Ignore cookie where both name and value are empty in SPDY header block

BUG=392295

Review URL: https://codereview.chromium.org/416243005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@286850 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 59 insertions, 4 deletions

diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
index 6f33e31..04ace40 100644
--- a/net/spdy/spdy_framer.cc
+++ b/net/spdy/spdy_framer.cc
@@ -31,6 +31,25 @@ uLong CalculateDictionaryId(const char* dictionary,
                  dictionary_size);
 }
 
+// Check to see if the name and value of a cookie are both empty.
+bool IsCookieEmpty(const base::StringPiece& cookie) {
+  if (cookie.size() == 0) {
+     return true;
+  }
+  size_t pos = cookie.find('=');
+  if (pos  == base::StringPiece::npos) {
+     return false;
+  }
+  // Ignore leading whitespaces of cookie value.
+  size_t value_start = pos + 1;
+  for (; value_start < cookie.size(); value_start++) {
+     if (!(cookie[value_start] == ' ' || cookie[value_start] == '\t')) {
+        break;
+     }
+  }
+  return (pos == 0) && ((cookie.size() - value_start) == 0);
+}
+
 struct DictionaryIds {
   DictionaryIds()
     : v2_dictionary_id(CalculateDictionaryId(kV2Dictionary, kV2DictionarySize)),
@@ -1257,12 +1276,18 @@ void SpdyFramer::WriteHeaderBlockToZ(const SpdyHeaderBlock* headers,
             break;
         }
         if (i < cookie_data.size()) {
-          cookie_values.push_back(cookie_data.substr(0, i));
-          cookie_length += i + 2 /* semicolon and space */;
+          if (!IsCookieEmpty(cookie_data.substr(0, i))) {
+            cookie_values.push_back(cookie_data.substr(0, i));
+            cookie_length += i + 2 /* semicolon and space */;
+          }
           cookie_data.remove_prefix(i + 1);
         } else {
-          cookie_values.push_back(cookie_data);
-          cookie_length += cookie_data.size();
+          if (!IsCookieEmpty(cookie_data)) {
+            cookie_values.push_back(cookie_data);
+            cookie_length += cookie_data.size();
+          } else if (cookie_length > 2) {
+            cookie_length -= 2 /* compensate for previously added length */;
+          }
           cookie_data.remove_prefix(i);
         }
       }
@@ -1313,6 +1338,7 @@ void SpdyFramer::WriteHeaderBlockToZ(const SpdyHeaderBlock* headers,
   DCHECK_EQ(Z_OK, rv);
   z->clas = kZStandardData;
 }
+
 #endif  // !defined(USE_SYSTEM_ZLIB)
 
 size_t SpdyFramer::ProcessControlFrameBeforeHeaderBlock(const char* data,
diff --git a/net/spdy/spdy_framer_test.cc b/net/spdy/spdy_framer_test.cc
index ce460dc..89e93cb 100644
--- a/net/spdy/spdy_framer_test.cc
+++ b/net/spdy/spdy_framer_test.cc
@@ -668,6 +668,35 @@ INSTANTIATE_TEST_CASE_P(SpdyFramerTests,
                         SpdyFramerTest,
                         ::testing::Values(SPDY2, SPDY3, SPDY4));
 
+// Test that we ignore cookie where both name and value are empty.
+TEST_P(SpdyFramerTest, HeaderBlockWithEmptyCookie) {
+  if (spdy_version_ > SPDY3) {
+    // Not implemented for hpack.
+    return;
+  }
+
+  SpdyFramer framer(spdy_version_);
+  framer.set_enable_compression(true);
+  SpdyHeadersIR headers(1);
+  headers.set_priority(1);
+  headers.SetHeader("cookie",
+                    "=; key=value; ;  = ; foo; bar=;  ;  =   ; k2=v2 ; =");
+  scoped_ptr<SpdyFrame> frame(framer.SerializeHeaders(headers));
+  EXPECT_TRUE(frame.get() != NULL);
+
+  TestSpdyVisitor visitor(spdy_version_);
+  visitor.use_compression_ = true;
+  visitor.SimulateInFramer(
+      reinterpret_cast<unsigned char*>(frame->data()),
+      frame->size());
+
+  EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_);
+  EXPECT_FALSE(CompareHeaderBlocks(&headers.name_value_block(),
+                                  &visitor.headers_));
+  EXPECT_EQ(1u, visitor.headers_.size());
+  EXPECT_EQ("key=value; foo; bar=; k2=v2 ", visitor.headers_["cookie"]);
+}
+
 // Test that we can encode and decode a SpdyHeaderBlock in serialized form.
 TEST_P(SpdyFramerTest, HeaderBlockInBuffer) {
   SpdyFramer framer(spdy_version_);