Max Karolinskiy
edd588d9b2
Chromium change: https://source.chromium.org/chromium/chromium/src/+/1917c17d0ad2fdc3e994a9aefd254b8db7bbe457 commit 1917c17d0ad2fdc3e994a9aefd254b8db7bbe457 Author: Takashi Toyoshima <toyoshim@chromium.org> Date: Wed Apr 22 19:42:38 2026 -0700 OOR-CORS: Enforce extra forbidden Sec- header checks This CL adds a new function ContainsForbiddenSecurityHeader in header_util to check for unauthorized Sec- headers from renderer. This function is used in both CorsURLLoaderFactory::IsValidRequest and CorsURLLoader::FollowRedirect to prevent renderer from injecting or modifying these headers, while permitting Client Hints and Sec-Purpose. Change-Id: Ia2923ccbddddba2657d72916a03e657c1785cd85 Bug: 494800494
13 lines
752 B
Diff
13 lines
752 B
Diff
diff --git a/services/network/public/cpp/header_util.cc b/services/network/public/cpp/header_util.cc
|
|
index cabfb3121e1d30d0cf84e7985a21de78b27cf65c..53b93d04ee4f43cdad960423491a5cc21bf776e7 100644
|
|
--- a/services/network/public/cpp/header_util.cc
|
|
+++ b/services/network/public/cpp/header_util.cc
|
|
@@ -120,6 +120,7 @@ bool ContainsForbiddenSecurityHeader(net::HttpRequestHeaders& headers) {
|
|
|
|
auto sanitize_and_check_security_header = [&](std::string_view name,
|
|
std::string_view value) {
|
|
+ BRAVE_CONTAINS_FORBIDDEN_SECURITY_HEADER
|
|
// Client Hints are harmless and set by the renderer.
|
|
if (base::StartsWith(name, "Sec-CH-",
|
|
base::CompareCase::INSENSITIVE_ASCII)) {
|