Make the default HTTP server configuration more secure

sdk/lib/io/http_impl.dart

Index: sdk/lib/io/http_impl.dart
diff --git a/sdk/lib/io/http_impl.dart b/sdk/lib/io/http_impl.dart
index 971186d9f3ee1edb3d1f2186caba2a124aeb0557..fcb40fe286bfcb30e7a84a170fd773c975bd2bdd 100644
--- a/sdk/lib/io/http_impl.dart
+++ b/sdk/lib/io/http_impl.dart
@@ -503,9 +503,11 @@ class _HttpResponse extends _HttpOutboundMessage<HttpResponse>
   _HttpResponse(Uri uri,
                 String protocolVersion,
                 _HttpOutgoing outgoing,
+                HttpHeaders defaultHeaders,
                 String serverHeader)
       : super(uri, protocolVersion, outgoing) {
-    if (serverHeader != null) headers._add('server', serverHeader);
+    defaultHeaders.forEach((name, value) => headers.add(name, value));

[Anders Johnsen, 2014/08/08 06:15:45]

I'm curious to the overhead of this. Maybe we should have a headers._clone, that
will just copy the private fields (headers.add involves is-checks, to-lower-case
etc).

[Søren Gjesse, 2014/08/11 14:10:09]

Don't know. Pass the default header values to the HttpHeaders constructor for
faster cloning instead.

+    if (serverHeader != null) headers.set('server', serverHeader);
   }
 
   bool get _isConnectionClosed => _httpRequest._httpConnection._isClosing;
@@ -2037,6 +2039,7 @@ class _HttpConnection
           var response = new _HttpResponse(incoming.uri,
                                            incoming.headers.protocolVersion,
                                            outgoing,
+                                           _httpServer.defaultResponseHeaders,
                                            _httpServer.serverHeader);
           var request = new _HttpRequest(response, incoming, _httpServer, this);
           _streamFuture = outgoing.done
@@ -2155,6 +2158,7 @@ class _HttpServer
   static Map<int, _HttpServer> _servers = new Map<int, _HttpServer>();
 
   String serverHeader;
+  HttpHeaders defaultResponseHeaders;
 
   Duration _idleTimeout;
   Timer _idleTimer;
@@ -2182,6 +2186,7 @@ class _HttpServer
   }
 
   _HttpServer._(this._serverSocket, this._closeServer) {
+    _initDefaultResponseHeaders();
     _controller = new StreamController<HttpRequest>(sync: true,
                                                     onCancel: close);
     idleTimeout = const Duration(seconds: 120);
@@ -2190,6 +2195,7 @@ class _HttpServer
   }
 
   _HttpServer.listenOn(this._serverSocket) : _closeServer = false {
+    _initDefaultResponseHeaders();
     _controller = new StreamController<HttpRequest>(sync: true,
                                                     onCancel: close);
     idleTimeout = const Duration(seconds: 120);
@@ -2197,6 +2203,14 @@ class _HttpServer
     try { _serverSocket._owner = this; } catch (_) {}
   }
 
+  _initDefaultResponseHeaders() {
+    defaultResponseHeaders = new _HttpHeaders('1.1');
+    defaultResponseHeaders.contentType = ContentType.TEXT;
+    defaultResponseHeaders.set('X-Frame-Options', 'SAMEORIGIN');
+    defaultResponseHeaders.set('X-Content-Type-Options', 'nosniff');
+    defaultResponseHeaders.set('X-XSS-Protection', '1; mode=block');
+  }
+
   Duration get idleTimeout => _idleTimeout;
 
   void set idleTimeout(Duration duration) {