Skip to content

Commit d384e88

Browse files
vseanreesermsftvseanreesermsft
committed
Merge commit '509f6badec2f3162f0e50330cd9107e5624b379b' into internal-merge-3.1-2022-03-08-1129
2 parents fd3bab2 + 509f6ba commit d384e88

File tree

8 files changed

+342
-252
lines changed

8 files changed

+342
-252
lines changed

‎NuGet.config

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,19 @@
44
<clear />
55
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
66
<!-- Begin: Package sources from dotnet-razor-tooling -->
7+
<add key="darc-int-dotnet-razor-tooling-39d9ee3" value="https://pkgs.dev.azure.com/dnceng/_packaging/darc-int-dotnet-razor-tooling-39d9ee3c/nuget/v3/index.json" />
78
<!-- End: Package sources from dotnet-razor-tooling -->
89
<!-- Begin: Package sources from dotnet-corefx -->
10+
<add key="darc-int-dotnet-corefx-641ee87" value="https://pkgs.dev.azure.com/dnceng/_packaging/darc-int-dotnet-corefx-641ee87b/nuget/v3/index.json" />
911
<!-- End: Package sources from dotnet-corefx -->
1012
<!-- Begin: Package sources from dotnet-core-setup -->
13+
<add key="darc-int-dotnet-core-setup-7af614f" value="https://pkgs.dev.azure.com/dnceng/_packaging/darc-int-dotnet-core-setup-7af614fd/nuget/v3/index.json" />
1114
<!-- End: Package sources from dotnet-core-setup -->
1215
<!-- Begin: Package sources from dotnet-efcore -->
16+
<add key="darc-int-dotnet-efcore-213c56e" value="https://pkgs.dev.azure.com/dnceng/_packaging/darc-int-dotnet-efcore-213c56ea/nuget/v3/index.json" />
1317
<!-- End: Package sources from dotnet-efcore -->
1418
<!-- Begin: Package sources from dotnet-extensions -->
19+
<add key="darc-int-dotnet-extensions-8934ddb" value="https://pkgs.dev.azure.com/dnceng/_packaging/darc-int-dotnet-extensions-8934ddbf/nuget/v3/index.json" />
1520
<!-- End: Package sources from dotnet-extensions -->
1621
<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
1722
<add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
@@ -23,14 +28,19 @@
2328
<clear />
2429
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
2530
<!-- Begin: Package sources from dotnet-razor-tooling -->
31+
<add key="darc-int-dotnet-razor-tooling-39d9ee3" value="true" />
2632
<!-- End: Package sources from dotnet-razor-tooling -->
2733
<!-- Begin: Package sources from dotnet-extensions -->
34+
<add key="darc-int-dotnet-extensions-8934ddb" value="true" />
2835
<!-- End: Package sources from dotnet-extensions -->
2936
<!-- Begin: Package sources from dotnet-efcore -->
37+
<add key="darc-int-dotnet-efcore-213c56e" value="true" />
3038
<!-- End: Package sources from dotnet-efcore -->
3139
<!-- Begin: Package sources from dotnet-core-setup -->
40+
<add key="darc-int-dotnet-core-setup-7af614f" value="true" />
3241
<!-- End: Package sources from dotnet-core-setup -->
3342
<!-- Begin: Package sources from dotnet-corefx -->
43+
<add key="darc-int-dotnet-corefx-641ee87" value="true" />
3444
<!-- End: Package sources from dotnet-corefx -->
3545
<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
3646
</disabledPackageSources>

‎eng/Version.Details.xml

Lines changed: 146 additions & 146 deletions
Large diffs are not rendered by default.

‎eng/Versions.props

Lines changed: 73 additions & 73 deletions
Large diffs are not rendered by default.

‎src/Http/WebUtilities/ref/Microsoft.AspNetCore.WebUtilities.Manual.cs

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,4 +46,19 @@ public void MoveTo(System.IO.Stream stream) { }
4646
[System.Diagnostics.DebuggerStepThroughAttribute]
4747
public System.Threading.Tasks.Task MoveToAsync(System.IO.Stream stream, System.Threading.CancellationToken cancellationToken) { throw null; }
4848
}
49+
50+
internal static partial class Resources
51+
{
52+
internal static System.Globalization.CultureInfo Culture { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } [System.Runtime.CompilerServices.CompilerGeneratedAttribute]set { } }
53+
internal static string FormPipeReader_KeyOrValueTooLarge { get { throw null; } }
54+
internal static string HttpRequestStreamReader_StreamNotReadable { get { throw null; } }
55+
internal static string HttpResponseStreamWriter_StreamNotWritable { get { throw null; } }
56+
internal static System.Resources.ResourceManager ResourceManager { get { throw null; } }
57+
internal static string FormPipeReader_KeyTooLarge(object p0) { throw null; }
58+
internal static string FormPipeReader_ValueTooLarge(object p0) { throw null; }
59+
internal static string WebEncoders_InvalidCountOffsetOrLength(object p0, object p1, object p2) { throw null; }
60+
61+
[System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.AggressiveInlining)]
62+
internal static string GetResourceString(string resourceKey, string defaultValue = null) { throw null; }
63+
}
4964
}

