[httpd] XSS prevention did not work for hex-encoded URL's.

OTP-9655
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r14/OTP-9655' into bmk/inets/inets572_integration

1 files changed, 66 insertions, 43 deletions

diff --git a/lib/inets/test/httpc_SUITE.erl b/lib/inets/test/httpc_SUITE.erl
index 6edd5371af..adea1666b4 100644
--- a/lib/inets/test/httpc_SUITE.erl
+++ b/lib/inets/test/httpc_SUITE.erl
@@ -253,10 +253,10 @@ init_per_testcase(Case, Config) ->
     init_per_testcase(Case, 2, Config).
 
 init_per_testcase(Case, Timeout, Config) ->
-    io:format(user, "~n~n*** INIT ~w:~w[~w] ***~n~n", 
-	      [?MODULE, Case, Timeout]),
-    PrivDir     = ?config(priv_dir, Config),
-    tsp("init_per_testcase -> stop inets"),
+    io:format(user, 
+	      "~n~n*** INIT ~w:~w[~w] ***"
+	      "~n~n", [?MODULE, Case, Timeout]),
+    PrivDir = ?config(priv_dir, Config),
     application:stop(inets),
     Dog         = test_server:timetrap(inets_test_lib:minutes(Timeout)),
     TmpConfig   = lists:keydelete(watchdog, 1, Config),
@@ -296,12 +296,12 @@ init_per_testcase(Case, Timeout, Config) ->
 			    throw:{error, {failed_starting, App, _}} ->
 				SkipString = 
 				    "Could not start " ++ atom_to_list(App),
-				{skip, SkipString};
-			    _:X ->
+				skip(SkipString);
+			      _:X ->
 				SkipString = 
 				    lists:flatten(
 				      io_lib:format("Failed starting apps: ~p", [X])), 
-				{skip, SkipString}
+				skip(SkipString)
 			end;
 
 		    _ ->
@@ -330,14 +330,14 @@ init_per_testcase(Case, Timeout, Config) ->
 				    ],
 				case lists:member(Rest, BadCases) of
 				    true ->
-					[{skip, "TC and server not compatible"}|
+					[skip("TC and server not compatible") | 
 					 TmpConfig];
 				    false ->
 					inets:start(),
 					[{watchdog, Dog} | TmpConfig]
 				end;
 			    false ->
-				[{skip, "proxy not responding"} | TmpConfig]
+				[skip("proxy not responding") | TmpConfig]
 			end
 		end;
 
@@ -367,12 +367,11 @@ init_per_testcase(Case, Timeout, Config) ->
 			      io_lib:format("Failed starting apps: ~p", [X])), 
 			{skip, SkipString}
 		end;
+
 	    _ -> 
 		TmpConfig2 = lists:keydelete(local_server, 1, TmpConfig),
-		Server = 
-		    %% Will start inets 
-		    inets_test_lib:start_http_server(
-		      filename:join(PrivDir, IpConfFile)),
+		%% Will start inets 
+		Server = start_http_server(PrivDir, IpConfFile),
 		[{watchdog, Dog}, {local_server, Server} | TmpConfig2]
 	end,
     
@@ -397,7 +396,17 @@ init_per_testcase_ssl(Tag, PrivDir, SslConfFile, Config) ->
     tsp("init_per_testcase(~w) -> Server: ~p", [Tag, Server]),
     [{local_ssl_server, Server} | Config2].
 
-    
+    ProxyExceptions = ["localhost", ?IPV6_LOCAL_HOST], 
+    http:set_options([{proxy, {{?PROXY, ?PROXY_PORT}, ProxyExceptions}}]),
+    inets:enable_trace(max, io, httpc),
+    %% inets:enable_trace(max, io, all),
+    %% snmp:set_trace([gen_tcp, inet_tcp, prim_inet]),
+    NewConfig.
+
+start_http_server(ConfDir, ConfFile) ->
+    inets_test_lib:start_http_server( filename:join(ConfDir, ConfFile) ).
+
+
 %%--------------------------------------------------------------------
 %% Function: end_per_testcase(Case, Config) -> _
 %% Case - atom()
@@ -733,7 +742,7 @@ test_pipeline(URL) ->
 		    p("test_pipeline -> received reply for (async) request 2"),
 		    ok;
 		{http, Msg1} ->
-		    test_server:fail(Msg1)
+		    tsf(Msg1)
 	    end;
 	{http, {RequestId2, {{_, 200, _}, _, _}}} ->
 	    io:format("test_pipeline -> received reply for (async) request 2 - now wait for 1"),
@@ -742,14 +751,14 @@ test_pipeline(URL) ->
 		    io:format("test_pipeline -> received reply for (async) request 1"),
 		    ok;
 		{http, Msg2} ->
-		    test_server:fail(Msg2)
+		    tsf(Msg2)
 	    end;
 	{http, Msg3} ->
-	    test_server:fail(Msg3)
+	    tsf(Msg3)
     after 60000 ->
 	    receive Any1 ->
 		    tsp("received crap after timeout: ~n   ~p", [Any1]),
-		    test_server:fail({error, {timeout, Any1}})
+		    tsf({error, {timeout, Any1}})
 	    end
     end,
 
