wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-28 18:28:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2070 - When multiple HSTS headers are received, only consider the first.

Browse source 
This implements a plain interpretations of RFC 6797, which says to only consider
the first HSTS header.
This slightly conflicts with RFC 7230, which says that sending multiple headers
which can't be merged is illegal (except for a specific whitelist which HSTS isn't in),
so this situation should never occur in the first place (and would therefore not need
the explicit entry in RFC 6797).

It improves HSTS robustness dealing with non-compliant servers.

Resolves #2070
This commit is contained in:
Moonchild 2022-12-25 11:42:42 +00:00 • committed by roytam1
commit c95a802078
5 changed files with 51 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
netwerk/protocol/http/nsHttpHeaderArray.cpp
View file

@ -79,7 +79,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header,
return SetHeader_internal(header, headerName, value, variety);
} else if (merge && !IsSingletonHeader(header)) {
return MergeHeader(header, entry, value, variety);
} else {
} else if (!IsIgnoreMultipleHeader(header)) {
// Replace the existing string with the new value
if (entry->variety == eVarietyResponseNetOriginalAndResponse) {
MOZ_ASSERT(variety == eVarietyResponse);
@ -190,7 +190,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header,
eVarietyResponseNetOriginal);
}
return rv;
} else {
} else if (!IsIgnoreMultipleHeader(header)) {
// Multiple instances of non-mergeable header received from network
// - ignore if same value
if (!entry->value.Equals(value)) {