Ignore Crypto-Key header values that do not have "dh" values

components/gcm_driver/crypto/gcm_encryption_provider.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/gcm_driver/crypto/gcm_encryption_provider.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 132 matching lines @@
 
   CryptoKeyHeaderIterator crypto_key_header_iterator(
       crypto_key_header->second.begin(), crypto_key_header->second.end());
   if (!crypto_key_header_iterator.GetNext()) {
     DLOG(ERROR) << "Unable to parse the value of the Crypto-Key header";
     callback.Run(DECRYPTION_RESULT_INVALID_CRYPTO_KEY_HEADER,
                  IncomingMessage());
     return;
   }
 
+  // Ignore values that don't include the "dh" property. When using VAPID, it is
+  // valid for the application server to supply multiple values.
+  while (crypto_key_header_iterator.dh().empty() &&

[johnme, 2016/06/30 16:55:58]

The spec requires "at most one entry having a `dh` parameter" but we don't
enforce that. Should we?

[Peter Beverloo, 2016/06/30 18:00:42]

Done.

+         crypto_key_header_iterator.GetNext()) {}
+
   if (crypto_key_header_iterator.dh().empty()) {
     DLOG(ERROR) << "Invalid values supplied in the Crypto-Key header";
     callback.Run(DECRYPTION_RESULT_INVALID_CRYPTO_KEY_HEADER,
                  IncomingMessage());
     return;
   }
 
   // Use |fallback_to_empty_authorized_entity|, since this message might have
   // been sent to either an InstanceID token or a non-InstanceID registration.
   key_store_->GetKeys(app_id, message.sender_id /* authorized_entity */,
@@ skipping 79 matching lines @@
   decrypted_message.decrypted = true;
 
   // There must be no data associated with the decrypted message at this point,
   // to make sure that we don't end up in an infinite decryption loop.
   DCHECK_EQ(0u, decrypted_message.data.size());
 
   callback.Run(DECRYPTION_RESULT_DECRYPTED, decrypted_message);
 }
 
 }  // namespace gcm