Skip to content

Added check for existence of Location HTTP header before using it #6560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iSazonov merged 9 commits into from
Apr 8, 2018
Merged

Added check for existence of Location HTTP header before using it #6560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
3f2bfb5
Check existence of Location header before using it
ffeldhaus Apr 3, 2018
6ecc705
Fixed Location header check to validate if it is not null
ffeldhaus Apr 4, 2018
d04be33
[Feature] Added tests to validate that WebCmdlets correctly handle re…
ffeldhaus Apr 4, 2018
f44f0db
Revert unrelated file about_PSReadline.help.txt
ffeldhaus Apr 4, 2018
bcd2588
[feature] Changed status code from string to value to allow WebListen…
ffeldhaus Apr 4, 2018
85c6c2c
[feature] Changed status code from string to int and using -Match ins…
ffeldhaus Apr 5, 2018
b61860b
[feature] Skipping relative test as it is not a valid response type a…
ffeldhaus Apr 5, 2018
33dba99
[feature] Clarified test description and added more information on wh…
ffeldhaus Apr 6, 2018
7e54d41
[feature] Shortened test description by one word and added whitespace
ffeldhaus Apr 7, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...owerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1287,7 +1287,7 @@ internal virtual HttpResponseMessage GetResponse(HttpClient client, HttpRequestM
_cancelToken = new CancellationTokenSource();
HttpResponseMessage response = client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, _cancelToken.Token).GetAwaiter().GetResult();

if (stripAuthorization && IsRedirectCode(response.StatusCode))
if (stripAuthorization && IsRedirectCode(response.StatusCode) && response.Headers.Location != null)
{
_cancelToken.Cancel();
_cancelToken = null;
Expand Down
42 changes: 42 additions & 0 deletions test/powershell/Modules/Microsoft.PowerShell.Utility/WebCmdlets.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -822,6 +822,27 @@ Describe "Invoke-WebRequest tests" -Tags "Feature" {
$response.Content.Method | Should -Be $redirectedMethod
}

It "Validates Invoke-WebRequest handles responses without Location header for requests with Authorization header and redirect: <redirectType>" -TestCases $redirectTests {
param($redirectType, $redirectedMethod)
# Skip relative test as it is not a valid response type.
if ($redirectType -eq 'relative') { return }

# When an Authorization request header is present,
# and -PreserveAuthorizationOnRedirect is not present,
# PowerShell should throw an HTTP Response Exception
# for a redirect response which does not contain a Location response header.
# The correct redirect status code should be included in the exception.

$StatusCode = [int][System.Net.HttpStatusCode]$redirectType
$uri = Get-WebListenerUrl -Test Response -Query @{statuscode = $StatusCode}
$command = "Invoke-WebRequest -Uri '$uri' -Headers @{Authorization = 'foo'}"
$response = ExecuteWebCommand -command $command

$response.Error.Exception | Should -BeOfType 'Microsoft.PowerShell.Commands.HttpResponseException'
$response.Error.Exception.Response.StatusCode | Should -Be $StatusCode
$response.Error.Exception.Response.Headers.Location | Should -BeNullOrEmpty
}

#endregion Redirect tests

Context "Invoke-WebRequest SkipHeaderVerification Tests" {
Expand Down Expand Up @@ -2137,6 +2158,27 @@ Describe "Invoke-RestMethod tests" -Tags "Feature" {
$response.Content.Method | Should -Be $redirectedMethod
}

It "Validates Invoke-RestMethod handles responses without Location header for requests with Authorization header and redirect: <redirectType>" -TestCases $redirectTests {
param($redirectType, $redirectedMethod)
# Skip relative test as it is not a valid response type.
if ($redirectType -eq 'relative') { return }

# When an Authorization request header is present,
# and -PreserveAuthorizationOnRedirect is not present,
# PowerShell should throw an HTTP Response Exception
# for a redirect response which does not contain a Location response header.
# The correct redirect status code should be included in the exception.

$StatusCode = [int][System.Net.HttpStatusCode]$redirectType
$uri = Get-WebListenerUrl -Test Response -Query @{statuscode = $StatusCode}
$command = "Invoke-RestMethod -Uri '$uri' -Headers @{Authorization = 'foo'}"
$response = ExecuteWebCommand -command $command

$response.Error.Exception | Should -BeOfType 'Microsoft.PowerShell.Commands.HttpResponseException'
$response.Error.Exception.Response.StatusCode | Should -Be $StatusCode
$response.Error.Exception.Response.Headers.Location | Should -BeNullOrEmpty
}

#endregion Redirect tests

Context "Invoke-RestMethod SkipHeaderVerification Tests" {
Expand Down