Sort header names in Access-Control-Request-Headers

Source/core/fetch/CrossOriginAccessControl.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 67 matching lines @@
     updateRequestForAccessControl(preflightRequest, securityOrigin, DoNotAllowStoredCredentials);
     preflightRequest.setHTTPMethod("OPTIONS");
     preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", request.httpMethod());
     preflightRequest.setPriority(request.priority());
     preflightRequest.setRequestContext(request.requestContext());
     preflightRequest.setSkipServiceWorker(true);
 
     const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
 
     if (requestHeaderFields.size() > 0) {
-        StringBuilder headerBuffer;
+        // Sort header names lexicographically: https://crbug.com/452391
+        // Fetch API Spec:
+        //   https://fetch.spec.whatwg.org/#cors-preflight-fetch-0
+        Vector<String> headers;
         for (const auto& header : requestHeaderFields) {
             if (equalIgnoringCase(header.key, "referer")) {
                 // When the request is from a Worker, referrer header was added
                 // by WorkerThreadableLoader. But it should not be added to
                 // Access-Control-Request-Headers header.
                 continue;
             }
+            headers.append(header.key.lower());
+        }
+        std::sort(headers.begin(), headers.end(), WTF::codePointCompareLessThan);
+        StringBuilder headerBuffer;
+        for (const String& header : headers) {
             if (!headerBuffer.isEmpty())
                 headerBuffer.appendLiteral(", ");
-            headerBuffer.append(header.key);
+            headerBuffer.append(header);
         }
-        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", AtomicString(headerBuffer.toString().lower()));
+        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", AtomicString(headerBuffer.toString()));
     }
 
     return preflightRequest;
 }
 
 static bool isOriginSeparator(UChar ch)
 {
     return isASCIISpace(ch) || ch == ',';
 }
 
@@ skipping 134 matching lines @@
         request.setHTTPOrigin(securityOrigin->toAtomicString());
         // If the user didn't request credentials in the first place, update our
         // state so we neither request them nor expect they must be allowed.
         if (options.credentialsRequested == ClientDidNotRequestCredentials)
             options.allowCredentials = DoNotAllowStoredCredentials;
     }
     return true;
 }
 
 } // namespace blink