.Write(testResponse) }) -var allHeaders = []string{ - "Vary", - "Access-Control-Allow-Origin", - "Access-Control-Allow-Methods", - "Access-Control-Allow-Headers", - "Access-Control-Allow-Credentials", - "Access-Control-Allow-Private-Network", - "Access-Control-Max-Age", - "Access-Control-Expose-Headers", +// For each key-value pair of this map, the value indicates whether the key +// is a list-based field (i.e. not a singleton field); +// see https://httpwg.org/specs/rfc9110.html#abnf.extension. +var allRespHeaders = map[string]bool{ + // see https://www.rfc-editor.org/rfc/rfc9110#section-12.5.5 + "Vary": true, + // see https://fetch.spec.whatwg.org/#http-new-header-syntax + "Access-Control-Allow-Origin": false, + "Access-Control-Allow-Credentials": false, + "Access-Control-Allow-Methods": true, + "Access-Control-Allow-Headers": true, + "Access-Control-Max-Age": false, + "Access-Control-Expose-Headers": true, + // see https://wicg.github.io/private-network-access/ + "Access-Control-Allow-Private-Network": false, } -func assertHeaders(t *testing.T, resHeaders http.Header, expHeaders map[string]string) { +func assertHeaders(t *testing.T, resHeaders http.Header, expHeaders http.Header) { t.Helper() - for _, name := range allHeaders { - got := strings.Join(resHeaders[name], ", ") + for name, listBased := range allRespHeaders { + got := resHeaders[name] want := expHeaders[name] - if got != want { + if !listBased && !slicesEqual(got, want) { t.Errorf("Response header %q = %q, want %q", name, got, want) + continue + } + if listBased && !slicesEqual(normalize(got), normalize(want)) { + t.Errorf("Response header %q = %q, want %q", name, got, want) + continue + } + } +} + +// normalize normalizes a list-based field value, +// preserving both empty elements and the order of elements. +func normalize(s []string) (res []string) { + for _, v := range s { + for _, e := range strings.Split(v, ",") { + e = strings.Trim(e, " \t") + res = append(res, e) } } + return +} + +// TODO: when updating go directive to 1.21 or later, +// use slices.Equal instead. +func slicesEqual(s1, s2 []string) bool { + if len(s1) != len(s2) { + return false + } + for i := range s1 { + if s1[i] != s2[i] { + return false + } + } + return true } func assertResponse(t *testing.T, res *httptest.ResponseRecorder, responseCode int) { @@ -49,8 +86,8 @@ func TestSpec(t *testing.T) { name string options Options method string - reqHeaders map[string]string - resHeaders map[string]string + reqHeaders http.Header + resHeaders http.Header originAllowed bool }{ { @@ -59,9 +96,9 @@ func TestSpec(t *testing.T) { // Intentionally left blank. }, "GET", - map[string]string{}, - map[string]string{ - "Vary": "Origin", + http.Header{}, + http.Header{ + "Vary": {"Origin"}, }, true, }, @@ -71,12 +108,12 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"*"}, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "*", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"*"}, }, true, }, @@ -87,13 +124,13 @@ func TestSpec(t *testing.T) { AllowCredentials: true, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "*", - "Access-Control-Allow-Credentials": "true", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"*"}, + "Access-Control-Allow-Credentials": {"true"}, }, true, }, @@ -103,12 +140,12 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"http://foobar.com"}, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foobar.com", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, }, true, }, @@ -118,12 +155,12 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"http://*.bar.com"}, }, "GET", - map[string]string{ - "Origin": "http://foo.bar.com", + http.Header{ + "Origin": {"http://foo.bar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foo.bar.com", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foo.bar.com"}, }, true, }, @@ -133,11 +170,11 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"http://foobar.com"}, }, "GET", - map[string]string{ - "Origin": "http://barbaz.com", + http.Header{ + "Origin": {"http://barbaz.com"}, }, - map[string]string{ - "Vary": "Origin", + http.Header{ + "Vary": {"Origin"}, }, false, }, @@ -147,11 +184,11 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"http://*.bar.com"}, }, "GET", - map[string]string{ - "Origin": "http://foo.baz.com", + http.Header{ + "Origin": {"http://foo.baz.com"}, }, - map[string]string{ - "Vary": "Origin", + http.Header{ + "Vary": {"Origin"}, }, false, }, @@ -163,12 +200,12 @@ func TestSpec(t *testing.T) { }, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foobar.com", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, }, true, }, @@ -180,13 +217,13 @@ func TestSpec(t *testing.T) { }, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", - "Authorization": "secret", + http.Header{ + "Origin": {"http://foobar.com"}, + "Authorization": {"secret"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foobar.com", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, }, true, }, @@ -198,13 +235,13 @@ func TestSpec(t *testing.T) { }, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", - "Authorization": "secret", + http.Header{ + "Origin": {"http://foobar.com"}, + "Authorization": {"secret"}, }, - map[string]string{ - "Vary": "Origin, Authorization", - "Access-Control-Allow-Origin": "http://foobar.com", + http.Header{ + "Vary": {"Origin, Authorization"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, }, true, }, @@ -216,52 +253,52 @@ func TestSpec(t *testing.T) { }, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", - "Authorization": "not-secret", + http.Header{ + "Origin": {"http://foobar.com"}, + "Authorization": {"not-secret"}, }, - map[string]string{ - "Vary": "Origin", + http.Header{ + "Vary": {"Origin"}, }, false, }, { "MaxAge", Options{ - AllowedOrigins: []string{"http://example.com/"}, + AllowedOrigins: []string{"http://example.com"}, AllowedMethods: []string{"GET"}, MaxAge: 10, }, "OPTIONS", - map[string]string{ - "Origin": "http://example.com/", - "Access-Control-Request-Method": "GET", + http.Header{ + "Origin": {"http://example.com"}, + "Access-Control-Request-Method": {"GET"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://example.com/", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Max-Age": "10", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://example.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Max-Age": {"10"}, }, true, }, { "MaxAgeNegative", Options{ - AllowedOrigins: []string{"http://example.com/"}, + AllowedOrigins: []string{"http://example.com"}, AllowedMethods: []string{"GET"}, MaxAge: -1, }, "OPTIONS", - map[string]string{ - "Origin": "http://example.com/", - "Access-Control-Request-Method": "GET", + http.Header{ + "Origin": {"http://example.com"}, + "Access-Control-Request-Method": {"GET"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://example.com/", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Max-Age": "0", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://example.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Max-Age": {"0"}, }, true, }, @@ -272,14 +309,14 @@ func TestSpec(t *testing.T) { AllowedMethods: []string{"PUT", "DELETE"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "PUT", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"PUT"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "PUT", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"PUT"}, }, true, }, @@ -290,12 +327,12 @@ func TestSpec(t *testing.T) { AllowedMethods: []string{"PUT", "DELETE"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "PATCH", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"PATCH"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, }, true, }, @@ -306,16 +343,16 @@ func TestSpec(t *testing.T) { AllowedHeaders: []string{"X-Header-1", "x-header-2", "X-HEADER-3"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", - "Access-Control-Request-Headers": "x-header-1,x-header-2", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Headers": {"x-header-1,x-header-2"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Allow-Headers": "x-header-1,x-header-2", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Headers": {"x-header-1,x-header-2"}, }, true, }, @@ -326,16 +363,16 @@ func TestSpec(t *testing.T) { AllowedHeaders: []string{}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", - "Access-Control-Request-Headers": "x-requested-with", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Headers": {"x-requested-with"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Allow-Headers": "x-requested-with", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Headers": {"x-requested-with"}, }, true, }, @@ -346,16 +383,16 @@ func TestSpec(t *testing.T) { AllowedHeaders: []string{"*"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", - "Access-Control-Request-Headers": "x-header-1,x-header-2", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Headers": {"x-header-1,x-header-2"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Allow-Headers": "x-header-1,x-header-2", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Headers": {"x-header-1,x-header-2"}, }, true, }, @@ -366,13 +403,13 @@ func TestSpec(t *testing.T) { AllowedHeaders: []string{"X-Header-1", "x-header-2"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", - "Access-Control-Request-Headers": "x-header-1,x-header-3", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Headers": {"x-header-1,x-header-3"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, }, true, }, @@ -383,13 +420,13 @@ func TestSpec(t *testing.T) { ExposedHeaders: []string{"X-Header-1", "x-header-2"}, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Expose-Headers": "X-Header-1, X-Header-2", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Expose-Headers": {"X-Header-1, X-Header-2"}, }, true, }, @@ -400,15 +437,15 @@ func TestSpec(t *testing.T) { AllowCredentials: true, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Allow-Credentials": "true", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Credentials": {"true"}, }, true, }, @@ -419,16 +456,16 @@ func TestSpec(t *testing.T) { AllowPrivateNetwork: true, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", - "Access-Control-Request-Private-Network": "true", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Private-Network": {"true"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "GET", - "Access-Control-Allow-Private-Network": "true", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Private-Network": {"true"}, }, true, }, @@ -438,15 +475,15 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"http://foobar.com"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", - "Access-Control-Request-PrivateNetwork": "true", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-PrivateNetwork": {"true"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "http://foobar.com", - "Access-Control-Allow-Methods": "GET", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, }, true, }, @@ -456,14 +493,14 @@ func TestSpec(t *testing.T) { OptionsPassthrough: true, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", - "Access-Control-Request-Method": "GET", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, }, - map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", - "Access-Control-Allow-Origin": "*", - "Access-Control-Allow-Methods": "GET", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"*"}, + "Access-Control-Allow-Methods": {"GET"}, }, true, }, @@ -473,12 +510,12 @@ func TestSpec(t *testing.T) { AllowedOrigins: []string{"http://foobar.com"}, }, "OPTIONS", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foobar.com", + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, }, true, }, { @@ -490,12 +527,52 @@ func TestSpec(t *testing.T) { }, }, "GET", - map[string]string{ - "Origin": "http://foobar.com", + http.Header{ + "Origin": {"http://foobar.com"}, + }, + http.Header{ + "Vary": {"Origin"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + }, + true, + }, + { + "MultipleACRHHeaders", + Options{ + AllowedOrigins: []string{"http://foobar.com"}, + AllowedHeaders: []string{"Content-Type", "Authorization"}, + }, + "OPTIONS", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Headers": {"authorization", "content-type"}, }, - map[string]string{ - "Vary": "Origin", - "Access-Control-Allow-Origin": "http://foobar.com", + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Headers": {"authorization", "content-type"}, + }, + true, + }, + { + "MultipleACRHHeadersWithOWSAndEmptyElements", + Options{ + AllowedOrigins: []string{"http://foobar.com"}, + AllowedHeaders: []string{"Content-Type", "Authorization"}, + }, + "OPTIONS", + http.Header{ + "Origin": {"http://foobar.com"}, + "Access-Control-Request-Method": {"GET"}, + "Access-Control-Request-Headers": {"authorization\t", " ", " content-type"}, + }, + http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, + "Access-Control-Allow-Origin": {"http://foobar.com"}, + "Access-Control-Allow-Methods": {"GET"}, + "Access-Control-Allow-Headers": {"authorization\t", " ", " content-type"}, }, true, }, @@ -506,8 +583,10 @@ func TestSpec(t *testing.T) { s := New(tc.options) req, _ := http.NewRequest(tc.method, "http://example.com/foo", nil) - for name, value := range tc.reqHeaders { - req.Header.Add(name, value) + for name, values := range tc.reqHeaders { + for _, value := range values { + req.Header.Add(name, value) + } } t.Run("OriginAllowed", func(t *testing.T) { @@ -591,12 +670,12 @@ func TestHandlePreflightInvalidOriginAbortion(t *testing.T) { }) res := httptest.NewRecorder() req, _ := http.NewRequest("OPTIONS", "http://example.com/foo", nil) - req.Header.Add("Origin", "http://example.com/") + req.Header.Add("Origin", "http://example.com") s.handlePreflight(res, req) - assertHeaders(t, res.Header(), map[string]string{ - "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers", + assertHeaders(t, res.Header(), http.Header{ + "Vary": {"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"}, }) } @@ -609,7 +688,7 @@ func TestHandlePreflightNoOptionsAbortion(t *testing.T) { s.handlePreflight(res, req) - assertHeaders(t, res.Header(), map[string]string{}) + assertHeaders(t, res.Header(), http.Header{}) } func TestHandleActualRequestInvalidOriginAbortion(t *testing.T) { @@ -618,12 +697,12 @@ func TestHandleActualRequestInvalidOriginAbortion(t *testing.T) { }) res := httptest.NewRecorder() req, _ := http.NewRequest("GET", "http://example.com/foo", nil) - req.Header.Add("Origin", "http://example.com/") + req.Header.Add("Origin", "http://example.com") s.handleActualRequest(res, req) - assertHeaders(t, res.Header(), map[string]string{ - "Vary": "Origin", + assertHeaders(t, res.Header(), http.Header{ + "Vary": {"Origin"}, }) } @@ -634,12 +713,12 @@ func TestHandleActualRequestInvalidMethodAbortion(t *testing.T) { }) res := httptest.NewRecorder() req, _ := http.NewRequest("GET", "http://example.com/foo", nil) - req.Header.Add("Origin", "http://example.com/") + req.Header.Add("Origin", "http://example.com") s.handleActualRequest(res, req) - assertHeaders(t, res.Header(), map[string]string{ - "Vary": "Origin", + assertHeaders(t, res.Header(), http.Header{ + "Vary": {"Origin"}, }) } diff --git a/internal/sortedset.go b/internal/sortedset.go index 513da20..844f3f9 100644 --- a/internal/sortedset.go +++ b/internal/sortedset.go @@ -52,46 +52,134 @@ func (set SortedSet) String() string { return strings.Join(elems, ",") } -// Subsumes reports whether csv is a sequence of comma-separated names that are -// - all elements of set, -// - sorted in lexicographically order, +// Accepts reports whether values is a sequence of list-based field values +// whose elements are +// - all members of set, +// - sorted in lexicographical order, // - unique. -func (set SortedSet) Subsumes(csv string) bool { - if csv == "" { - return true +func (set SortedSet) Accepts(values []string) bool { + var ( // effectively constant + maxLen = maxOWSBytes + set.maxLen + maxOWSBytes + 1 // +1 for comma + ) + var ( + posOfLastNameSeen = -1 + name string + commaFound bool + emptyElements int + ok bool + ) + for _, s := range values { + for { + // As a defense against maliciously long names in s, + // we process only a small number of s's leading bytes per iteration. + name, s, commaFound = cutAtComma(s, maxLen) + name, ok = trimOWS(name, maxOWSBytes) + if !ok { + return false + } + if name == "" { + // RFC 9110 requires recipients to tolerate + // "a reasonable number of empty list elements"; see + // https://httpwg.org/specs/rfc9110.html#abnf.extension.recipient. + emptyElements++ + if emptyElements > maxEmptyElements { + return false + } + if !commaFound { // We have now exhausted the names in s. + break + } + continue + } + pos, ok := set.m[name] + if !ok { + return false + } + // The names in s are expected to be sorted in lexicographical order + // and to each appear at most once. + // Therefore, the positions (in set) of the names that + // appear in s should form a strictly increasing sequence. + // If that's not actually the case, bail out. + if pos <= posOfLastNameSeen { + return false + } + posOfLastNameSeen = pos + if !commaFound { // We have now exhausted the names in s. + break + } + } + } + return true +} + +const ( + maxOWSBytes = 1 // number of leading/trailing OWS bytes tolerated + maxEmptyElements = 16 // number of empty list elements tolerated +) + +func cutAtComma(s string, n int) (before, after string, found bool) { + // Note: this implementation draws inspiration from strings.Cut's. + end := min(len(s), n) + if i := strings.IndexByte(s[:end], ','); i >= 0 { + after = s[i+1:] // deal with this first to save one bounds check + return s[:i], after, true + } + return s, "", false +} + +// TrimOWS trims up to n bytes of [optional whitespace (OWS)] +// from the start of and/or the end of s. +// If no more than n bytes of OWS are found at the start of s +// and no more than n bytes of OWS are found at the end of s, +// it returns the trimmed result and true. +// Otherwise, it returns the original string and false. +// +// [optional whitespace (OWS)]: https://httpwg.org/specs/rfc9110.html#whitespace +func trimOWS(s string, n int) (trimmed string, ok bool) { + if s == "" { + return s, true + } + trimmed, ok = trimRightOWS(s, n) + if !ok { + return s, false } - posOfLastNameSeen := -1 - chunkSize := set.maxLen + 1 // (to accommodate for at least one comma) - for { - // As a defense against maliciously long names in csv, - // we only process at most chunkSize bytes per iteration. - end := min(len(csv), chunkSize) - comma := strings.IndexByte(csv[:end], ',') - var name string - if comma == -1 { - name = csv - } else { - name = csv[:comma] + trimmed, ok = trimLeftOWS(trimmed, n) + if !ok { + return s, false + } + return trimmed, true +} + +func trimLeftOWS(s string, n int) (string, bool) { + sCopy := s + var i int + for len(s) > 0 { + if i > n { + return sCopy, false } - pos, found := set.m[name] - if !found { - return false + if !