92768 - be more careful when matching HTTP header values

Status: RESOLVED DUPLICATE of bug 325808

(Core :: Networking: HTTP, defect)

Description

[Darin Fisher]

From brendan's comments on bug 92598:

> Just curious, not picking nits or asking for changes: why PL_strcasestr rather
> than PL_strcasecmp, or perhaps something more complicated that strips leading
> and trailing whitespace (tho I'd hope that PeekHeader does that for you)?  Are
> all the values guaranteed not to be substrings of other legal values?  Can you
> have random garbage around the no-store and get the desired results, according
> to the spec?
> 
> /be

it's possible that future versions of HTTP might define header values which
would "overlap" with existing HTTP/1.1 header values.  it is also likely that 
servers could send us garbage, which could be mistaken for a HTTP/1.1 header value.

Comment 1

[Bradley Baetz (:bbaetz)]

I've seen servers send Cache-Control: "no-cache", so we have to be a bit flexible.

I don't have an example url which springs to mind, though.

Comment 2

[Darin Fisher]

-> default owner

Comment 3

[Christian :Biesinger (don't email me, ping me on IRC)]

fixed by bug 325808 afaict

*** This bug has been marked as a duplicate of 325808 ***