Make the default HTTP server configuration more secure

sdk/lib/io/http_headers.dart

Index: sdk/lib/io/http_headers.dart
diff --git a/sdk/lib/io/http_headers.dart b/sdk/lib/io/http_headers.dart
index f621fff07fa1fc8e4246393737fc110480e49b4d..269237524c93556f50238f2fcb6b2f3b10953f23 100644
--- a/sdk/lib/io/http_headers.dart
+++ b/sdk/lib/io/http_headers.dart
@@ -20,9 +20,18 @@ class _HttpHeaders implements HttpHeaders {
   final int _defaultPortForScheme;
 
   _HttpHeaders(this.protocolVersion,
-               {int defaultPortForScheme: HttpClient.DEFAULT_HTTP_PORT})
+               {int defaultPortForScheme: HttpClient.DEFAULT_HTTP_PORT,
+                _HttpHeaders initialHeaders})
       : _headers = new HashMap<String, List<String>>(),
         _defaultPortForScheme = defaultPortForScheme {
+    if (initialHeaders != null) {
+      initialHeaders._headers.forEach((name, value) => _headers[name] = value);
+      _contentLength = initialHeaders._contentLength;
+      _persistentConnection = initialHeaders._persistentConnection;
+      _chunkedTransferEncoding = initialHeaders._chunkedTransferEncoding;

[Anders Johnsen, 2014/08/12 05:49:13]

This may be problematic if protocolVersions doesn't match, e.g. wget is used and
enforces 1.0 when chunked is set.

[Søren Gjesse, 2014/08/12 06:53:49]

Good point. Clearing it for 1.0. Anyway setting chunked transfer encoding as a
default header is also asking for trouble...

+      _host = initialHeaders._host;
+      _port = initialHeaders._port;
+    }
     if (protocolVersion == "1.0") {
       _persistentConnection = false;
     }
@@ -252,6 +261,16 @@ class _HttpHeaders implements HttpHeaders {
     _set(HttpHeaders.CONTENT_TYPE, contentType.toString());
   }
 
+  void clear() {
+    _checkMutable();
+    _headers.clear();
+    _contentLength = -1;
+    _persistentConnection = true;
+    _chunkedTransferEncoding = false;
+    _host = null;
+    _port = null;
+  }
+
   // [name] must be a lower-case version of the name.
   void _add(String name, value) {
     assert(name == _validateField(name));
@@ -801,6 +820,8 @@ class _Cookie implements Cookie {
   bool secure = false;
 
   _Cookie([this.name, this.value]) {
+    // Default value of httponly is true.
+    httpOnly = true;
     _validate();
   }