Allow multiple identical Location and Content-Disposition headers

net/http/http_stream_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_parser.h"
 
 #include "base/compiler_specific.h"
 #include "base/metrics/histogram.h"
 #include "base/string_util.h"
 #include "net/base/address_list.h"
@@ skipping 19 matching lines @@
   const char* header_line = null_separated_headers;
   std::string cr_separated_headers;
   while (header_line[0] != 0) {
     cr_separated_headers += header_line;
     cr_separated_headers += "\n";
     header_line += strlen(header_line) + 1;
   }
   return cr_separated_headers;
 }
 
-// Return true if |headers| contain multiple |field_name| fields.  If
-// |count_same_value| is false, returns false if all copies of the field have
-// the same value.
+// Return true if |headers| contain multiple |field_name| fields.
 bool HeadersContainMultipleCopiesOfField(
     const net::HttpResponseHeaders& headers,
-    const std::string& field_name,
-    bool count_same_value) {
+    const std::string& field_name) {
   void* it = NULL;
   std::string field_value;
   if (!headers.EnumerateHeader(&it, field_name, &field_value))
     return false;
   // There's at least one |field_name| header.  Check if there are any more
   // such headers, and if so, return true if they have different values or
   // |count_same_value| is true.
   std::string field_value2;
   while (headers.EnumerateHeader(&it, field_name, &field_value2)) {
-    if (count_same_value || field_value != field_value2)
+    if (field_value != field_value2)
       return true;
   }
   return false;
 }
 
 }  // namespace
 
 namespace net {
 
 // Similar to DrainableIOBuffer(), but this version comes with its own
@@ skipping 703 matching lines @@
         read_buf_->StartOfBuffer() + read_buf_unused_offset_, end_offset));
   } else {
     // Enough data was read -- there is no status line.
     headers = new HttpResponseHeaders(std::string("HTTP/0.9 200 OK"));
   }
 
   // Check for multiple Content-Length headers with no Transfer-Encoding header.
   // If they exist, and have distinct values, it's a potential response
   // smuggling attack.
   if (!headers->HasHeader("Transfer-Encoding")) {
-    if (HeadersContainMultipleCopiesOfField(*headers,
-                                            "Content-Length",
-                                            false)) {
+    if (HeadersContainMultipleCopiesOfField(*headers, "Content-Length"))
       return ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_LENGTH;
-    }
   }
 
   // Check for multiple Content-Disposition or Location headers.  If they exist,
   // it's also a potential response smuggling attack.
-  if (HeadersContainMultipleCopiesOfField(*headers,
-                                          "Content-Disposition",
-                                          true)) {
+  if (HeadersContainMultipleCopiesOfField(*headers, "Content-Disposition"))
     return ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION;
-  }
-  if (HeadersContainMultipleCopiesOfField(*headers, "Location", true))
+  if (HeadersContainMultipleCopiesOfField(*headers, "Location"))
     return ERR_RESPONSE_HEADERS_MULTIPLE_LOCATION;
 
   response_->headers = headers;
   response_->vary_data.Init(*request_, *response_->headers);
   DVLOG(1) << __FUNCTION__ << "()"
            << " content_length = \""
            << response_->headers->GetContentLength() << "\n\""
            << " headers = \"" << GetResponseHeaderLines(*response_->headers)
            << "\"";
   return OK;
@@ skipping 128 matching lines @@
       request_body->IsInMemory() &&
       request_body->size() > 0) {
     size_t merged_size = request_headers.size() + request_body->size();
     if (merged_size <= kMaxMergedHeaderAndBodySize)
       return true;
   }
   return false;
 }
 
 }  // namespace net