fix(ext/fetch): avoid panic when header is invalid (#12244)

1 files changed, 158 insertions, 6 deletions

diff --git a/tools/wpt/expectation.json b/tools/wpt/expectation.json
index c7879ff82..5235c1828 100644
--- a/tools/wpt/expectation.json
+++ b/tools/wpt/expectation.json
@@ -14034,17 +14034,169 @@
         ]
       },
       "headers": {
-        "header-values-normalize.any.html": false,
-        "header-values-normalize.any.worker.html": false,
-        "header-values.any.html": false,
-        "header-values.any.worker.html": false,
+        "header-values-normalize.any.html": [
+          "XMLHttpRequest with value %00",
+          "XMLHttpRequest with value %01",
+          "XMLHttpRequest with value %02",
+          "XMLHttpRequest with value %03",
+          "XMLHttpRequest with value %04",
+          "XMLHttpRequest with value %05",
+          "XMLHttpRequest with value %06",
+          "XMLHttpRequest with value %07",
+          "XMLHttpRequest with value %08",
+          "XMLHttpRequest with value %09",
+          "XMLHttpRequest with value %0A",
+          "XMLHttpRequest with value %0D",
+          "XMLHttpRequest with value %0E",
+          "XMLHttpRequest with value %0F",
+          "XMLHttpRequest with value %10",
+          "XMLHttpRequest with value %11",
+          "XMLHttpRequest with value %12",
+          "XMLHttpRequest with value %13",
+          "XMLHttpRequest with value %14",
+          "XMLHttpRequest with value %15",
+          "XMLHttpRequest with value %16",
+          "XMLHttpRequest with value %17",
+          "XMLHttpRequest with value %18",
+          "XMLHttpRequest with value %19",
+          "XMLHttpRequest with value %1A",
+          "XMLHttpRequest with value %1B",
+          "XMLHttpRequest with value %1C",
+          "XMLHttpRequest with value %1D",
+          "XMLHttpRequest with value %1E",
+          "XMLHttpRequest with value %1F",
+          "XMLHttpRequest with value %20",
+          "fetch() with value %01",
+          "fetch() with value %02",
+          "fetch() with value %03",
+          "fetch() with value %04",
+          "fetch() with value %05",
+          "fetch() with value %06",
+          "fetch() with value %07",
+          "fetch() with value %08",
+          "fetch() with value %0E",
+          "fetch() with value %0F",
+          "fetch() with value %10",
+          "fetch() with value %11",
+          "fetch() with value %12",
+          "fetch() with value %13",
+          "fetch() with value %14",
+          "fetch() with value %15",
+          "fetch() with value %16",
+          "fetch() with value %17",
+          "fetch() with value %18",
+          "fetch() with value %19",
+          "fetch() with value %1A",
+          "fetch() with value %1B",
+          "fetch() with value %1C",
+          "fetch() with value %1D",
+          "fetch() with value %1E",
+          "fetch() with value %1F"
+        ],
+        "header-values-normalize.any.worker.html": [
+          "fetch() with value %01",
+          "fetch() with value %02",
+          "fetch() with value %03",
+          "fetch() with value %04",
+          "fetch() with value %05",
+          "fetch() with value %06",
+          "fetch() with value %07",
+          "fetch() with value %08",
+          "fetch() with value %0E",
+          "fetch() with value %0F",
+          "fetch() with value %10",
+          "fetch() with value %11",
+          "fetch() with value %12",
+          "fetch() with value %13",
+          "fetch() with value %14",
+          "fetch() with value %15",
+          "fetch() with value %16",
+          "fetch() with value %17",
+          "fetch() with value %18",
+          "fetch() with value %19",
+          "fetch() with value %1A",
+          "fetch() with value %1B",
+          "fetch() with value %1C",
+          "fetch() with value %1D",
+          "fetch() with value %1E",
+          "fetch() with value %1F"
+        ],
+        "header-values.any.html": [
+          "XMLHttpRequest with value x%00x needs to throw",
+          "XMLHttpRequest with value x%0Ax needs to throw",
+          "XMLHttpRequest with value x%0Dx needs to throw",
+          "XMLHttpRequest with all valid values",
+          "fetch() with all valid values"
+        ],
+        "header-values.any.worker.html": [
+          "fetch() with all valid values"
+        ],
         "headers-basic.any.html": true,
         "headers-casing.any.html": true,
         "headers-combine.any.html": true,
         "headers-errors.any.html": true,
         "headers-normalize.any.html": true,
         "headers-record.any.html": true,
-        "headers-structure.any.html": true
+        "headers-structure.any.html": true,
+        "headers-basic.any.worker.html": false,