‎src/Http/WebUtilities/src/FormPipeReader.cs

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
using System.Buffers;
66
using System.Collections.Generic;
77
using System.Diagnostics;
8+
using System.Globalization;
89
using System.IO;
910
using System.IO.Pipelines;
1011
using System.Runtime.CompilerServices;
@@ -98,7 +99,7 @@ public async Task<Dictionary<string, StringValues>> ReadFormAsync(CancellationTo
9899
}
99100
catch
100101
{
101-
_pipeReader.AdvanceTo(buffer.Start);
102+
_pipeReader.AdvanceTo(buffer.Start, buffer.End);
102103
throw;
103104
}
104105
}
@@ -244,7 +245,8 @@ private void ParseValuesSlow(
244245
if (!isFinalBlock)
245246
{
246247
// Don't buffer indefinately
247-
if ((uint)(sequenceReader.Consumed - consumedBytes) > (uint)KeyLengthLimit + (uint)ValueLengthLimit)
248+
// +2 to account for '&' and '='
249+
if ((sequenceReader.Length - consumedBytes) > (long)KeyLengthLimit + (long)ValueLengthLimit + 2)
248250
{
249251
ThrowKeyOrValueTooLargeException();
250252
}
@@ -308,17 +310,30 @@ private void ParseValuesSlow(
308310

309311
private void ThrowKeyOrValueTooLargeException()
310312
{
311-
throw new InvalidDataException($"Form key length limit {KeyLengthLimit} or value length limit {ValueLengthLimit} exceeded.");
313+
throw new InvalidDataException(
314+
string.Format(
315+
CultureInfo.CurrentCulture,
316+
Resources.FormPipeReader_KeyOrValueTooLarge,
317+
KeyLengthLimit,
318+
ValueLengthLimit));
312319
}
313320

314321
private void ThrowKeyTooLargeException()
315322
{
316-
throw new InvalidDataException($"Form key length limit {KeyLengthLimit} exceeded.");
323+
throw new InvalidDataException(
324+
string.Format(
325+
CultureInfo.CurrentCulture,
326+
Resources.FormPipeReader_KeyTooLarge,
327+
KeyLengthLimit));
317328
}
318329

319330
private void ThrowValueTooLargeException()
320331
{
321-
throw new InvalidDataException($"Form value length limit {ValueLengthLimit} exceeded.");
332+
throw new InvalidDataException(
333+
string.Format(
334+
CultureInfo.CurrentCulture,
335+
Resources.FormPipeReader_ValueTooLarge,
336+
ValueLengthLimit));
322337
}
323338

324339
private string GetDecodedStringFromReadOnlySequence(in ReadOnlySequence<byte> ros)

