Merge r5767 - Protect cookie headers from XHR...

net/http/http_response_headers.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_RESPONSE_HEADERS_H_
 #define NET_HTTP_RESPONSE_HEADERS_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 23 matching lines @@
   // us to access the raw byte sequence as sent by a web server.  In any case,
   // HttpResponseHeaders does not perform any encoding changes on the input.
   //
   explicit HttpResponseHeaders(const std::string& raw_headers);
 
   // Initializes from the representation stored in the given pickle.  The data
   // for this object is found relative to the given pickle_iter, which should
   // be passed to the pickle's various Read* methods.
   HttpResponseHeaders(const Pickle& pickle, void** pickle_iter);
 
-  // Appends a representation of this object to the given pickle.  If the
-  // for_cache argument is true, then non-cacheable headers will be pruned from
-  // the persisted version of the response headers.
-  void Persist(Pickle* pickle, bool for_cache);
+  // Persist options.
+  typedef int PersistOptions;
+  static const PersistOptions PERSIST_RAW = -1;  // Raw, unparsed headers.
+  static const PersistOptions PERSIST_ALL = 0;  // Parsed headers.
+  static const PersistOptions PERSIST_SANS_COOKIES = 1 << 0;
+  static const PersistOptions PERSIST_SANS_CHALLENGES = 1 << 1;
+  static const PersistOptions PERSIST_SANS_HOP_BY_HOP = 1 << 2;
+  static const PersistOptions PERSIST_SANS_NON_CACHEABLE = 1 << 3;
+
+  // Appends a representation of this object to the given pickle.
+  // The options argument can be a combination of PersistOptions.
+  void Persist(Pickle* pickle, PersistOptions options);
 
   // Performs header merging as described in 13.5.3 of RFC 2616.
   void Update(const HttpResponseHeaders& new_headers);
 
   // Creates a normalized header string.  The output will be formatted exactly
   // like so:
   //     HTTP/<version> <status_code> <status_text>\n
   //     [<header-name>: <header-values>\n]*
   // meaning, each line is \n-terminated, and there is no extra whitespace
   // beyond the single space separators shown (of course, values can contain
@@ skipping 174 matching lines @@
                  std::string::const_iterator value_end);
 
   // Add to parsed_ given the fields of a ParsedHeader object.
   void AddToParsed(std::string::const_iterator name_begin,
                    std::string::const_iterator name_end,
                    std::string::const_iterator value_begin,
                    std::string::const_iterator value_end);
 
   typedef base::hash_set<std::string> HeaderSet;
 
-  // Returns the values from any 'cache-control: no-cache="foo,bar"' headers as
-  // well as other known-to-be-transient header names.  The header names are
-  // all lowercase to support fast lookup.
-  void GetTransientHeaders(HeaderSet* header_names) const;
+  // Adds the values from any 'cache-control: no-cache="foo,bar"' headers.
+  void AddNonCacheableHeaders(HeaderSet* header_names) const;
+
+  // Adds the set of header names that contain cookie values.
+  static void AddSensitiveHeaders(HeaderSet* header_names);
+
+  // Adds the set of rfc2616 hop-by-hop response headers.
+  static void AddHopByHopHeaders(HeaderSet* header_names);
+
+  // Adds the set of challenge response headers.
+  static void AddChallengeHeaders(HeaderSet* header_names);
+
+  // Adds the set of cookie response headers.
+  static void AddCookieHeaders(HeaderSet* header_names);
 
   // The members of this structure point into raw_headers_.
   struct ParsedHeader {
     std::string::const_iterator name_begin;
     std::string::const_iterator name_end;
     std::string::const_iterator value_begin;
     std::string::const_iterator value_end;
 
     // A header "continuation" contains only a subsequent value for the
     // preceding header.  (Header values are comma separated.)
@@ skipping 22 matching lines @@
   // The parsed http version number (not normalized).
   HttpVersion parsed_http_version_;
 
   DISALLOW_COPY_AND_ASSIGN(HttpResponseHeaders);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_RESPONSE_HEADERS_H_