Make the default HTTP server configuration more secure

sdk/lib/io/http_headers.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 class _HttpHeaders implements HttpHeaders {
   final Map<String, List<String>> _headers;
   final String protocolVersion;
 
@@ skipping 234 matching lines @@
     } else {
       return null;
     }
   }
 
   void set contentType(ContentType contentType) {
     _checkMutable();
     _set(HttpHeaders.CONTENT_TYPE, contentType.toString());
   }
 
+  void clear() {
+    _headers.clear();

[Anders Johnsen, 2014/08/08 06:15:45]

What about all the fields?

Please add test with e.g. 

var headers = ...;
headers.contentLength = 0;
headers.clear();
Expect.equals(headers.contentLength, -1);

[Søren Gjesse, 2014/08/11 14:10:09]

Done.

+  }
+
   // [name] must be a lower-case version of the name.
   void _add(String name, value) {
     assert(name == _validateField(name));
     // Use the length as index on what method to call. This is notable
     // faster than computing hash and looking up in a hash-map.
     switch (name.length) {
       case 4:
         if (HttpHeaders.DATE == name) {
           _addDate(name, value);
           return;
@@ skipping 525 matching lines @@
 }
 
 
 class _Cookie implements Cookie {
   String name;
   String value;
   DateTime expires;
   int maxAge;
   String domain;
   String path;
-  bool httpOnly = false;
+  bool httpOnly = true;
   bool secure = false;
 
   _Cookie([this.name, this.value]) {
     _validate();
   }
 
   _Cookie.fromSetCookieValue(String value) {
+    httpOnly = false;

[Anders Johnsen, 2014/08/08 06:15:45]

Is this because of spec? Can you add comment?

[Søren Gjesse, 2014/08/11 14:10:09]

Changed the default back to false, and set it to true in the non-parsing
constructor. Added a comment there.

     // Parse the 'set-cookie' header value.
     _parseSetCookieValue(value);
   }
 
   // Parse a 'set-cookie' header value according to the rules in RFC 6265.
   void _parseSetCookieValue(String s) {
     int index = 0;
 
     bool done() => index == s.length;
 
@@ skipping 117 matching lines @@
             (codeUnit >= 0x23 && codeUnit <= 0x2B) ||
             (codeUnit >= 0x2D && codeUnit <= 0x3A) ||
             (codeUnit >= 0x3C && codeUnit <= 0x5B) ||
             (codeUnit >= 0x5D && codeUnit <= 0x7E))) {
         throw new FormatException(
             "Invalid character in cookie value, code unit: '$codeUnit'");
       }
     }
   }
 }