X-XSS-Protection parser shoud reject '0; mode=block'

Source/platform/network/HTTPParsers.cpp

 /*
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ skipping 337 matching lines @@
 
         charsetPos = pos;
         charsetLen = endpos - pos;
         return;
     }
 }
 
 ReflectedXSSDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL)
 {
     DEFINE_STATIC_LOCAL(String, failureReasonInvalidToggle, ("expected 0 or 1"));
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidDisable, ("'0' disables protections, and may not be followed by any characters"));
     DEFINE_STATIC_LOCAL(String, failureReasonInvalidSeparator, ("expected semicolon"));
     DEFINE_STATIC_LOCAL(String, failureReasonInvalidEquals, ("expected equals sign"));
     DEFINE_STATIC_LOCAL(String, failureReasonInvalidMode, ("invalid mode directive"));
     DEFINE_STATIC_LOCAL(String, failureReasonInvalidReport, ("invalid report directive"));
     DEFINE_STATIC_LOCAL(String, failureReasonDuplicateMode, ("duplicate mode directive"));
     DEFINE_STATIC_LOCAL(String, failureReasonDuplicateReport, ("duplicate report directive"));
     DEFINE_STATIC_LOCAL(String, failureReasonInvalidDirective, ("unrecognized directive"));
 
     unsigned pos = 0;
 
     if (!skipWhiteSpace(header, pos, false))
         return ReflectedXSSUnset;
 
-    if (header[pos] == '0')
-        return AllowReflectedXSS;
+    if (header[pos] == '0') {
+        pos++;
+        skipWhiteSpace(header, pos, false);
+        if (pos == header.length())
+            return AllowReflectedXSS;

[Tom Sepez, 2013/11/28 00:09:15]

I'm almost inclined to suggest getting rid of the early returns and parse out
all the ;-separated options, and in the end barf if AllowReflectedXSS &&
modeDirectiveSeen and so forth.

+        failureReason = failureReasonInvalidDisable;
+        return ReflectedXSSInvalid;
+    }
 
     if (header[pos++] != '1') {
         failureReason = failureReasonInvalidToggle;
         return ReflectedXSSInvalid;
     }
 
     ReflectedXSSDisposition result = FilterReflectedXSS;
     bool modeDirectiveSeen = false;
     bool reportDirectiveSeen = false;
 
@@ skipping 296 matching lines @@
 
 size_t parseHTTPRequestBody(const char* data, size_t length, Vector<unsigned char>& body)
 {
     body.clear();
     body.append(data, length);
 
     return length;
 }
 
 }