Merge r5767 - Protect cookie headers from XHR...

net/http/http_cache.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_cache.h"
 
 #include <algorithm>
 
 #include "base/compiler_specific.h"
 #include "base/message_loop.h"
@@ skipping 1062 matching lines @@
   if (response_info->ssl_info.security_bits != -1)
     flags |= RESPONSE_INFO_HAS_SECURITY_BITS;
   if (response_info->vary_data.is_valid())
     flags |= RESPONSE_INFO_HAS_VARY_DATA;
 
   Pickle pickle;
   pickle.WriteInt(flags);
   pickle.WriteInt64(response_info->request_time.ToInternalValue());
   pickle.WriteInt64(response_info->response_time.ToInternalValue());
 
-  response_info->headers->Persist(&pickle, skip_transient_headers);
+  net::HttpResponseHeaders::PersistOptions persist_options =
+      net::HttpResponseHeaders::PERSIST_RAW;
+
+  if (skip_transient_headers) {
+    persist_options =
+        net::HttpResponseHeaders::PERSIST_SANS_COOKIES |
+        net::HttpResponseHeaders::PERSIST_SANS_CHALLENGES |
+        net::HttpResponseHeaders::PERSIST_SANS_HOP_BY_HOP |
+        net::HttpResponseHeaders::PERSIST_SANS_NON_CACHEABLE;
+  }
+
+  response_info->headers->Persist(&pickle, persist_options);
 
   if (response_info->ssl_info.cert) {
     response_info->ssl_info.cert->Persist(&pickle);
     pickle.WriteInt(response_info->ssl_info.cert_status);
   }
   if (response_info->ssl_info.security_bits != -1)
     pickle.WriteInt(response_info->ssl_info.security_bits);
 
   if (response_info->vary_data.is_valid())
     response_info->vary_data.Persist(&pickle);
@@ skipping 267 matching lines @@
 
   entry->pending_queue.erase(entry->pending_queue.begin());
 
   AddTransactionToEntry(entry, next);
 }
 
 //-----------------------------------------------------------------------------
 
 }  // namespace net