[XHR] Replace isSetCookieHeader() with isForbiddenResponseHeaderName()

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

Index: third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
index 8b302c8215b172312e8939667b77915e2f523e41..abd426c4ed723a7d1392185c4c76a29d4ee00497 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
@@ -100,11 +100,6 @@ private:
     int* const m_level;
 };
 
-bool isSetCookieHeader(const AtomicString& name)
-{
-    return equalIgnoringCase(name, "set-cookie") || equalIgnoringCase(name, "set-cookie2");
-}
-
 void replaceCharsetInMediaType(String& mediaType, const String& charsetValue)
 {
     unsigned pos = 0, len = 0;
@@ -1236,7 +1231,7 @@ String XMLHttpRequest::getAllResponseHeaders() const
         //     2) There's no known harm in hiding Set-Cookie header fields entirely; we don't
         //        know any widely used technique that requires access to them.
         //     3) Firefox has implemented this policy.

[yhirano, 2015/12/08 07:23:51]

Can you update the comments?

[tyoshino (SeeGerritForStatus), 2015/12/08 13:21:38]

Done.

-        if (isSetCookieHeader(it->key) && !securityOrigin()->canLoadLocalResources())
+        if (FetchUtils::isForbiddenResponseHeaderName(it->key) && !securityOrigin()->canLoadLocalResources())

[yhirano, 2015/12/08 07:23:51]

[optional] It would be good to use this function in
modules/fetch/FetchResponseData.cpp as well.

[tyoshino (SeeGerritForStatus), 2015/12/08 13:21:38]

Seems the check in FetchResponseData is unnecessary. Check for forbidden
response-header name is done when creating a Response object.

If it's really needed, createCORSFilteredResponse() should also have it.

             continue;
 
         if (!m_sameOriginRequest && !isOnAccessControlResponseHeaderWhitelist(it->key) && !accessControlExposeHeaderSet.contains(it->key))
@@ -1259,7 +1254,7 @@ const AtomicString& XMLHttpRequest::getResponseHeader(const AtomicString& name)
         return nullAtom;
 
     // See comment in getAllResponseHeaders above.
-    if (isSetCookieHeader(name) && !securityOrigin()->canLoadLocalResources()) {
+    if (FetchUtils::isForbiddenResponseHeaderName(name) && !securityOrigin()->canLoadLocalResources()) {
         logConsoleError(executionContext(), "Refused to get unsafe header \"" + name + "\"");
         return nullAtom;
     }