(s[0] == ' ' || s[0] == '\t') { + break } - // The names in csv are expected to be sorted in lexicographical order - // and appear at most once in csv. - // Therefore, the positions (in set) of the names that - // appear in csv should form a strictly increasing sequence. - // If that's not actually the case, bail out. - if pos <= posOfLastNameSeen { - return false + s = s[1:] + i++ + } + return s, true +} + +func trimRightOWS(s string, n int) (string, bool) { + sCopy := s + var i int + for len(s) > 0 { + if i > n { + return sCopy, false } - posOfLastNameSeen = pos - if comma < 0 { // We've now processed all the names in csv. + last := len(s) - 1 + if !(s[last] == ' ' || s[last] == '\t') { break } - csv = csv[comma+1:] + s = s[:last] + i++ } - return true + return s, true } // TODO: when updating go directive to 1.21 or later, diff --git a/internal/sortedset_test.go b/internal/sortedset_test.go index 9727686..1a362fc 100644 --- a/internal/sortedset_test.go +++ b/internal/sortedset_test.go @@ -1,108 +1,207 @@ package internal import ( + "strings" "testing" ) func TestSortedSet(t *testing.T) { cases := []struct { - desc string - elems []string - combined string - subsets []string - notSubsets []string - wantSize int + desc string + elems []string + // expectations + size int + combined string + slice []string + accepted [][]string + rejected [][]string }{ { desc: "empty set", + size: 0, combined: "", - notSubsets: []string{ - "bar", - "bar,foo", + accepted: [][]string{ + // some empty elements, possibly with OWS + {""}, + {","}, + {"\t, , "}, + // multiple field lines, some empty elements + make([]string, maxEmptyElements), + }, + rejected: [][]string{ + {"x-bar"}, + {"x-bar,x-foo"}, + // too many empty elements + {strings.Repeat(",", maxEmptyElements+1)}, + // multiple field lines, too many empty elements + make([]string, maxEmptyElements+1), }, - wantSize: 0, }, { desc: "singleton set", - elems: []string{"foo"}, - combined: "foo", - subsets: []string{ - "", - "foo", + elems: []string{"x-foo"}, + size: 1, + combined: "x-foo", + slice: []string{"X-Foo"}, + accepted: [][]string{ + {"x-foo"}, + // some empty elements, possibly with OWS + {""}, + {","}, + {"\t, , "}, + {"\tx-foo ,"}, + {" x-foo\t,"}, + {strings.Repeat(",", maxEmptyElements) + "x-foo"}, + // multiple field lines, some empty elements + append(make([]string, maxEmptyElements), "x-foo"), + make([]string, maxEmptyElements), }, - notSubsets: []string{ - "bar", - "bar,foo", + rejected: [][]string{ + {"x-bar"}, + {"x-bar,x-foo"}, + // too much OWS + {"x-foo "}, + {" x-foo "}, + {" x-foo "}, + {"x-foo\t\t"}, + {"\tx-foo\t\t"}, + {"\t\tx-foo\t\t"}, + // too many empty elements + {strings.Repeat(",", maxEmptyElements+1) + "x-foo"}, + // multiple field lines, too many empty elements + append(make([]string, maxEmptyElements+1), "x-foo"), + make([]string, maxEmptyElements+1), }, - wantSize: 1, }, { desc: "no dupes", - elems: []string{"foo", "bar", "baz"}, - combined: "bar,baz,foo", - subsets: []string{ - "", - "bar", - "baz", - "foo", - "bar,baz", - "bar,foo", - "baz,foo", - "bar,baz,foo", + elems: []string{"x-foo", "x-bar", "x-baz"}, + size: 3, + combined: "x-bar,x-baz,x-foo", + slice: []string{"X-Bar", "X-Baz", "X-Foo"}, + accepted: [][]string{ + {"x-bar"}, + {"x-baz"}, + {"x-foo"}, + {"x-bar,x-baz"}, + {"x-bar,x-foo"}, + {"x-baz,x-foo"}, + {"x-bar,x-baz,x-foo"}, + // some empty elements, possibly with OWS + {""}, + {","}, + {"\t, , "}, + {"\tx-bar ,"}, + {" x-baz\t,"}, + {"x-foo,"}, + {"\tx-bar ,\tx-baz ,"}, + {" x-bar\t, x-foo\t,"}, + {"x-baz,x-foo,"}, + {" x-bar , x-baz , x-foo ,"}, + {"x-bar" + strings.Repeat(",", maxEmptyElements+1) + "x-foo"}, + // multiple field lines + {"x-bar", "x-foo"}, + {"x-bar", "x-baz,x-foo"}, + // multiple field lines, some empty elements + append(make([]string, maxEmptyElements), "x-bar", "x-foo"), + make([]string, maxEmptyElements), }, - notSubsets: []string{ - "qux", - "bar,baz,baz", - "qux,baz", - "qux,foo", - "quxbaz,foo", + rejected: [][]string{ + {"x-qux"}, + {"x-bar,x-baz,x-baz"}, + {"x-qux,x-baz"}, + {"x-qux,x-foo"}, + {"x-quxbaz,x-foo"}, + // too much OWS + {"x-bar "}, + {" x-baz "}, + {" x-foo "}, + {"x-bar\t\t,x-baz"}, + {"x-bar,\tx-foo\t\t"}, + {"\t\tx-baz,x-foo\t\t"}, + {" x-bar\t,\tx-baz\t ,x-foo"}, + // too many empty elements + {"x-bar" + strings.Repeat(",", maxEmptyElements+2) + "x-foo"}, + // multiple field lines, elements in the wrong order + {"x-foo", "x-bar"}, + // multiple field lines, too many empty elements + append(make([]string, maxEmptyElements+1), "x-bar", "x-foo"), + make([]string, maxEmptyElements+1), }, - wantSize: 3, }, { desc: "some dupes", - elems: []string{"foo", "bar", "bar", "foo", "e"}, - combined: "bar,e,foo", - subsets: []string{ - "", - "bar", - "e", - "foo", - "bar,foo", - "bar,e", - "e,foo", - "bar,e,foo", + elems: []string{"x-foo", "x-bar", "x-foo"}, + size: 2, + combined: "x-bar,x-foo", + slice: []string{"X-Bar", "X-Foo"}, + accepted: [][]string{ + {"x-bar"}, + {"x-foo"}, + {"x-bar,x-foo"}, + // some empty elements, possibly with OWS + {""}, + {","}, + {"\t, , "}, + {"\tx-bar ,"}, + {" x-foo\t,"}, + {"x-foo,"}, + {"\tx-bar ,\tx-foo ,"}, + {" x-bar\t, x-foo\t,"}, + {"x-bar,x-foo,"}, + {" x-bar , x-foo ,"}, + {"x-bar" + strings.Repeat(",", maxEmptyElements+1) + "x-foo"}, + // multiple field lines + {"x-bar", "x-foo"}, + // multiple field lines, some empty elements + append(make([]string, maxEmptyElements), "x-bar", "x-foo"), + make([]string, maxEmptyElements), }, - notSubsets: []string{ - "qux", - "qux,bar", - "qux,foo", - "qux,baz,foo", + rejected: [][]string{ + {"x-qux"}, + {"x-qux,x-bar"}, + {"x-qux,x-foo"}, + {"x-qux,x-baz,x-foo"}, + // too much OWS + {"x-qux "}, + {"x-qux,\t\tx-bar"}, + {"x-qux,x-foo\t\t"}, + {"\tx-qux , x-baz\t\t,x-foo"}, + // too many empty elements + {"x-bar" + strings.Repeat(",", maxEmptyElements+2) + "x-foo"}, + // multiple field lines, elements in the wrong order + {"x-foo", "x-bar"}, + // multiple field lines, too much whitespace + {"x-qux", "\t\tx-bar"}, + {"x-qux", "x-foo\t\t"}, + {"\tx-qux ", " x-baz\t\t,x-foo"}, + // multiple field lines, too many empty elements + append(make([]string, maxEmptyElements+1), "x-bar", "x-foo"), + make([]string, maxEmptyElements+1), }, - wantSize: 3, }, } for _, tc := range cases { f := func(t *testing.T) { elems := clone(tc.elems) - s := NewSortedSet(tc.elems...) - size := s.Size() - if s.Size() != tc.wantSize { + set := NewSortedSet(tc.elems...) + size := set.Size() + if set.Size() != tc.size { const tmpl = "NewSortedSet(%#v...).Size(): got %d; want %d" - t.Errorf(tmpl, elems, size, tc.wantSize) + t.Errorf(tmpl, elems, size, tc.size) } - combined := s.String() + combined := set.String() if combined != tc.combined { const tmpl = "NewSortedSet(%#v...).String(): got %q; want %q" t.Errorf(tmpl, elems, combined, tc.combined) } - for _, sub := range tc.subsets { - if !s.Subsumes(sub) { - const tmpl = "%q is not a subset of %q, but should be" - t.Errorf(tmpl, sub, s) + for _, a := range tc.accepted { + if !set.Accepts(a) { + const tmpl = "%q rejects %q, but should accept it" + t.Errorf(tmpl, set, a) } } - for _, notSub := range tc.notSubsets { - if s.Subsumes(notSub) { - const tmpl = "%q is a subset of %q, but should not be" - t.Errorf(tmpl, notSub, s) + for _, r := range tc.rejected { + if set.Accepts(r) { + const tmpl = "%q accepts %q, but should reject it" + t.Errorf(tmpl, set, r) } } } diff --git a/utils.go b/utils.go index 7019f45..41b0c28 100644 --- a/utils.go +++ b/utils.go @@ -1,7 +1,6 @@ package cors import ( - "net/http" "strings" ) @@ -24,11 +23,3 @@ func convert(s []string, f func(string) string) []string { } return out } - -func first(hdrs http.Header, k string) ([]string, bool) { - v, found := hdrs[k] - if !found || len(v) == 0 { - return nil, false - } - return v[:1], true -}