@@ -774,7 +783,7 @@ test_pipeline(URL) ->
      p("test_pipeline -> expect *no* reply for cancelled (async) request 4 (for 3 secs)"),
      receive
 	 {http, {RequestId3, _}} ->
-	     test_server:fail(http_cancel_request_failed)
+	     tsf(http_cancel_request_failed)
      after 3000 ->
 	     ok
      end,
@@ -787,11 +796,11 @@ test_pipeline(URL) ->
 		tsp("Receive : ~p", [Res]),
 		BinBody4;
 	    {http, Msg4} ->
-		test_server:fail(Msg4)
+		tsf(Msg4)
 	after 60000 ->
 		receive Any2 ->
 			tsp("received crap after timeout: ~n   ~p", [Any2]),
-			test_server:fail({error, {timeout, Any2}})
+			tsf({error, {timeout, Any2}})
 		end
 	end,
 
@@ -801,7 +810,7 @@ test_pipeline(URL) ->
     p("test_pipeline -> ensure no unexpected incomming"),
     receive
 	{http, Any} ->
-	    test_server:fail({unexpected_message, Any})
+	    tsf({unexpected_message, Any})
     after 500 ->
 	    ok
     end,
@@ -823,11 +832,11 @@ http_trace(Config) when is_list(Config) ->
 		{ok, {{_,200,_}, [_ | _], "TRACE /dummy.html" ++ _}} ->
 		    ok;
 		{ok, {{_,200,_}, [_ | _], WrongBody}} ->
-		    test_server:fail({wrong_body, WrongBody});
+		    tsf({wrong_body, WrongBody});
 		{ok, WrongReply} ->
-		    test_server:fail({wrong_reply, WrongReply});
+		    tsf({wrong_reply, WrongReply});
 		Error ->
-		    test_server:fail({failed, Error})
+		    tsf({failed, Error})
 	    end;
 	_ ->
 	    {skip, "Failed to start local http-server"}
@@ -850,7 +859,7 @@ http_async(Config) when is_list(Config) ->
 		    {http, {RequestId, {{_, 200, _}, _, BinBody}}} ->
 			BinBody;
 		    {http, Msg} ->
-			test_server:fail(Msg)
+			tsf(Msg)
 		end,
 	    
 	    inets_test_lib:check_body(binary_to_list(Body)),
@@ -860,7 +869,7 @@ http_async(Config) when is_list(Config) ->
 	    ok = httpc:cancel_request(NewRequestId),
 	    receive 
 		{http, {NewRequestId, _NewResult}} ->
-		    test_server:fail(http_cancel_request_failed)
+		    tsf(http_cancel_request_failed)
 	    after 3000 ->
 		    ok
 	    end;
@@ -909,7 +918,7 @@ http_save_to_file_async(Config) when is_list(Config) ->
 		{http, {RequestId, saved_to_file}} ->
 		    ok;
 		{http, Msg} ->
-		    test_server:fail(Msg)
+		    tsf(Msg)
 	    end,
 
