Skip to content

Commit 3362fc7

Browse files
RunDevelopmentRunDevelopment
authored
HTTP: Added support for special header value tokenization (#3275)
1 parent 0f1b581 commit 3362fc7

22 files changed

+345
-102
lines changed

‎components.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎components.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -559,7 +559,10 @@
559559
"http": {
560560
"title": "HTTP",
561561
"optional": [
562+
"csp",
562563
"css",
564+
"hpkp",
565+
"hsts",
563566
"javascript",
564567
"json",
565568
"markup",

‎components/prism-http.js

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
(function (Prism) {
2+
3+
/**
4+
* @param {string} name
5+
* @returns {RegExp}
6+
*/
7+
function headerValueOf(name) {
8+
return RegExp('(^(?:' + name + '):[ \t]*(?![ \t]))[^]+', 'i');
9+
}
10+
211
Prism.languages.http = {
312
'request-line': {
413
pattern: /^(?:CONNECT|DELETE|GET|HEAD|OPTIONS|PATCH|POST|PRI|PUT|SEARCH|TRACE)\s(?:https?:\/\/|\/)\S*\sHTTP\/[\d.]+/m,
@@ -45,10 +54,39 @@
4554
}
4655
}
4756
},
48-
// HTTP header name
49-
'header-name': {
50-
pattern: /^[\w-]+:(?=.)/m,
51-
alias: 'keyword'
57+
'header': {
58+
pattern: /^[\w-]+:.+(?:(?:\r\n?|\n)[ \t].+)*/m,
59+
inside: {
60+
'header-value': [
61+
{
62+
pattern: headerValueOf(/Content-Security-Policy/.source),
63+
lookbehind: true,
64+
alias: ['csp', 'languages-csp'],
65+
inside: Prism.languages.csp
66+
},
67+
{
68+
pattern: headerValueOf(/Public-Key-Pins(?:-Report-Only)?/.source),
69+
lookbehind: true,
70+
alias: ['hpkp', 'languages-hpkp'],
71+
inside: Prism.languages.hpkp
72+
},
73+
{
74+
pattern: headerValueOf(/Strict-Transport-Security/.source),
75+
lookbehind: true,
76+
alias: ['hsts', 'languages-hsts'],
77+
inside: Prism.languages.hsts
78+
},
79+
{
80+
pattern: headerValueOf(/[^:]+/.source),
81+
lookbehind: true
82+
}
83+
],
84+
'header-name': {
85+
pattern: /^[^:]+/,
86+
alias: 'keyword'
87+
},
88+
'punctuation': /^:/
89+
}
5290
}
5391
};
5492

@@ -60,7 +98,8 @@
6098
'application/xml': langs.xml,
6199
'text/xml': langs.xml,
62100
'text/html': langs.html,
63-
'text/css': langs.css
101+
'text/css': langs.css,
102+
'text/plain': langs.plain
64103
};
65104

66105
// Declare which types can also be suffixes
@@ -97,7 +136,7 @@
97136
// However, when writing code by hand (e.g. to display on a website) people can forget about this,
98137
// so we want to be liberal here. We will allow the empty line to be omitted if the first line of
99138
// the body does not start with a [\w-] character (as headers do).
100-
/[^\w-][\s\S]*/.source,
139+
/[^ \t\w-][\s\S]*/.source,
101140
'i'
102141
),
103142
lookbehind: true,
@@ -106,7 +145,7 @@
106145
}
107146
}
108147
if (options) {
109-
Prism.languages.insertBefore('http', 'header-name', options);
148+
Prism.languages.insertBefore('http', 'header', options);
110149
}
111150

112151
}(Prism));

‎components/prism-http.min.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎tests/languages/css+http/css_inclusion.test

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,11 @@ a.link:hover {
77
----------------------------------------------------
88

99
[
10-
["header-name", "Content-type:"],
11-
" text/css\r\n",
10+
["header", [
11+
["header-name", "Content-type"],
12+
["punctuation", ":"],
13+
["header-value", "text/css"]
14+
]],
1215

