Process only the first Strict-Transport-Security header.
In accordance with the specification.
BUG=156147
Review URL: https://chromiumcodereview.appspot.com/11192045
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@165013 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index aab892f3..2860e7e5 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -701,7 +701,16 @@
void* iter = NULL;
base::Time now = base::Time::Now();
+ // http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec:
+ //
+ // If a UA receives more than one STS header field in a HTTP response
+ // message over secure transport, then the UA MUST process only the
+ // first such header field.
+ bool seen_sts = false;
while (headers->EnumerateHeader(&iter, "Strict-Transport-Security", &value)) {
+ if (seen_sts)
+ return;
+ seen_sts = true;
TransportSecurityState::DomainState domain_state;
if (domain_state.ParseSTSHeader(now, value))
security_state->EnableHost(host, domain_state);
diff --git a/net/url_request/url_request_test_util.cc b/net/url_request/url_request_test_util.cc
index 33ea742..28da79f 100644
--- a/net/url_request/url_request_test_util.cc
+++ b/net/url_request/url_request_test_util.cc
@@ -85,6 +85,10 @@
context_storage_.set_http_server_properties(
new net::HttpServerPropertiesImpl);
}
+ if (!transport_security_state()) {
+ context_storage_.set_transport_security_state(
+ new net::TransportSecurityState());
+ }
net::HttpNetworkSession::Params params;
params.host_resolver = host_resolver();
params.cert_verifier = cert_verifier();
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 402b773..38b574a 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -3060,6 +3060,61 @@
EXPECT_EQ("a, b", header);
}
+TEST_F(URLRequestTestHTTP, ProcessSTS) {
+ TestServer::SSLOptions ssl_options;
+ TestServer https_test_server(
+ TestServer::TYPE_HTTPS,
+ ssl_options,
+ FilePath(FILE_PATH_LITERAL("net/data/url_request_unittest")));
+ ASSERT_TRUE(https_test_server.Start());
+
+ TestDelegate d;
+ URLRequest request(
+ https_test_server.GetURL("files/hsts-headers.html"),
+ &d,
+ &default_context_);
+ request.Start();
+ MessageLoop::current()->Run();
+
+ TransportSecurityState* security_state =
+ default_context_.transport_security_state();
+ bool sni_available = true;
+ TransportSecurityState::DomainState domain_state;
+ EXPECT_TRUE(security_state->GetDomainState(
+ TestServer::kLocalhost, sni_available, &domain_state));
+ EXPECT_EQ(TransportSecurityState::DomainState::MODE_FORCE_HTTPS,
+ domain_state.upgrade_mode);
+ EXPECT_TRUE(domain_state.include_subdomains);
+}
+
+TEST_F(URLRequestTestHTTP, ProcessSTSOnce) {
+ TestServer::SSLOptions ssl_options;
+ TestServer https_test_server(
+ TestServer::TYPE_HTTPS,
+ ssl_options,
+ FilePath(FILE_PATH_LITERAL("net/data/url_request_unittest")));
+ ASSERT_TRUE(https_test_server.Start());
+
+ TestDelegate d;
+ URLRequest request(
+ https_test_server.GetURL("files/hsts-multiple-headers.html"),
+ &d,
+ &default_context_);
+ request.Start();
+ MessageLoop::current()->Run();
+
+ // We should have set parameters from the first header, not the second.
+ TransportSecurityState* security_state =
+ default_context_.transport_security_state();
+ bool sni_available = true;
+ TransportSecurityState::DomainState domain_state;
+ EXPECT_TRUE(security_state->GetDomainState(
+ TestServer::kLocalhost, sni_available, &domain_state));
+ EXPECT_EQ(TransportSecurityState::DomainState::MODE_FORCE_HTTPS,
+ domain_state.upgrade_mode);
+ EXPECT_FALSE(domain_state.include_subdomains);
+}
+
TEST_F(URLRequestTestHTTP, ContentTypeNormalizationTest) {
ASSERT_TRUE(test_server_.Start());
