mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-08-26 09:18:37 +09:00
Potential attack: session supercookie. [Moz Notes](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c5): "The problem is that for unknown header names we store the first one we see and then later we case-insensitively match against that name *globally*. That means you can track if a user agent has already seen a certain header name used (by using a different casing and observing whether it gets normalized). This would allow you to see if a user has used a sensitive service that uses custom header names, or allows you to track a user across sites, by teaching the browser about a certain header case once and then observing if different casings get normalized to that. What we should do instead is only store the casing for a header name for each header list and not globally. That way it only leaks where it's expected (and necessary) to leak." [Moz fix note](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c8): "nsHttpAtom now holds the old nsHttpAtom and a string that is case sensitive (only for not standard headers). So nsHttpAtom holds a pointer to a header name. (header names are store on a static structure). This is how it used to be. I left that part the same but added a nsCString which holds a string that was used to resoled the header name. So when we parse headers we call ResolveHeader with a char*. If it is a new header name the char* will be stored in a HttpHeapAtom, nsHttpAtom::_val will point to HttpHeapAtom::value and the same strings will be stored in mLocalCaseSensitiveHeader. For the first resolve request they will be the same but for the following maybe not. At the end this nsHttpAtom will be stored in nsHttpHeaderArray. For all operation we will used the old char* except when we are returning it to a script using VisitHeaders." |
||
|---|---|---|
| .. | ||
| AltDataOutputStreamChild.cpp | ||
| AltDataOutputStreamChild.h | ||
| AltDataOutputStreamParent.cpp | ||
| AltDataOutputStreamParent.h | ||
| AlternateServices.cpp | ||
| AlternateServices.h | ||
| ASpdySession.cpp | ||
| ASpdySession.h | ||
| CacheControlParser.cpp | ||
| CacheControlParser.h | ||
| ConnectionDiagnostics.cpp | ||
| http2_huffman_table.txt | ||
| Http2Compression.cpp | ||
| Http2Compression.h | ||
| Http2HuffmanIncoming.h | ||
| Http2HuffmanOutgoing.h | ||
| Http2Push.cpp | ||
| Http2Push.h | ||
| Http2Session.cpp | ||
| Http2Session.h | ||
| Http2Stream.cpp | ||
| Http2Stream.h | ||
| HttpBaseChannel.cpp | ||
| HttpBaseChannel.h | ||
| HttpChannelChild.cpp | ||
| HttpChannelChild.h | ||
| HttpChannelParent.cpp | ||
| HttpChannelParent.h | ||
| HttpChannelParentListener.cpp | ||
| HttpChannelParentListener.h | ||
| HttpInfo.cpp | ||
| HttpInfo.h | ||
| HttpLog.h | ||
| InterceptedChannel.cpp | ||
| InterceptedChannel.h | ||
| make_incoming_tables.py | ||
| make_outgoing_tables.py | ||
| moz.build | ||
| nsAHttpConnection.h | ||
| nsAHttpTransaction.h | ||
| nsCORSListenerProxy.cpp | ||
| nsCORSListenerProxy.h | ||
| nsHttp.cpp | ||
| nsHttp.h | ||
| nsHttpActivityDistributor.cpp | ||
| nsHttpActivityDistributor.h | ||
| nsHttpAtomList.h | ||
| nsHttpAuthCache.cpp | ||
| nsHttpAuthCache.h | ||
| nsHttpAuthManager.cpp | ||
| nsHttpAuthManager.h | ||
| nsHttpBasicAuth.cpp | ||
| nsHttpBasicAuth.h | ||
| nsHttpChannel.cpp | ||
| nsHttpChannel.h | ||
| nsHttpChannelAuthProvider.cpp | ||
| nsHttpChannelAuthProvider.h | ||
| nsHttpChunkedDecoder.cpp | ||
| nsHttpChunkedDecoder.h | ||
| nsHttpConnection.cpp | ||
| nsHttpConnection.h | ||
| nsHttpConnectionInfo.cpp | ||
| nsHttpConnectionInfo.h | ||
| nsHttpConnectionMgr.cpp | ||
| nsHttpConnectionMgr.h | ||
| nsHttpDigestAuth.cpp | ||
| nsHttpDigestAuth.h | ||
| nsHttpHandler.cpp | ||
| nsHttpHandler.h | ||
| nsHttpHeaderArray.cpp | ||
| nsHttpHeaderArray.h | ||
| nsHttpNTLMAuth.cpp | ||
| nsHttpNTLMAuth.h | ||
| nsHttpPipeline.cpp | ||
| nsHttpPipeline.h | ||
| nsHttpRequestHead.cpp | ||
| nsHttpRequestHead.h | ||
| nsHttpResponseHead.cpp | ||
| nsHttpResponseHead.h | ||
| nsHttpTransaction.cpp | ||
| nsHttpTransaction.h | ||
| nsICorsPreflightCallback.h | ||
| nsIHttpActivityObserver.idl | ||
| nsIHttpAuthenticableChannel.idl | ||
| nsIHttpAuthenticator.idl | ||
| nsIHttpAuthManager.idl | ||
| nsIHttpChannel.idl | ||
| nsIHttpChannelAuthProvider.idl | ||
| nsIHttpChannelChild.idl | ||
