Skip to content

Commit abb2bb1

Browse files
authored
Validate request methods against a regex (#512)
Fixes #511
1 parent ca730a3 commit abb2bb1

File tree

4 files changed

+25
-2
lines changed

4 files changed

+25
-2
lines changed

CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
## 0.13.3-dev
22

3+
* Validate that the `method` parameter of BaseRequest is a valid "token".
4+
35
## 0.13.2
46

57
* Add `package:http/retry.dart` with `RetryClient`. This is the same

lib/src/base_request.dart

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,17 @@ abstract class BaseRequest {
8888
bool get finalized => _finalized;
8989
bool _finalized = false;
9090

91-
BaseRequest(this.method, this.url)
92-
: headers = LinkedHashMap(
91+
static final _tokenRE = RegExp(r"^[\w!#%&'*+\-.^`|~]+$");
92+
static String _validateMethod(String method) {
93+
if (!_tokenRE.hasMatch(method)) {
94+
throw ArgumentError.value(method, 'method', 'Not a valid method');
95+
}
96+
return method;
97+
}
98+
99+
BaseRequest(String method, this.url)
100+
: method = _validateMethod(method),
101+
headers = LinkedHashMap(
93102
equals: (key1, key2) => key1.toLowerCase() == key2.toLowerCase(),
94103
hashCode: (key) => key.toLowerCase().hashCode);
95104

test/request_test.dart

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,4 +334,10 @@ void main() {
334334
expect(request.toString(), 'POST $dummyUrl');
335335
});
336336
});
337+
338+
group('#method', () {
339+
test('must be a token', () {
340+
expect(() => http.Request('LLAMA[0]', dummyUrl), throwsArgumentError);
341+
});
342+
});
337343
}

test/streamed_request_test.dart

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,10 @@ void main() {
2424
expect(() => request.contentLength = 10, throwsStateError);
2525
});
2626
});
27+
group('#method', () {
28+
test('must be a token', () {
29+
expect(() => http.StreamedRequest('SUPER LLAMA', dummyUrl),
30+
throwsArgumentError);
31+
});
32+
});
2733
}

0 commit comments

Comments
 (0)