Sort header names in Access-Control-Request-Headers

Source/core/fetch/CrossOriginAccessControl.cpp

Index: Source/core/fetch/CrossOriginAccessControl.cpp
diff --git a/Source/core/fetch/CrossOriginAccessControl.cpp b/Source/core/fetch/CrossOriginAccessControl.cpp
index 803eca8baaad0071c54ccefd512bebf4009ece75..8ad3c32686b72121571b7d80c37435d9c3e95134 100644
--- a/Source/core/fetch/CrossOriginAccessControl.cpp
+++ b/Source/core/fetch/CrossOriginAccessControl.cpp
@@ -85,7 +85,12 @@ ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
     const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
 
     if (requestHeaderFields.size() > 0) {
-        StringBuilder headerBuffer;
+        // Sort header names lexicographically: https://crbug.com/452391
+        // Fetch API Spec:
+        //   https://fetch.spec.whatwg.org/#cors-preflight-fetch-0
+        // CORS Spec:
+        //   http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0

[tyoshino (SeeGerritForStatus), 2015/01/29 10:44:53]

it's ok to omit the W3C version.

[hiroshige, 2015/01/29 11:08:11]

Done.

+        Vector<String> headers;
         for (const auto& header : requestHeaderFields) {
             if (equalIgnoringCase(header.key, "referer")) {
                 // When the request is from a Worker, referrer header was added
@@ -93,11 +98,16 @@ ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
                 // Access-Control-Request-Headers header.
                 continue;
             }
+            headers.append(header.key.lower());
+        }
+        std::sort(headers.begin(), headers.end(), WTF::codePointCompareLessThan);
+        StringBuilder headerBuffer;
+        for (const String& header : headers) {
             if (!headerBuffer.isEmpty())
                 headerBuffer.appendLiteral(", ");
-            headerBuffer.append(header.key);
+            headerBuffer.append(header);
         }
-        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", AtomicString(headerBuffer.toString().lower()));
+        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", AtomicString(headerBuffer.toString()));
     }
 
     return preflightRequest;