1316
["text-css", [
1417
["selector", "a.link:hover"],

‎tests/languages/http!+csp/inclusion.test

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Content-Security-Policy: default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports
2+
3+
----------------------------------------------------
4+
5+
[
6+
["header", [
7+
["header-name", "Content-Security-Policy"],
8+
["punctuation", ":"],
9+
["header-value", [
10+
["directive", "default-src"],
11+
["none", "'none'"],
12+
["punctuation", ";"],
13+
["directive", "style-src"],
14+
["host", ["cdn.example.com"]],
15+
["punctuation", ";"],
16+
["directive", "report-uri"],
17+
" /_/csp-reports"
18+
]]
19+
]]
20+
]

‎tests/languages/http!+hpkp/inclusion.test

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
Public-Key-Pins: max-age=3000;
2+
pin-sha256="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=";
3+
pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="
4+
5+
----------------------------------------------------
6+
7+
[
8+
["header", [
9+
["header-name", "Public-Key-Pins"],
10+
["punctuation", ":"],
11+
["header-value", [
12+
["directive", "max-age"],
13+
["operator", "="],
14+
"3000",
15+
["punctuation", ";"],
16+
17+
["directive", "pin-sha256"],
18+
["operator", "="],
19+
"\"d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM",
20+
["operator", "="],
21+
"\"",
22+
["punctuation", ";"],
23+
24+
["directive", "pin-sha256"],
25+
["operator", "="],
26+
"\"E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g",
27+
["operator", "="],
28+
"\""
29+
]]
30+
]]
31+
]

‎tests/languages/http!+hsts/inclusion.test

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
Strict-Transport-Security: max-age=31536000
2+
3+
----------------------------------------------------
4+
5+
[
6+
["header", [
7+
["header-name", "Strict-Transport-Security"],
8+
["punctuation", ":"],
9+
["header-value", [
10+
["directive", "max-age"],
11+
["operator", "="],
12+
"31536000"
13+
]]
14+
]]
15+
]

‎tests/languages/http/header-name_feature.test

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎tests/languages/http/header_feature.test

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
2+
Accept-Encoding: gzip, deflate
3+
Server: GitHub.com
4+
Date: Mon, 22 Dec 2014 18:25:30 GMT
5+
Content-Type: text/html; charset=utf-8
6+
Content-Security-Policy: default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports
7+
Public-Key-Pins: max-age=3000;
8+
pin-sha256="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=";
9+
pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="
10+
Strict-Transport-Security: max-age=31536000
11+
12+
----------------------------------------------------
13+
14+
[
15+
["header", [
16+
["header-name", "Accept-Language"],
17+
["punctuation", ":"],
18+
["header-value", "fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3"]
19+
]],
20+
["header", [
21+
["header-name", "Accept-Encoding"],
22+
["punctuation", ":"],
23+
["header-value", "gzip, deflate"]
24+
]],
25+
["header", [
26+
["header-name", "Server"],
27+
["punctuation", ":"],
28+
["header-value", "GitHub.com"]
29+
]],
30+
["header", [
31+
["header-name", "Date"],
32+
["punctuation", ":"],
33+
["header-value", "Mon, 22 Dec 2014 18:25:30 GMT"]
34+
]],
35+
["header", [
36+
["header-name", "Content-Type"],
37+
["punctuation", ":"],
38+
["header-value", "text/html; charset=utf-8"]
39+
]],
40+
["header", [
41+
["header-name", "Content-Security-Policy"],
42+
["punctuation", ":"],
43+
["header-value", "default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports"]
44+
]],
45+
["header", [
46+
["header-name", "Public-Key-Pins"],
47+
["punctuation", ":"],
48+
["header-value", "max-age=3000;\r\n pin-sha256=\"d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=\";\r\n pin-sha256=\"E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=\""]
49+
]],
50+
["header", [
51+
["header-name", "Strict-Transport-Security"],
52+
["punctuation", ":"],
53+
["header-value", "max-age=31536000"]
54+
]]
55+
]
56+
57+
----------------------------------------------------
58+
59+
Checks for header names.

0 commit comments

Comments
 (0)