Invalidate urls given in the content-location header in requests using

net/http/http_cache_transaction.cc

Index: net/http/http_cache_transaction.cc
diff --git a/net/http/http_cache_transaction.cc b/net/http/http_cache_transaction.cc
index cebecda47aa14c2c20ff5671e65b20e660933274..9dde0720feef0249c513817ed2615f1b2c2254a0 100644
--- a/net/http/http_cache_transaction.cc
+++ b/net/http/http_cache_transaction.cc
@@ -171,6 +171,16 @@ bool NonErrorResponse(int status_code) {
   return status_code_range == 2 || status_code_range == 3;
 }
 
+// Return true if |method| is considered safe, or false if |method| is unsafe or

[Adam Rice, 2015/04/24 13:19:21]

A reference to RFC7231 section 4.2.1 would be helpful to clarify what is meant
by "safe" here.

[haavardm, 2015/04/27 10:48:35]

Done.

+// the safety is not known.
+bool SafeHTTPMethod(const std::string& method) {

[Adam Rice, 2015/04/24 13:19:21]

Nitpick: capitalisation should be SafeHttpMethod.

[haavardm, 2015/04/27 10:48:35]

Done.

+  if (method == "GET" || method == "HEAD" || method == "OPTIONS" ||
+      method == "TRACE") {
+    return true;
+  }
+  return false;
+}
+
 // Error codes that will be considered indicative of a page being offline/
 // unreachable for LOAD_FROM_CACHE_IF_OFFLINE.
 bool IsOfflineError(int error) {
@@ -1238,6 +1248,22 @@ int HttpCache::Transaction::DoSuccessfulSendRequest() {
     mode_ = NONE;
   }
 
+  // If this is a successful request having a unsafe method, invalidate
+  // the URL given in the Content-Location header if it has the same origin as
+  // |request_->url|.
+  if (!SafeHTTPMethod(request_->method) &&
+      NonErrorResponse(new_response->headers->response_code())) {
+    std::string content_location;
+    if (new_response_->headers->EnumerateHeader(NULL, "Content-Location",
+                                                &content_location)) {
+      GURL absolute_location_url = request_->url.Resolve(content_location);
+      if (absolute_location_url.is_valid() &&
+          absolute_location_url.host() == request_->url.host()) {
+        cache_->DoomMainEntryForUrl(absolute_location_url);
+      }
+    }
+  }
+
   // Invalidate any cached GET with a successful POST.
   if (!(effective_load_flags_ & LOAD_DISABLE_CACHE) &&
       request_->method == "POST" &&