‎src/Http/WebUtilities/src/Resources.resx

Lines changed: 36 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<root>
3-
<!--
4-
Microsoft ResX Schema
5-
3+
<!--
4+
Microsoft ResX Schema
5+
66
Version 2.0
7-
8-
The primary goals of this format is to allow a simple XML format
9-
that is mostly human readable. The generation and parsing of the
10-
various data types are done through the TypeConverter classes
7+
8+
The primary goals of this format is to allow a simple XML format
9+
that is mostly human readable. The generation and parsing of the
10+
various data types are done through the TypeConverter classes
1111
associated with the data types.
12-
12+
1313
Example:
14-
14+
1515
... ado.net/XML headers & schema ...
1616
<resheader name="resmimetype">text/microsoft-resx</resheader>
1717
<resheader name="version">2.0</resheader>
@@ -26,36 +26,36 @@
2626
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
2727
<comment>This is a comment</comment>
2828
</data>
29-
30-
There are any number of "resheader" rows that contain simple
29+
30+
There are any number of "resheader" rows that contain simple
3131
name/value pairs.
32-
33-
Each data row contains a name, and value. The row also contains a
34-
type or mimetype. Type corresponds to a .NET class that support
35-
text/value conversion through the TypeConverter architecture.
36-
Classes that don't support this are serialized and stored with the
32+
33+
Each data row contains a name, and value. The row also contains a
34+
type or mimetype. Type corresponds to a .NET class that support
35+
text/value conversion through the TypeConverter architecture.
36+
Classes that don't support this are serialized and stored with the
3737
mimetype set.
38-
39-
The mimetype is used for serialized objects, and tells the
40-
ResXResourceReader how to depersist the object. This is currently not
38+
39+
The mimetype is used for serialized objects, and tells the
40+
ResXResourceReader how to depersist the object. This is currently not
4141
extensible. For a given mimetype the value must be set accordingly:
42-
43-
Note - application/x-microsoft.net.object.binary.base64 is the format
44-
that the ResXResourceWriter will generate, however the reader can
42+
43+
Note - application/x-microsoft.net.object.binary.base64 is the format
44+
that the ResXResourceWriter will generate, however the reader can
4545
read any of the formats listed below.
46-
46+
4747
mimetype: application/x-microsoft.net.object.binary.base64
48-
value : The object must be serialized with
48+
value : The object must be serialized with
4949
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
5050
: and then encoded with base64 encoding.
51-
51+
5252
mimetype: application/x-microsoft.net.object.soap.base64
53-
value : The object must be serialized with
53+
value : The object must be serialized with
5454
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
5555
: and then encoded with base64 encoding.
5656
5757
mimetype: application/x-microsoft.net.object.bytearray.base64
58-
value : The object must be serialized into a byte array
58+
value : The object must be serialized into a byte array
5959
: using a System.ComponentModel.TypeConverter
6060
: and then encoded with base64 encoding.
6161
-->
@@ -117,6 +117,15 @@
117117
<resheader name="writer">
118118
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
119119
</resheader>
120+
<data name="FormPipeReader_KeyOrValueTooLarge" xml:space="preserve">
121+
<value>Form key length limit {0} or value length limit {1} exceeded.</value>
122+
</data>
123+
<data name="FormPipeReader_KeyTooLarge" xml:space="preserve">
124+
<value>Form key length limit {0} exceeded.</value>
125+
</data>
126+
<data name="FormPipeReader_ValueTooLarge" xml:space="preserve">
127+
<value>Form value length limit {0} exceeded.</value>
128+
</data>
120129
<data name="HttpRequestStreamReader_StreamNotReadable" xml:space="preserve">
121130
<value>The stream must support reading.</value>
122131
</data>

‎src/Http/WebUtilities/test/FormPipeReaderTests.cs

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
using System;
55
using System.Buffers;
66
using System.Collections.Generic;
7+
using System.Globalization;
78
using System.IO;
89
using System.IO.Pipelines;
910
using System.Text;
@@ -178,6 +179,34 @@ public async Task ReadFormAsync_ValueLengthLimitExceeded_Throw()
178179
Assert.Equal(Encoding.UTF8.GetBytes(content), readResult.Buffer.ToArray());
179180
}
180181

182+
[Fact]
183+
public void ReadFormAsync_ChunkedDataNoDelimiter_ThrowsEarly()
184+
{
185+
byte[] bytes = CreateBytes_NoDelimiter((10 * 1024) +2);
186+
var readOnlySequence = ReadOnlySequenceFactory.SegmentPerByteFactory.CreateWithContent(bytes);
187+
188+
KeyValueAccumulator accumulator = default;
189+
190+
var valueLengthLimit = 1024;
191+
var keyLengthLimit = 10;
192+
193+
var formReader = new FormPipeReader(null!)
194+
{
195+
ValueLengthLimit = valueLengthLimit,
196+
KeyLengthLimit = keyLengthLimit
197+
};
198+
199+
var exception = Assert.Throws<InvalidDataException>(
200+
() => formReader.ParseFormValues(ref readOnlySequence, ref accumulator, isFinalBlock: false));
201+
// Make sure that FormPipeReader throws an exception after hitting KeyLengthLimit + ValueLengthLimit,
202+
// Rather than after reading the entire request.
203+
Assert.Equal(string.Format(
204+
CultureInfo.CurrentCulture,
205+
Resources.FormPipeReader_KeyOrValueTooLarge,
206+
keyLengthLimit,
207+
valueLengthLimit), exception.Message);
208+
}
209+
181210
// https://en.wikipedia.org/wiki/Percent-encoding
182211
[Theory]
183212
[InlineData("++=hello", " ", "hello")]
@@ -569,5 +598,17 @@ private static async Task<PipeReader> MakePipeReader(string text)
569598
bodyPipe.Writer.Complete();
570599
return bodyPipe.Reader;
571600
}
601+
602+
private static byte[] CreateBytes_NoDelimiter(int n)
603+
{
604+
//Create the bytes of "key=vvvvvvvv....", of length n
605+
var keyValue = new char[n];
606+
Array.Fill(keyValue, 'v');
607+
keyValue[0] = 'k';
608+
keyValue[1] = 'e';
609+
keyValue[2] = 'y';
610+
keyValue[3] = '=';
611+
return Encoding.UTF8.GetBytes(keyValue);
612+
}
572613
}
573614
}

‎src/Http/WebUtilities/test/FormReaderTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,4 +227,4 @@ private static Stream MakeStream(bool bufferRequest, string text)
227227
return body;
228228
}
229229
}
230-
}
230+
}

0 commit comments

Comments
 (0)