Invalidate urls given in the content-location header in requests using

net/http/http_cache_transaction.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_cache_transaction.h"
 
 #include "build/build_config.h"
 
 #if defined(OS_POSIX)
 #include <unistd.h>
@@ skipping 153 matching lines @@
 }
 
 // From http://tools.ietf.org/html/draft-ietf-httpbis-p6-cache-21#section-6
 //      a "non-error response" is one with a 2xx (Successful) or 3xx
 //      (Redirection) status code.
 bool NonErrorResponse(int status_code) {
   int status_code_range = status_code / 100;
   return status_code_range == 2 || status_code_range == 3;
 }
 
+// Return true if |method| is considered safe, or false if |method| is unsafe or

[Adam Rice, 2015/04/24 13:19:21]

A reference to RFC7231 section 4.2.1 would be helpful to clarify what is meant
by "safe" here.

[haavardm, 2015/04/27 10:48:35]

Done.

+// the safety is not known.
+bool SafeHTTPMethod(const std::string& method) {

[Adam Rice, 2015/04/24 13:19:21]

Nitpick: capitalisation should be SafeHttpMethod.

[haavardm, 2015/04/27 10:48:35]

Done.

+  if (method == "GET" || method == "HEAD" || method == "OPTIONS" ||
+      method == "TRACE") {
+    return true;
+  }
+  return false;
+}
+
 // Error codes that will be considered indicative of a page being offline/
 // unreachable for LOAD_FROM_CACHE_IF_OFFLINE.
 bool IsOfflineError(int error) {
   return (error == net::ERR_NAME_NOT_RESOLVED ||
           error == net::ERR_INTERNET_DISCONNECTED ||
           error == net::ERR_ADDRESS_UNREACHABLE ||
           error == net::ERR_CONNECTION_TIMED_OUT);
 }
 
 // Enum for UMA, indicating the status (with regard to offline mode) of
@@ skipping 1047 matching lines @@
       (request_->method == "PUT" || request_->method == "DELETE")) {
     if (NonErrorResponse(new_response->headers->response_code())) {
       int ret = cache_->DoomEntry(cache_key_, NULL);
       DCHECK_EQ(OK, ret);
     }
     cache_->DoneWritingToEntry(entry_, true);
     entry_ = NULL;
     mode_ = NONE;
   }
 
+  // If this is a successful request having a unsafe method, invalidate
+  // the URL given in the Content-Location header if it has the same origin as
+  // |request_->url|.
+  if (!SafeHTTPMethod(request_->method) &&
+      NonErrorResponse(new_response->headers->response_code())) {
+    std::string content_location;
+    if (new_response_->headers->EnumerateHeader(NULL, "Content-Location",
+                                                &content_location)) {
+      GURL absolute_location_url = request_->url.Resolve(content_location);
+      if (absolute_location_url.is_valid() &&
+          absolute_location_url.host() == request_->url.host()) {
+        cache_->DoomMainEntryForUrl(absolute_location_url);
+      }
+    }
+  }
+
   // Invalidate any cached GET with a successful POST.
   if (!(effective_load_flags_ & LOAD_DISABLE_CACHE) &&
       request_->method == "POST" &&
       NonErrorResponse(new_response->headers->response_code())) {
     cache_->DoomMainEntryForUrl(request_->url);
   }
 
   RecordNoStoreHeaderHistogram(request_->load_flags, new_response);
 
   if (new_response_->headers->response_code() == 416 &&
@@ skipping 1781 matching lines @@
     default:
       NOTREACHED();
   }
 }
 
 void HttpCache::Transaction::OnIOComplete(int result) {
   DoLoop(result);
 }
 
 }  // namespace net