Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-05 05:30:08 +01:00
Code Issues Projects Releases Packages Wiki Activity

Ensure STS headers are only honoured when they come from an HTTPS host

Browse source
This commit is contained in:
Sam Gibson 2015-07-27 18:34:37 +12:00
parent c44579018a
commit 0d94ee917d
1 changed files with 18 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

5
components/net/http_loader.rs
View file

@ -15,8 +15,7 @@ use std::collections::HashSet;
use file_loader;
use flate2::read::{DeflateDecoder, GzDecoder};
use hyper::client::Request;
use hyper::header::{AcceptEncoding, Accept, ContentLength, ContentType, Host, Location, qitem};
use hyper::header::{Quality, QualityItem};
use hyper::header::{AcceptEncoding, Accept, ContentLength, ContentType, Host, Location, qitem, Quality, QualityItem};
use hyper::header::StrictTransportSecurity;
use hyper::Error as HttpError;
use hyper::method::Method;
@ -299,6 +298,7 @@ reason: \"certificate verify failed\" }]))";
}
}
if url.scheme == "https" {
if let Some(header) = response.headers.get::<StrictTransportSecurity>() {
if let Some(host) = url.domain() {
info!("adding host {} to the strict transport security list", host);
@ -318,6 +318,7 @@ reason: \"certificate verify failed\" }]))";
).unwrap();
}
}
}
if response.status.class() == StatusClass::Redirection {