Merge internal change: 63891842 - QuicServerId changes

net/base/host_port_pair.cc

Index: net/base/host_port_pair.cc
diff --git a/net/base/host_port_pair.cc b/net/base/host_port_pair.cc
index bc23a9a8621c10f47c52a14502c9007d4a3c0343..4c250ed5a90ce70d78827f47f2e1acf37d3422c6 100644
--- a/net/base/host_port_pair.cc
+++ b/net/base/host_port_pair.cc
@@ -4,6 +4,7 @@
 
 #include "net/base/host_port_pair.h"
 
+#include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
@@ -47,6 +48,10 @@ std::string HostPortPair::ToString() const {
 }
 
 std::string HostPortPair::HostForURL() const {
+  // TODO(rtenneti): Add support for |host| to have '\0'.

[wtc, 2014/04/01 22:10:58]

Can you explain why |host| may have '\0'?

[ramant (doing other things), 2014/04/02 02:34:45]

avd mentioned if host is constructed in code where the host user-input, then an
attacker could embed \0 in the string.

Should we delete this code/comment?

The following is a comment from avd:

If HostPortPair class is used in the server environment (could attacker provider
a host string with \0 embedded in it)
The problem is that the Host string is user-input.  I as an attacker can trigger
this DCHECK by constructing specific packets.

+  if (host_.find('\0') != std::string::npos) {
+    LOG(DFATAL) << "Host has a null char: " << host_;

[Ryan Hamilton, 2014/03/31 15:45:43]

nit: how about DLOG_IF(DFATAL) ...? 

[ramant (doing other things), 2014/03/31 18:40:32]

Fixed in
https://codereview.chromium.org/216713003/diff2/20001:40001/net/base/host_por...

Done.

[ramant (doing other things), 2014/04/01 03:19:56]

Hi Ryan,
  In net/spdy and net/quic, we are using LOG_IF(DFATAL. EXPECT_DFATAL fails if
we use DLOG_IF on CQ bots. Thus switched to using LOG_IF(DFATAL. Would
appreciate suggestions. thanks.

+  }
   // Check to see if the host is an IPv6 address.  If so, added brackets.
   if (host_.find(':') != std::string::npos) {
     DCHECK_NE(host_[0], '[');