-
Notifications
You must be signed in to change notification settings - Fork 27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Warn about asterisk being used in media type. #182
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I know I'm not an approver here, but I came across this earlier and a few things caught my eye 😀
@@ -14,7 +14,8 @@ | |||
+ "|scripts|top-navigation)$"); | |||
public static final Pattern requireSriForEnumeratedTokenPattern = Pattern | |||
.compile("^(?:script|style)$", Pattern.CASE_INSENSITIVE); | |||
public static final Pattern mediaTypePattern = Pattern.compile("^(?<type>[^/]+)/(?<subtype>[^/]+)$"); | |||
public static final Pattern mediaTypePattern = Pattern.compile("^(?<type>[a-zA-Z0-9!#$%^&*\\-_+{}|'.`~]+)/(?<subtype>[a-zA-Z0-9!#$%^&*\\-_+{}|'.`~]+)$"); | |||
// public static final Pattern mediaTypePattern = Pattern.compile("[a-zA-Z0-9!#$%^&\\*-_\\+{}\\|'.`~]+/[a-zA-Z0-9!#$%^&\\*-_\\+{}\\|'.`~]+"); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Drop this commented one?
@@ -252,6 +252,8 @@ private boolean eat(@Nonnull Class<? extends Token> c) { | |||
if (mediaTypes.isEmpty()) { | |||
this.error(token, "The media-type-list must contain at least one media-type."); | |||
throw INVALID_MEDIA_TYPE_LIST; | |||
} else if (mediaTypes.stream().anyMatch(x -> x.matchesTypeOrSubType("*"))) { | |||
this.warn(token,"`*` is allowed character in media type which will be literally matched. Make sure it not an attempt to match any."); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Make sure it not an attempt to match any.
Missing an "is" in there. Also if the user/dev does want to define "any" what should they be using? Or is it not possible? Either way, some clarity or a suggestion might help...
[The test will need to be updated to match whatever change is made here...]
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks! Addressed comments.
@@ -25,6 +25,10 @@ public boolean matchesMediaType(@Nonnull MediaType mediaType) { | |||
return this.type.equalsIgnoreCase(mediaType.type) && this.subtype.equalsIgnoreCase(mediaType.subtype); | |||
} | |||
|
|||
public boolean matchesTypeOrSubType(@Nonnull String str) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't like this function. It's not generally useful. Just use x.type.equals("*") || x.subtype.equals("*")
.
@@ -14,7 +14,7 @@ | |||
+ "|scripts|top-navigation)$"); | |||
public static final Pattern requireSriForEnumeratedTokenPattern = Pattern | |||
.compile("^(?:script|style)$", Pattern.CASE_INSENSITIVE); | |||
public static final Pattern mediaTypePattern = Pattern.compile("^(?<type>[^/]+)/(?<subtype>[^/]+)$"); | |||
public static final Pattern mediaTypePattern = Pattern.compile("^(?<type>[a-zA-Z0-9!#$%^&*\\-_+{}|'.`~]+)/(?<subtype>[a-zA-Z0-9!#$%^&*\\-_+{}|'.`~]+)$"); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add comment with link to grammar/spec and the name of the production this is supposed to match.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Addressed
fixes #181