Re-land: Only allow HTTP/0.9 support on default ports.

net/http/http_stream_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_parser.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_util.h"
 #include "base/values.h"
 #include "net/base/io_buffer.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/upload_data_stream.h"
 #include "net/http/http_chunked_decoder.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_request_info.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_status_line_validator.h"
 #include "net/http/http_util.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/ssl/token_binding.h"
+#include "url/url_canon.h"
 
 namespace net {
 
 namespace {
 
 enum HttpHeaderParserEvent {
   HEADER_PARSER_INVOKED = 0,
   // Obsolete: HEADER_HTTP_09_RESPONSE = 1,
   HEADER_ALLOWED_TRUNCATED_HEADERS = 2,
   HEADER_SKIPPED_WS_PREFIX = 3,
@@ skipping 162 matching lines @@
 const size_t HttpStreamParser::kChunkHeaderFooterSize = 12;
 
 HttpStreamParser::HttpStreamParser(ClientSocketHandle* connection,
                                    const HttpRequestInfo* request,
                                    GrowableIOBuffer* read_buffer,
                                    const BoundNetLog& net_log)
     : io_state_(STATE_NONE),
       request_(request),
       request_headers_(nullptr),
       request_headers_length_(0),
+      http_09_on_non_default_ports_enabled_(false),
       read_buf_(read_buffer),
       read_buf_unused_offset_(0),
       response_header_start_offset_(-1),
       received_bytes_(0),
       sent_bytes_(0),
       response_(nullptr),
       response_body_length_(-1),
       response_is_keep_alive_(false),
       response_body_read_(0),
       user_read_buf_(nullptr),
@@ skipping 770 matching lines @@
   }
 
   if (response_header_start_offset_ >= 0) {
     received_bytes_ += end_offset;
     std::string raw_headers =
         HttpUtil::AssembleRawHeaders(read_buf_->StartOfBuffer(), end_offset);
     ValidateStatusLine(
         std::string(read_buf_->StartOfBuffer(), raw_headers.find('\0')));
     headers = new HttpResponseHeaders(raw_headers);
   } else {
-    // Enough data was read -- there is no status line.
+    // Enough data was read -- there is no status line, so this is HTTP/0.9, or
+    // the server is broken / doesn't speak HTTP.
+
+    // If the port is not the default for the scheme, assume it's not a real
+    // HTTP/0.9 response, and fail the request.
+    // TODO(crbug.com/624462):  Further restrict the cases in which we allow
+    // HTTP/0.9.
+    std::string scheme(request_->url.scheme());
+    if (!http_09_on_non_default_ports_enabled_ &&
+        url::DefaultPortForScheme(scheme.c_str(), scheme.length()) !=
+            request_->url.EffectiveIntPort()) {
+      return ERR_INVALID_HTTP_RESPONSE;
+    }
+
     headers = new HttpResponseHeaders(std::string("HTTP/0.9 200 OK"));
 
     if (request_->url.SchemeIsCryptographic()) {
       RecordHeaderParserEvent(HEADER_HTTP_09_RESPONSE_OVER_SSL);
     } else {
       RecordHeaderParserEvent(HEADER_HTTP_09_RESPONSE_OVER_HTTP);
     }
     if (connection_->is_reused())
       RecordHeaderParserEvent(HEADER_HTTP_09_ON_REUSED_SOCKET);
   }
@@ skipping 206 matching lines @@
   UMA_HISTOGRAM_ENUMERATION("Net.HttpStatusLineStatus", status,
                             HttpStatusLineValidator::STATUS_LINE_MAX);
 }
 
 bool HttpStreamParser::SendRequestBuffersEmpty() {
   return request_headers_ == nullptr && request_body_send_buf_ == nullptr &&
          request_body_send_buf_ == nullptr;
 }
 
 }  // namespace net