From bfb171c7839d2691e96854960b850a4d0b2ced87 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 11 Jun 2024 18:10:22 +0200 Subject: [PATCH 1/2] [network] Perform a case-insensitive match on special cookie prefixes. --- netwerk/cookie/nsCookieService.cpp | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp index 2549ffaccb..147103afd0 100644 --- a/netwerk/cookie/nsCookieService.cpp +++ b/netwerk/cookie/nsCookieService.cpp @@ -3346,7 +3346,7 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI, return newCookie; } if (!CheckHiddenPrefix(cookieAttributes)) { - COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "failed the CheckHiddenPrefix tests"); + COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "failed the hidden prefix tests"); return newCookie; } // magic prefix checks. MUST be run after CheckDomain() and CheckPath() @@ -4159,8 +4159,9 @@ nsCookieService::CheckHiddenPrefix(nsCookieAttributes &aCookie) { static const int kSecureLen = sizeof( kSecure ) - 1; static const int kHostLen = sizeof( kHost ) - 1; - bool isSecure = strncmp( aCookie.value.get(), kSecure, kSecureLen ) == 0; - bool isHost = strncmp( aCookie.value.get(), kHost, kHostLen ) == 0; + // As of RFC 6265 bis-11 draft, this should be a case *in*sensitive match. + bool isSecure = nsCRT::strncasecmp(aCookie.value.get(), kSecure, kSecureLen) == 0; + bool isHost = nsCRT::strncasecmp(aCookie.value.get(), kHost, kHostLen) == 0; if (isSecure || isHost) { return false; @@ -4186,8 +4187,9 @@ nsCookieService::CheckPrefixes(nsCookieAttributes &aCookie, static const int kSecureLen = sizeof( kSecure ) - 1; static const int kHostLen = sizeof( kHost ) - 1; - bool isSecure = strncmp( aCookie.value.get(), kSecure, kSecureLen ) == 0; - bool isHost = strncmp( aCookie.value.get(), kHost, kHostLen ) == 0; + // As of RFC 6265 bis-11 draft, this should be a case *in*sensitive match. + bool isSecure = nsCRT::strncasecmp(aCookie.value.get(), kSecure, kSecureLen) == 0; + bool isHost = nsCRT::strncasecmp(aCookie.value.get(), kHost, kHostLen) == 0; if ( !isSecure && !isHost ) { // not one of the magic prefixes: carry on From bcdf7dc8459f6830fab10b7c7f480cfe309c2280 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 11 Jun 2024 19:01:24 +0200 Subject: [PATCH 2/2] [network] Avoid accessing raw pointers in nsTransportEventSinkProxy. --- netwerk/base/nsTransportUtils.cpp | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/netwerk/base/nsTransportUtils.cpp b/netwerk/base/nsTransportUtils.cpp index e29bbfdab5..1ff081ad27 100644 --- a/netwerk/base/nsTransportUtils.cpp +++ b/netwerk/base/nsTransportUtils.cpp @@ -27,24 +27,22 @@ public: : mSink(sink) , mTarget(target) , mLock("nsTransportEventSinkProxy.mLock") - , mLastEvent(nullptr) { - NS_ADDREF(mSink); } private: virtual ~nsTransportEventSinkProxy() { // our reference to mSink could be the last, so be sure to release - // it on the target thread. otherwise, we could get into trouble. - NS_ProxyRelease(mTarget, dont_AddRef(mSink)); + // it on the target thread, otherwise, we could get into trouble. + NS_ProxyRelease(mTarget, mSink.forget()); } public: - nsITransportEventSink *mSink; + nsCOMPtr mSink; nsCOMPtr mTarget; Mutex mLock; - nsTransportStatusEvent *mLastEvent; + RefPtr mLastEvent; }; class nsTransportStatusEvent : public Runnable @@ -70,12 +68,14 @@ public: // if not coalescing all, then last event may not equal self! { MutexAutoLock lock(mProxy->mLock); - if (mProxy->mLastEvent == this) - mProxy->mLastEvent = nullptr; + if (mProxy->mLastEvent == this) { + mProxy->mLastEvent = nullptr; + } } mProxy->mSink->OnTransportStatus(mTransport, mStatus, mProgress, mProgressMax); + mProxy = nullptr; return NS_OK; }