Bug 1405971 - Strip existing disallowed schemes in Origin header. r=JuniorHsu,ckerschb

Differential Revision: https://phabricator.services.mozilla.com/D39781

--HG--
extra : moz-landing-system : lando

netwerk/protocol/http/nsHttpChannel.cpp

@@ -9784,27 +9784,40 @@ void nsHttpChannel::MaybeWarnAboutAppCache() {
 
 // Step 10 of HTTP-network-or-cache fetch
 void nsHttpChannel::SetOriginHeader() {
-  if (mRequestHead.IsGet() || mRequestHead.IsHead()) {
-    return;
-  }
   nsresult rv;
 
   nsAutoCString existingHeader;
   Unused << mRequestHead.GetHeader(nsHttp::Origin, existingHeader);
-  if (!existingHeader.IsEmpty()) {
-    LOG(("nsHttpChannel::SetOriginHeader Origin header already present"));
+  if (!existingHeader.IsEmpty() && !existingHeader.EqualsLiteral("null")) {
+    LOG(
+        ("nsHttpChannel::SetOriginHeader Origin header already present "
+         "[this=%p]",
+         this));
     nsCOMPtr<nsIURI> uri;
     rv = NS_NewURI(getter_AddRefs(uri), existingHeader);
-    if (NS_SUCCEEDED(rv) &&
-        ReferrerInfo::ShouldSetNullOriginHeader(this, uri)) {
-      LOG(("nsHttpChannel::SetOriginHeader null Origin by Referrer-Policy"));
-      rv = mRequestHead.SetHeader(nsHttp::Origin, NS_LITERAL_CSTRING("null"),
-                                  false /* merge */);
+    if (NS_FAILED(rv) || !dom::ReferrerInfo::IsReferrerSchemeAllowed(uri)) {
+      LOG(
+          ("nsHttpChannel::SetOriginHeader removing header for disallowed "
+           "scheme [this=%p]",
+           this));
+      DebugOnly<nsresult> rv = mRequestHead.ClearHeader(nsHttp::Origin);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    } else if (ReferrerInfo::ShouldSetNullOriginHeader(this, uri)) {
+      LOG(
+          ("nsHttpChannel::SetOriginHeader null Origin by Referrer-Policy "
+           "[this=%p]",
+           this));
+      DebugOnly<nsresult> rv = mRequestHead.SetHeader(
+          nsHttp::Origin, NS_LITERAL_CSTRING("null"), false /* merge */);
       MOZ_ASSERT(NS_SUCCEEDED(rv));
     }
     return;
   }
 
+  if (mRequestHead.IsGet() || mRequestHead.IsHead()) {
+    return;
+  }
+
   // Instead of consulting Preferences::GetInt() all the time we
   // can cache the result to speed things up.
   static int32_t sSendOriginHeader = 0;