Add CORS headers to URLRequestRedirectJob.

net/url_request/url_request_redirect_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_redirect_job.h"
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
+#include "base/strings/string_number_conversions.h"
 #include "net/base/load_timing_info.h"
 #include "net/base/net_log.h"
+#include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 
 namespace net {
 
 URLRequestRedirectJob::URLRequestRedirectJob(URLRequest* request,
                                              NetworkDelegate* network_delegate,
                                              const GURL& redirect_destination,
                                              StatusCode http_status_code,
                                              const std::string& redirect_reason)
     : URLRequestJob(request, network_delegate),
@@ skipping 27 matching lines @@
   return false;
 }
 
 URLRequestRedirectJob::~URLRequestRedirectJob() {}
 
 void URLRequestRedirectJob::StartAsync() {
   receive_headers_end_ = base::TimeTicks::Now();
   NotifyHeadersComplete();
 }
 
+void URLRequestRedirectJob::GetResponseInfo(HttpResponseInfo* info) {
+  scoped_refptr<net::HttpResponseHeaders> response_headers(
+      new net::HttpResponseHeaders(std::string()));
+  std::string status_line;
+  status_line += "HTTP/1.1 ";
+  status_line += base::IntToString(http_status_code_);
+  status_line += " " + redirect_reason_;;

[abarth-chromium, 2014/06/23 17:01:09]

This is a very slow way to construct a string.

[robwu, 2014/06/23 17:28:19]

What about:

std::string status_line(base::StringPrintf("HTTP/1.1 %d %s", http_status_code_,
redirect_reason_.c_str()));

+
+  response_headers->ReplaceStatusLine(status_line);
+  const net::HttpRequestHeaders& headers = request_->extra_request_headers();
+  std::string http_origin;
+  if (headers.GetHeader("Origin", &http_origin)) {
+    // If this redirect is used in a cross-origin request, add the necessary
+    // CORS headers to prevent the redirect from being blocked by cross-origin
+    // access control. Note that the request is still blocked if the redirection
+    // target does not serve the necessary CORS headers.
+    response_headers->AddHeader("Access-Control-Allow-Origin: " + http_origin);

[abarth-chromium, 2014/06/23 17:01:09]

Does this line represent an HTTP header injection vulnerability?  How do you
know that http_origin won't split the header?

[robwu, 2014/06/23 17:28:19]

The Origin request header is set by the browser (Blink). This header cannot be
forged by regular web pages (not even through XMLHttpRequest).

+    response_headers->AddHeader("Access-Control-Allow-Credentials: true");
+  }
+  info->headers = response_headers;
+}
+
 void URLRequestRedirectJob::GetLoadTimingInfo(
     LoadTimingInfo* load_timing_info) const {
   // Set send_start and send_end to receive_headers_end_ to keep consistent
   // with network cache behavior.
   load_timing_info->send_start = receive_headers_end_;
   load_timing_info->send_end = receive_headers_end_;
   load_timing_info->receive_headers_end = receive_headers_end_;
 }
 
 }  // namespace net