Fix a logic error in the handling the response to an HTTP...

net/http/http_network_transaction.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/scoped_ptr.h"
 #include "base/compiler_specific.h"
 #include "base/string_util.h"
 #include "base/trace_event.h"
@@ skipping 809 matching lines @@
     if (establishing_tunnel_)
       return ERR_TUNNEL_CONNECTION_FAILED;
 
     // HTTP/0.9 doesn't support the PUT method, so lack of response headers
     // indicates a buggy server.  See:
     // https://bugzilla.mozilla.org/show_bug.cgi?id=193921
     if (request_->method == "PUT")
       return ERR_METHOD_NOT_SUPPORTED;
   }
 
+  if (establishing_tunnel_) {
+    if (headers->response_code() == 200) {
+      if (header_buf_body_offset_ != header_buf_len_) {
+        // The proxy sent extraneous data after the headers.
+        return ERR_TUNNEL_CONNECTION_FAILED;
+      }
+      next_state_ = STATE_SSL_CONNECT_OVER_TUNNEL;
+      // Reset for the real request and response headers.
+      request_headers_.clear();
+      request_headers_bytes_sent_ = 0;
+      header_buf_len_ = 0;
+      header_buf_body_offset_ = 0;
+      establishing_tunnel_ = false;
+      return OK;
+    }
+    // Sanitize any illegal response code for CONNECT to prevent us from
+    // handling it by mistake.  See http://crbug.com/7338.
+    if (headers->response_code() < 400 || headers->response_code() > 599)
+      headers->set_response_code(500);  // Masquerade as a 500.
+  }
+
   // Check for an intermediate 100 Continue response.  An origin server is
   // allowed to send this response even if we didn't ask for it, so we just
   // need to skip over it.
   if (headers->response_code() == 100) {
     header_buf_len_ -= header_buf_body_offset_;
     // If we've already received some bytes after the 100 Continue response,
     // move them to the beginning of header_buf_.
     if (header_buf_len_) {
       memmove(header_buf_.get(), header_buf_.get() + header_buf_body_offset_,
               header_buf_len_);
     }
     header_buf_body_offset_ = -1;
     next_state_ = STATE_READ_HEADERS;
     return OK;
   }
 
-  if (establishing_tunnel_ && headers->response_code() == 200) {
-    if (header_buf_body_offset_ != header_buf_len_) {
-      // The proxy sent extraneous data after the headers.
-      return ERR_TUNNEL_CONNECTION_FAILED;
-    }
-    next_state_ = STATE_SSL_CONNECT_OVER_TUNNEL;
-    // Reset for the real request and response headers.
-    request_headers_.clear();
-    request_headers_bytes_sent_ = 0;
-    header_buf_len_ = 0;
-    header_buf_body_offset_ = 0;
-    establishing_tunnel_ = false;
-    return OK;
-  }
-
   response_.headers = headers;
   response_.vary_data.Init(*request_, *response_.headers);
 
   int rv = HandleAuthChallenge();
   if (rv == WILL_RESTART_TRANSACTION) {
     DCHECK(next_state_ == STATE_INIT_CONNECTION);
     return OK;
   }
   if (rv != OK)
     return rv;
@@ skipping 338 matching lines @@
 
   int status = response_.headers->response_code();
   if (status != 401 && status != 407)
     return OK;
   HttpAuth::Target target = status == 407 ?
       HttpAuth::AUTH_PROXY : HttpAuth::AUTH_SERVER;
 
   if (target == HttpAuth::AUTH_PROXY && proxy_info_.is_direct())
     return ERR_UNEXPECTED_PROXY_AUTH;
 
+  if (target == HttpAuth::AUTH_SERVER && establishing_tunnel_)
+    return ERR_UNEXPECTED_SERVER_AUTH;
+
   // The auth we tried just failed, hence it can't be valid. Remove it from
   // the cache so it won't be used again.
   if (HaveAuth(target))
     InvalidateRejectedAuthFromCache(target);
 
   auth_identity_[target].invalid = true;
 
   // Find the best authentication challenge that we support.
   HttpAuth::ChooseBestChallenge(response_.headers.get(),
                                 target,
@@ skipping 33 matching lines @@
   if (target == HttpAuth::AUTH_PROXY) {
     auth_info->host = ASCIIToWide(proxy_info_.proxy_server());
   } else {
     DCHECK(target == HttpAuth::AUTH_SERVER);
     auth_info->host = ASCIIToWide(request_->url.host());
   }
   response_.auth_challenge = auth_info;
 }
 
 }  // namespace net