Make the default HTTP server configuration more secure

sdk/lib/io/http_headers.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 class _HttpHeaders implements HttpHeaders {
   final Map<String, List<String>> _headers;
   final String protocolVersion;
 
   bool _mutable = true;  // Are the headers currently mutable?
   List<String> _noFoldingHeaders;
 
   int _contentLength = -1;
   bool _persistentConnection = true;
   bool _chunkedTransferEncoding = false;
   String _host;
   int _port;
 
   final int _defaultPortForScheme;
 
   _HttpHeaders(this.protocolVersion,
-               {int defaultPortForScheme: HttpClient.DEFAULT_HTTP_PORT})
+               {int defaultPortForScheme: HttpClient.DEFAULT_HTTP_PORT,
+                _HttpHeaders initialHeaders})
       : _headers = new HashMap<String, List<String>>(),
         _defaultPortForScheme = defaultPortForScheme {
+    if (initialHeaders != null) {
+      initialHeaders._headers.forEach((name, value) => _headers[name] = value);
+      _contentLength = initialHeaders._contentLength;
+      _persistentConnection = initialHeaders._persistentConnection;
+      _chunkedTransferEncoding = initialHeaders._chunkedTransferEncoding;

[Anders Johnsen, 2014/08/12 05:49:13]

This may be problematic if protocolVersions doesn't match, e.g. wget is used and
enforces 1.0 when chunked is set.

[Søren Gjesse, 2014/08/12 06:53:49]

Good point. Clearing it for 1.0. Anyway setting chunked transfer encoding as a
default header is also asking for trouble...

+      _host = initialHeaders._host;
+      _port = initialHeaders._port;
+    }
     if (protocolVersion == "1.0") {
       _persistentConnection = false;
     }
   }
 
   List<String> operator[](String name) => _headers[name.toLowerCase()];
 
   String value(String name) {
     name = name.toLowerCase();
     List<String> values = _headers[name];
@@ skipping 209 matching lines @@
     } else {
       return null;
     }
   }
 
   void set contentType(ContentType contentType) {
     _checkMutable();
     _set(HttpHeaders.CONTENT_TYPE, contentType.toString());
   }
 
+  void clear() {
+    _checkMutable();
+    _headers.clear();
+    _contentLength = -1;
+    _persistentConnection = true;
+    _chunkedTransferEncoding = false;
+    _host = null;
+    _port = null;
+  }
+
   // [name] must be a lower-case version of the name.
   void _add(String name, value) {
     assert(name == _validateField(name));
     // Use the length as index on what method to call. This is notable
     // faster than computing hash and looking up in a hash-map.
     switch (name.length) {
       case 4:
         if (HttpHeaders.DATE == name) {
           _addDate(name, value);
           return;
@@ skipping 529 matching lines @@
   String name;
   String value;
   DateTime expires;
   int maxAge;
   String domain;
   String path;
   bool httpOnly = false;
   bool secure = false;
 
   _Cookie([this.name, this.value]) {
+    // Default value of httponly is true.
+    httpOnly = true;
     _validate();
   }
 
   _Cookie.fromSetCookieValue(String value) {
     // Parse the 'set-cookie' header value.
     _parseSetCookieValue(value);
   }
 
   // Parse a 'set-cookie' header value according to the rules in RFC 6265.
   void _parseSetCookieValue(String s) {
@@ skipping 121 matching lines @@
             (codeUnit >= 0x23 && codeUnit <= 0x2B) ||
             (codeUnit >= 0x2D && codeUnit <= 0x3A) ||
             (codeUnit >= 0x3C && codeUnit <= 0x5B) ||
             (codeUnit >= 0x5D && codeUnit <= 0x7E))) {
         throw new FormatException(
             "Invalid character in cookie value, code unit: '$codeUnit'");
       }
     }
   }
 }