netty5/codec-http/src/main/java/io/netty/handler/codec/http/HttpRequest.java
Stephane Landelle 97d871a755 Validate cookie name and value characters Motivation:
RFC6265 specifies which characters are allowed in a cookie name and value.

Netty is currently too lax, which can used for HttpOnly escaping.

Modification:

In ServerCookieDecoder: discard cookie key-value pairs that contain invalid characters.
In ClientCookieEncoder: throw an exception when trying to encode cookies with invalid characters.

Result:

The problem described in the motivation section is fixed.
2015-05-07 06:33:36 +02:00

79 lines
2.4 KiB
Java

/*
* Copyright 2012 The Netty Project
*
* The Netty Project licenses this file to you under the Apache License,
* version 2.0 (the "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations
* under the License.
*/
package io.netty.handler.codec.http;
/**
* An HTTP request.
*
* <h3>Accessing Query Parameters and Cookie</h3>
* <p>
* Unlike the Servlet API, a query string is constructed and decomposed by
* {@link QueryStringEncoder} and {@link QueryStringDecoder}.
*
* {@link io.netty.handler.codec.http.cookie.Cookie} support is also provided
* separately via {@link io.netty.handler.codec.http.cookie.ServerCookieDecoder},
* {@link io.netty.handler.codec.http.cookie.ClientCookieDecoder},
* {@link io.netty.handler.codec.http.cookie.ServerCookieEncoder},
* and {@link @io.netty.handler.codec.http.cookie.ClientCookieEncoder}.
*
* @see HttpResponse
* @see io.netty.handler.codec.http.cookie.ServerCookieDecoder
* @see io.netty.handler.codec.http.cookie.ClientCookieDecoder
* @see io.netty.handler.codec.http.cookie.ServerCookieEncoder
* @see io.netty.handler.codec.http.cookie.ClientCookieEncoder
*/
public interface HttpRequest extends HttpMessage {
/**
* @deprecated Use {@link #method()} instead.
*/
@Deprecated
HttpMethod getMethod();
/**
* Returns the {@link HttpMethod} of this {@link HttpRequest}.
*
* @return The {@link HttpMethod} of this {@link HttpRequest}
*/
HttpMethod method();
/**
* Set the {@link HttpMethod} of this {@link HttpRequest}.
*/
HttpRequest setMethod(HttpMethod method);
/**
* @deprecated Use {@link #uri()} instead.
*/
@Deprecated
String getUri();
/**
* Returns the requested URI (or alternatively, path)
*
* @return The URI being requested
*/
String uri();
/**
* Set the requested URI (or alternatively, path)
*/
HttpRequest setUri(String uri);
@Override
HttpRequest setProtocolVersion(HttpVersion version);
}