Issue 4951 - Restrict request headers in XMLHttpRequest.Also test Accept-Encoding with th…

lib/compat.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2016 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 306 matching lines @@
     "te": true,
     "trailer": true,
     "transfer-encoding": true,
     "upgrade": true,
     "via": true,
   },
   _forbiddenRequestHeadersRe: new RegExp("^(Proxy|Sec)-", "i"),
 
   _isRequestHeaderAllowed: function(header)
   {
-    if (this._forbiddenRequestHeaders[header.toLowerCase()] !== undefined) {

[sergei, 2017/03/02 22:25:31]

Actually it's not according to our coding style, so I would recommend to use
hasOwnProperty.

[hub, 2017/03/02 23:30:12]

Acknowledged.

+    if (this._forbiddenRequestHeaders.hasOwnProperty(header.toLowerCase()))
       return false;
-    }
-    if (header.match(this._forbiddenRequestHeadersRe)) {
+    if (header.match(this._forbiddenRequestHeadersRe))
       return false;
-    }
+
     return true;
   },
 
   addEventListener: function(eventName, handler, capture)
   {
     var list;
     if (eventName == "load")
       list = this._loadHandlers;
     else if (eventName == "error")
       list = this._errorHandlers;
@@ skipping 66 matching lines @@
 
   overrideMimeType: function(mime)
   {
   },
 
   setRequestHeader: function(name, value)
   {
     if (this.readyState > 1)
       throw new Error("Cannot set request header after sending");
 
-    if (this._isRequestHeaderAllowed(name)) {
+    if (this._isRequestHeaderAllowed(name))
       this._requestHeaders[name] = value;
-    } else {
-      console.warning("Attempt to set a forbidden header was denied: " + name);

[sergei, 2017/03/02 22:25:31]

the name of the method should be "warn"

[hub, 2017/03/02 23:30:12]

Looks like my testing has failed here. Will definitely fix that.

-    }
+    else
+      console.warn("Attempt to set a forbidden header was denied: " + name);
   },
 
   getResponseHeader: function(name)
   {
     name = name.toLowerCase();
     if (!this._responseHeaders || !this._responseHeaders.hasOwnProperty(name))
       return null;
     else
       return this._responseHeaders[name];
   },
 
   channel:
   {
     status: -1,
     notificationCallbacks: {},
     loadFlags: 0,
     INHIBIT_CACHING: 0,
     VALIDATE_ALWAYS: 0,
     QueryInterface: function()
     {
       return this;
     }
   }
 };