Closed Bug 1557189 Opened 5 years ago Closed 5 years ago

[wpt-sync] Sync PR 17200 - Prevent leaking Sec- Request Headers on HTTPS Downgrade Redirects.

Categories

(Core :: DOM: Networking, defect, P4)

Product:
Core
Component:
DOM: Networking
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla70
Tracking Flags:
Tracking Status
firefox70 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream][necko-triaged] )

Sync web-platform-tests PR 17200 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/17200
Details from upstream follow.

Brandon Maslen <brandm@microsoft.com> wrote:

Prevent leaking Sec- Request Headers on HTTPS Downgrade Redirects.

Currently various Sec- headers are added through the codebase and correctly check if the request target url is trustworthy. If the destination is not trustworthy then the headers are not added. However in the event a request redirects from a trustworthy to non-trustworthy destination, such as https => http, there may be pre-existing headers present. Since these headers would not have been added to the non-trustworthy request we need to remove these extra headers from the request.

This change adds a helper call to the UrlLoader class in the network service to remove any request headers prefixed with "sec-" when a downgrade redirect is detected. In addition to this unit test cases for the helper and end to end WPT cases have been added to validate the scenario and prevent future regressions.

Bug: 964053
Change-Id: I109c3ec1b3a05f6341c3c4adbd1a8da1274fd0d6
Reviewed-on: https://chromium-review.googlesource.com/1647354
WPT-Export-Revision: 5586168722e4d66ca3049f742f90d37d49299cbd

Component: web-platform-tests → DOM: Networking
Product: Testing → Core
Whiteboard: [wptsync downstream] → [wptsync downstream][necko-triaged]
Whiteboard: [wptsync downstream][necko-triaged] → [wptsync downstream]
Whiteboard: [wptsync downstream] → [wptsync downstream][necko-triaged]
Failed to get results from try push
Pushed by james@hoppipolla.co.uk:
https://hg.mozilla.org/integration/mozilla-inbound/rev/60e39993bb94
[wpt PR 17200] - Prevent leaking Sec-CH-/Sec-Fetch- Request Headers on HTTPS Downgrade Redirects., a=testonly

https://hg.mozilla.org/mozilla-central/rev/60e39993bb94

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox70: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
You need to log in before you can comment on or make changes to this bug.