 	    {ok, Bin} = file:read_file(FilePath), 
@@ -1482,10 +1491,10 @@ proxy_options(Config) when is_list(Config) ->
 			{value, {"allow", _}} ->
 			    ok;
 			_ ->
-			    test_server:fail(http_options_request_failed)
+			    tsf(http_options_request_failed)
 		    end;
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1506,7 +1515,7 @@ proxy_head(Config) when is_list(Config) ->
 		{ok, {{_,200, _}, [_ | _], []}} ->
 		    ok;
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1525,7 +1534,7 @@ proxy_get(Config) when is_list(Config) ->
 		{ok, {{_,200,_}, [_ | _], Body = [_ | _]}} ->
 		    inets_test_lib:check_body(Body);
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1604,7 +1613,7 @@ proxy_post(Config) when is_list(Config) ->
 		{ok, {{_,405,_}, [_ | _], [_ | _]}} ->
 		    ok;
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1629,7 +1638,7 @@ proxy_put(Config) when is_list(Config) ->
 		{ok, {{_,405,_}, [_ | _], [_ | _]}} ->
 		    ok;
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1654,7 +1663,7 @@ proxy_delete(Config) when is_list(Config) ->
 		{ok, {{_,404,_}, [_ | _], [_ | _]}} ->
 		    ok;
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1710,7 +1719,7 @@ proxy_auth(Config) when is_list(Config) ->
 		{ok, {{_,200, _}, [_ | _], [_|_]}} ->
 		    ok;
 		Unexpected ->
-		    test_server:fail({unexpected_result, Unexpected})
+		    tsf({unexpected_result, Unexpected})
 	    end;
 	Reason ->
 	    {skip, Reason}
@@ -1796,7 +1805,7 @@ http_stream(Config) when is_list(Config) ->
 	{http, {RequestId, stream_start, _Headers}} ->
 	    ok;
 	{http, Msg} ->
-	    test_server:fail(Msg)
+	    tsf(Msg)
     end,
 
     StreamedBody = receive_streamed_body(RequestId, <<>>),
@@ -1851,7 +1860,7 @@ once(URL) ->
 		  [RequestId, Pid]),
 		Pid;
 	    {http, Msg} ->
-		test_server:fail(Msg)
+		tsf(Msg)
 	end,
 
     tsp("once -> request handler: ~p", [NewPid]),
@@ -1894,7 +1903,7 @@ proxy_stream(Config) when is_list(Config) ->
 		{http, {RequestId, stream_start, _Headers}} ->
 		    ok;
 		{http, Msg} ->
-		    test_server:fail(Msg)
+		    tsf(Msg)
 	    end,
 	    
 	    StreamedBody = receive_streamed_body(RequestId, <<>>),
@@ -2979,7 +2988,7 @@ receive_streamed_body(RequestId, Body) ->
 	{http, {RequestId, stream_end, _Headers}} ->
 	    Body;
 	{http, Msg} ->	    
-	    test_server:fail(Msg)
+	    tsf(Msg)
     end.
 
 receive_streamed_body(RequestId, Body, Pid) ->
@@ -2993,7 +3002,7 @@ receive_streamed_body(RequestId, Body, Pid) ->
 	{http, {RequestId, stream_end, _Headers}} ->
 	    Body;
 	{http, Msg} ->	    
-	    test_server:fail(Msg)
+	    tsf(Msg)
     end.
 
 %% Perform a synchronous stop
@@ -3455,7 +3464,7 @@ handle_auth("Basic " ++ UserInfo, Challange, DefaultResponse) ->
     end.
 
 check_cookie([]) ->
-    test_server:fail(no_cookie_header);
+    tsf(no_cookie_header);
 check_cookie(["cookie:" ++ _Value | _]) ->
     ok;
 check_cookie([_Head | Tail]) ->
@@ -3515,7 +3524,21 @@ p(F, A) ->
 tsp(F) ->
     tsp(F, []).
 tsp(F, A) ->
-    test_server:format("~p ~p:" ++ F ++ "~n", [self(), ?MODULE | A]).
+    Timestamp = formated_timestamp(), 
+    test_server:format("** ~s ** ~p ~p:" ++ F ++ "~n", 
+		       [Timestamp, self(), ?MODULE | A]).
+
+formated_timestamp() ->
+    format_timestamp( os:timestamp() ).
+
+format_timestamp({_N1, _N2, N3} = Now) ->
+    {Date, Time}   = calendar:now_to_datetime(Now),
+    {YYYY,MM,DD}   = Date,
+    {Hour,Min,Sec} = Time,
+    FormatDate =
+        io_lib:format("~.4w:~.2.0w:~.2.0w ~.2.0w:~.2.0w:~.2.0w 4~w",
+                      [YYYY,MM,DD,Hour,Min,Sec,round(N3/1000)]),
+    lists:flatten(FormatDate).
 
 tsf(Reason) ->
     test_server:fail(Reason).