+        "headers-casing.any.worker.html": true,
+        "headers-combine.any.worker.html": true,
+        "headers-errors.any.worker.html": true,
+        "headers-no-cors.any.html": [
+          "\"no-cors\" Headers object cannot have accept set to sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have accept-language set to sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have content-language set to sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have accept set to , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have accept-language set to , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have content-language set to , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have content-type set to text/plain;ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, text/plain",
+          "\"no-cors\" Headers object cannot have accept/\" as header",
+          "\"no-cors\" Headers object cannot have accept/012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678 as header",
+          "\"no-cors\" Headers object cannot have accept-language/\u0001 as header",
+          "\"no-cors\" Headers object cannot have accept-language/@ as header",
+          "\"no-cors\" Headers object cannot have authorization/basics as header",
+          "\"no-cors\" Headers object cannot have content-language/\u0001 as header",
+          "\"no-cors\" Headers object cannot have content-language/@ as header",
+          "\"no-cors\" Headers object cannot have content-type/text/html as header",
+          "\"no-cors\" Headers object cannot have content-type/text/plain; long=0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901 as header",
+          "\"no-cors\" Headers object cannot have range/bytes 0- as header",
+          "\"no-cors\" Headers object cannot have test/hi as header",
+          "\"no-cors\" Headers object cannot have dpr/2 as header",
+          "\"no-cors\" Headers object cannot have downlink/1 as header",
+          "\"no-cors\" Headers object cannot have save-data/on as header",
+          "\"no-cors\" Headers object cannot have viewport-width/100 as header",
+          "\"no-cors\" Headers object cannot have width/100 as header",
+          "\"no-cors\" Headers object cannot have unknown/doesitmatter as header"
+        ],
+        "headers-no-cors.any.worker.html": [
+          "\"no-cors\" Headers object cannot have accept set to sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have accept-language set to sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have content-language set to sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have accept set to , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have accept-language set to , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have content-language set to , sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss",
+          "\"no-cors\" Headers object cannot have content-type set to text/plain;ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss, text/plain",
+          "\"no-cors\" Headers object cannot have accept/\" as header",
+          "\"no-cors\" Headers object cannot have accept/012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678 as header",
+          "\"no-cors\" Headers object cannot have accept-language/\u0001 as header",
+          "\"no-cors\" Headers object cannot have accept-language/@ as header",
+          "\"no-cors\" Headers object cannot have authorization/basics as header",
+          "\"no-cors\" Headers object cannot have content-language/\u0001 as header",
+          "\"no-cors\" Headers object cannot have content-language/@ as header",
+          "\"no-cors\" Headers object cannot have content-type/text/html as header",
+          "\"no-cors\" Headers object cannot have content-type/text/plain; long=0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901 as header",
+          "\"no-cors\" Headers object cannot have range/bytes 0- as header",
+          "\"no-cors\" Headers object cannot have test/hi as header",
+          "\"no-cors\" Headers object cannot have dpr/2 as header",
+          "\"no-cors\" Headers object cannot have downlink/1 as header",
+          "\"no-cors\" Headers object cannot have save-data/on as header",
+          "\"no-cors\" Headers object cannot have viewport-width/100 as header",
+          "\"no-cors\" Headers object cannot have width/100 as header",
+          "\"no-cors\" Headers object cannot have unknown/doesitmatter as header"
+        ],
+        "headers-normalize.any.worker.html": true,
+        "headers-record.any.worker.html": true,
+        "headers-structure.any.worker.html": true
       },
       "basic": {
         "request-head.any.html": true,
@@ -15190,4 +15342,4 @@
       "Pattern: [] Inputs: []"
     ]
   }
-}
+}
\ No newline at end of file