Gecko [ www.blackthorn-inc.com ]

Name	Size	Permission	Date
Dump.t	221 B	-r--r--r--	2014-12-27 11:49
apache.t	164 B	-r--r--r--	2014-12-27 11:49
autoescape.t	6.13 KB	-r--r--r--	2014-12-27 11:49
can.t	112 B	-r--r--r--	2014-12-27 11:49
carp.t	11.04 KB	-r--r--r--	2014-12-27 11:49
charset.t	722 B	-r--r--r--	2014-12-27 11:49
checkbox_group.t	992 B	-r--r--r--	2014-12-27 11:49
cookie.t	15.64 KB	-r--r--r--	2014-12-27 11:49
delete.t	2.08 KB	-r--r--r--	2014-12-27 11:49
end_form.t	188 B	-r--r--r--	2014-12-27 11:49
form.t	8.83 KB	-r--r--r--	2014-12-27 11:49
function.t	4.79 KB	-r--r--r--	2014-12-27 11:49
headers.t	1.94 KB	-r--r--r--	2014-12-27 11:49
hidden.t	2.14 KB	-r--r--r--	2014-12-27 11:49
html.t	4.75 KB	-r--r--r--	2014-12-27 11:49
http.t	1.44 KB	-r--r--r--	2014-12-27 11:49
init.t	227 B	-r--r--r--	2014-12-27 11:49
init_test.txt	12 B	-r--r--r--	2014-12-27 11:49
multipart_init.t	741 B	-r--r--r--	2014-12-27 11:49
no_tabindex.t	4.08 KB	-r--r--r--	2014-12-27 11:49
param_fetch.t	838 B	-r--r--r--	2014-12-27 11:49
popup_menu.t	627 B	-r--r--r--	2014-12-27 11:49
pretty.t	2.12 KB	-r--r--r--	2014-12-27 11:49
push.t	2.04 KB	-r--r--r--	2014-12-27 11:49
query_string.t	308 B	-r--r--r--	2014-12-27 11:49
request.t	4.02 KB	-r--r--r--	2014-12-27 11:49
rt-52469.t	184 B	-r--r--r--	2014-12-27 11:49
save_read_roundtrip.t	583 B	-r--r--r--	2014-12-27 11:49
start_end_asterisk.t	2.86 KB	-r--r--r--	2014-12-27 11:49
start_end_end.t	2.91 KB	-r--r--r--	2014-12-27 11:49
start_end_start.t	2.94 KB	-r--r--r--	2014-12-27 11:49
switch.t	164 B	-r--r--r--	2014-12-27 11:49
tmpdir.t	1.25 KB	-r--r--r--	2014-12-27 11:49
unescapeHTML.t	875 B	-r--r--r--	2014-12-27 11:49
upload.t	4.69 KB	-r--r--r--	2014-12-27 11:49
uploadInfo.t	2.52 KB	-r--r--r--	2014-12-27 11:49
upload_post_text.txt	3.21 KB	-r--r--r--	2014-12-27 11:49
url.t	3.71 KB	-r--r--r--	2014-12-27 11:49
user_agent.t	362 B	-r--r--r--	2014-12-27 11:49
utf8.t	721 B	-r--r--r--	2014-12-27 11:49
util-58.t	1.03 KB	-r--r--r--	2014-12-27 11:49
util.t	1.22 KB	-r--r--r--	2014-12-27 11:49

Rename

# Test that header generation is spec compliant.
# References:
#   http://www.w3.org/Protocols/rfc2616/rfc2616.html
#   http://www.w3.org/Protocols/rfc822/3_Lexical.html

use strict;
use warnings;

use Test::More 'no_plan';

use CGI;

my $cgi = CGI->new;

like $cgi->header( -type => "text/html" ),
    qr#Type: text/html#, 'known header, basic case: type => "text/html"';

eval { $cgi->header( -type => "text/html".$CGI::CRLF."evil: stuff" ) };
like($@,qr/contains a newline/,'invalid header blows up');

like $cgi->header( -type => "text/html".$CGI::CRLF." evil: stuff " ),
    qr#Content-Type: text/html evil: stuff#, 'known header, with leading and trailing whitespace on the continuation line';

eval { $cgi->header( -p3p => ["foo".$CGI::CRLF."bar"] ) };
like($@,qr/contains a newline/,'P3P header with CRLF embedded blows up');

eval { $cgi->header( -cookie => ["foo".$CGI::CRLF."bar"] ) };
like($@,qr/contains a newline/,'Set-Cookie header with CRLF embedded blows up');

eval { $cgi->header( -foobar => "text/html".$CGI::CRLF."evil: stuff" ) };
like($@,qr/contains a newline/,'unknown header with CRLF embedded blows up');

eval { $cgi->header( -foobar => $CGI::CRLF."Content-type: evil/header" ) };
like($@,qr/contains a newline/, 'unknown header with leading newlines blows up');

eval { $cgi->redirect( -type => "text/html".$CGI::CRLF."evil: stuff" ) };
like($@,qr/contains a newline/,'redirect with known header with CRLF embedded blows up');

eval { $cgi->redirect( -foobar => "text/html".$CGI::CRLF."evil: stuff" ) };
like($@,qr/contains a newline/,'redirect with unknown header with CRLF embedded blows up');

eval { $cgi->redirect( $CGI::CRLF.$CGI::CRLF."Content-Type: text/html") };
like($@,qr/contains a newline/,'redirect with leading newlines blows up');

{
    my $cgi = CGI->new('t=bogus%0A%0A<html>');
    my $out;
    eval { $out = $cgi->redirect( $cgi->param('t') ) };
    like($@,qr/contains a newline/, "redirect does not allow double-newline injection");
}