Merge internal change: 63891842 - QuicServerId changes

net/base/host_port_pair.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/host_port_pair.h"
 
+#include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "net/base/ip_endpoint.h"
 #include "url/gurl.h"
 
 namespace net {
 
 HostPortPair::HostPortPair() : port_(0) {}
@@ skipping 23 matching lines @@
   host_port_pair.set_host(key_port[0]);
   host_port_pair.set_port(port);
   return host_port_pair;
 }
 
 std::string HostPortPair::ToString() const {
   return base::StringPrintf("%s:%u", HostForURL().c_str(), port_);
 }
 
 std::string HostPortPair::HostForURL() const {
+  // TODO(rtenneti): Add support for |host| to have '\0'.

[wtc, 2014/04/01 22:10:58]

Can you explain why |host| may have '\0'?

[ramant (doing other things), 2014/04/02 02:34:45]

avd mentioned if host is constructed in code where the host user-input, then an
attacker could embed \0 in the string.

Should we delete this code/comment?

The following is a comment from avd:

If HostPortPair class is used in the server environment (could attacker provider
a host string with \0 embedded in it)
The problem is that the Host string is user-input.  I as an attacker can trigger
this DCHECK by constructing specific packets.

+  if (host_.find('\0') != std::string::npos) {
+    LOG(DFATAL) << "Host has a null char: " << host_;

[Ryan Hamilton, 2014/03/31 15:45:43]

nit: how about DLOG_IF(DFATAL) ...? 

[ramant (doing other things), 2014/03/31 18:40:32]

Fixed in
https://codereview.chromium.org/216713003/diff2/20001:40001/net/base/host_por...

Done.

[ramant (doing other things), 2014/04/01 03:19:56]

Hi Ryan,
  In net/spdy and net/quic, we are using LOG_IF(DFATAL. EXPECT_DFATAL fails if
we use DLOG_IF on CQ bots. Thus switched to using LOG_IF(DFATAL. Would
appreciate suggestions. thanks.

+  }
   // Check to see if the host is an IPv6 address.  If so, added brackets.
   if (host_.find(':') != std::string::npos) {
     DCHECK_NE(host_[0], '[');
     return base::StringPrintf("[%s]", host_.c_str());
   }
 
   return host_;
 }
 
 }  // namespace net