diff options
| -rw-r--r-- | chrome_frame/html_utils.cc | 2 | ||||
| -rw-r--r-- | chrome_frame/test/html_util_unittests.cc | 7 |
2 files changed, 8 insertions, 1 deletions
diff --git a/chrome_frame/html_utils.cc b/chrome_frame/html_utils.cc index dcc1f53..9395afa 100644 --- a/chrome_frame/html_utils.cc +++ b/chrome_frame/html_utils.cc @@ -360,7 +360,7 @@ bool HasFrameBustingHeader(const std::string& http_headers) { net::HttpUtil::HeadersIterator it( http_headers.begin(), http_headers.end(), "\r\n"); while (it.GetNext()) { - if (it.name() == kXFrameOptionsHeader) { + if (lstrcmpiA(it.name().c_str(), kXFrameOptionsHeader) == 0) { std::string allow_all(kXFrameOptionsValueAllowAll); if (it.values_end() - it.values_begin() != allow_all.length() || !std::equal(it.values_begin(), it.values_end(), diff --git a/chrome_frame/test/html_util_unittests.cc b/chrome_frame/test/html_util_unittests.cc index 7248b80..1188482 100644 --- a/chrome_frame/test/html_util_unittests.cc +++ b/chrome_frame/test/html_util_unittests.cc @@ -316,6 +316,7 @@ TEST(HttpUtils, HasFrameBustingHeader) { // Simple negative cases. EXPECT_FALSE(http_utils::HasFrameBustingHeader("")); EXPECT_FALSE(http_utils::HasFrameBustingHeader("Content-Type: text/plain")); + EXPECT_FALSE(http_utils::HasFrameBustingHeader("X-Frame-Optionss: ALLOWALL")); // Explicit negative cases, test that we ignore case. EXPECT_FALSE(http_utils::HasFrameBustingHeader("X-Frame-Options: ALLOWALL")); EXPECT_FALSE(http_utils::HasFrameBustingHeader("X-Frame-Options: allowall")); @@ -342,6 +343,12 @@ TEST(HttpUtils, HasFrameBustingHeader) { EXPECT_TRUE(http_utils::HasFrameBustingHeader( "X-Frame-Options: SAMEorigin")); + // Verify that we pick up case changes in the header name too: + EXPECT_TRUE(http_utils::HasFrameBustingHeader("X-FRAME-OPTIONS: deny")); + EXPECT_TRUE(http_utils::HasFrameBustingHeader("x-frame-options: deny")); + EXPECT_TRUE(http_utils::HasFrameBustingHeader("X-frame-optionS: deny")); + EXPECT_TRUE(http_utils::HasFrameBustingHeader("X-Frame-optionS: deny")); + // Allowall entries do not override the denying entries, are // order-independent, and the deny entries can interleave with // other headers. |