| nsIHttpChannelInternal.idl | ||
| nsIHttpEventSink.idl | ||
| nsIHttpHeaderVisitor.idl | ||
| nsIHttpProtocolHandler.idl | ||
| nsIWellKnownOpportunisticUtils.idl | ||
| NullHttpChannel.cpp | ||
| NullHttpChannel.h | ||
| NullHttpTransaction.cpp | ||
| NullHttpTransaction.h | ||
| PAltDataOutputStream.ipdl | ||
| PHttpChannel.ipdl | ||
| PHttpChannelParams.h | ||
| PSpdyPush.h | ||
| README | ||
| TimingStruct.h | ||
| TunnelUtils.cpp | ||
| TunnelUtils.h | ||
| UserAgentOverrides.jsm | ||
| UserAgentUpdates.jsm | ||
| WellKnownOpportunisticUtils.js | ||
| WellKnownOpportunisticUtils.manifest | ||
Darin Fisher
darin@netscape.com
8/8/2001
HTTP DESIGN NOTES
CLASS BREAKDOWN
nsHttpHandler
- implements nsIProtocolHandler
- manages preferences
- owns the authentication cache
- holds references to frequently used services
nsHttpChannel
- implements nsIHttpChannel
- talks to the cache
- initiates http transactions
- processes http response codes
- intercepts progress notifications
nsHttpConnection
- implements nsIStreamListener & nsIStreamProvider
- talks to the socket transport service
- feeds data to its transaction object
- routes progress notifications
nsHttpConnectionInfo
- identifies a connection
nsHttpTransaction
- implements nsIRequest
- encapsulates a http request and response
- parses incoming data
nsHttpChunkedDecoder
- owned by a transaction
- removes chunked decoding
nsHttpRequestHead
- owns a nsHttpHeaderArray
- knows how to fill a request buffer
nsHttpResponseHead
- owns a nsHttpHeaderArray
- knows how to parse response lines
- performs common header manipulations/calculations
nsHttpHeaderArray
- stores http "<header>:<value>" pairs
nsHttpAuthCache
- stores authentication credentials for http auth domains
nsHttpBasicAuth
- implements nsIHttpAuthenticator
- generates BASIC auth credentials from user:pass
ATOMS
nsHttp:: (header namespace)
eg. nsHttp::Content_Length
TRANSACTION MODEL
InitiateTransaction -> ActivateConnection -> AsyncWrite, AsyncRead
The channel creates transactions, and passes them to the handler via
InitiateTransaction along with a nsHttpConnectionInfo object
identifying the requested connection. The handler either dispatches
the transaction immediately or queues it up to be dispatched later,
depending on whether or not the limit on the number of connections
to the requested server has been reached. Once the transaction can
be run, the handler looks for an idle connection or creates a new
connection, and then (re)activates the connection, assigning it the
new transaction.
Once activated the connection ensures that it has a socket transport,
and then calls AsyncWrite and AsyncRead on the socket transport. This
begins the process of talking to the server. To minimize buffering,
socket transport thread-proxying is completely disabled (using the flags
DONT_PROXY_LISTENER | DONT_PROXY_PROVIDER | DONT_PROXY_OBSERVER with
both AsyncWrite and AsyncRead). This means that the nsHttpConnection's
OnStartRequest, OnDataAvailable, OnDataWritable, and OnStopRequest
methods will execute on the socket transport thread.
The transaction defines (non-virtual) OnDataReadable, OnDataWritable, and
OnStopTransaction methods, which the connection calls in response to
its OnDataAvailable, OnDataWritable, and OnStopRequest methods, respectively.
The transaction owns a nsStreamListenerProxy created by the channel, which
it uses to transfer data from the socket thread over to the client's thread.
To mimize buffering, the transaction implements nsIInputStream, and passes
itself to the stream listener proxy's OnDataAvailable. In this way, we
have effectively wedged the response parsing between the socket and the
thread proxy's buffer. When read, the transaction turns around and reads
from the socket using the buffer passed to it. The transaction scans the
buffer for headers, removes them as they are detected, and copies the headers
into its nsHttpResponseHead object. The rest of the data remains in the
buffer, and is proxied over to the client's thread to be handled first by the
http channel and eventually by the client.
There are several other major design factors, including:
- transaction cancelation
- progress notification
- SSL tunneling
- chunked decoding
- thread safety
- premature EOF detection and transaction restarting
- pipelining (not yet implemented)
CACHING
<EOF>