Re: [webappsec-testsuite] CORS tests and null bytes in origin

On Sun, Apr 14, 2013 at 12:17 AM, Odin Hørthe Omdal <odinho@opera.com> wrote:
> I read it as it'll give a parse error.  But it is not explicitly enough
> mentioned to make me understand it.  I did not write those tests to that
> language that exists there though, but the newer specs should hopefully
> be more web compatible than that of old.

It's not so much about parse error or not. Origin can never contain a
0x00 byte so if Access-Control-Allow-Origin contains one they should
never match, because the values are not identical.


On Sun, Apr 14, 2013 at 1:12 AM, Hill, Brad <bhill@paypal-inc.com> wrote:
> I think these are tests are therefore even more questionable since they seem to depend on server behavior in this regard.

That calls for fixing the setup and not crippling test coverage I'd say.


--
http://annevankesteren.nl/

Received on Sunday, 14 April 2013 07:36:50 UTC