disallow restricted XMLHttpRequest header prefixes

components/script/dom/xmlhttprequest.rs

@@ -423,20 +423,26 @@ impl XMLHttpRequestMethods for XMLHttpRequest {
         let name_lower = name.to_lower();
         let name_str = match name_lower.as_str() {
             Some(s) => {
-                match s {
-                    // Step 5
-                    // Disallowed headers
-                    "accept-charset" | "accept-encoding" |
-                    "access-control-request-headers" |
-                    "access-control-request-method" |
-                    "connection" | "content-length" |
-                    "cookie" | "cookie2" | "date" |"dnt" |
-                    "expect" | "host" | "keep-alive" | "origin" |
-                    "referer" | "te" | "trailer" | "transfer-encoding" |
-                    "upgrade" | "user-agent" | "via" => {
-                        return Ok(());
-                    },
-                    _ => s
+                // Step 5
+                // Disallowed headers and header prefixes:
+                // https://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method
+                let disallowedHeaders =
+                    ["accept-charset", "accept-encoding",
+                    "access-control-request-headers",
+                    "access-control-request-method",
+                    "connection", "content-length",
+                    "cookie", "cookie2", "date", "dnt",
+                    "expect", "host", "keep-alive", "origin",
+                    "referer", "te", "trailer", "transfer-encoding",
+                    "upgrade", "user-agent", "via"];
+
+                let disallowedHeaderPrefixes = ["sec-", "proxy-"];
+
+                if disallowedHeaders.iter().any(|header| *header == s) ||
+                   disallowedHeaderPrefixes.iter().any(|prefix| s.starts_with(prefix)) {
+                    return Ok(())
+                } else {
+                    s
                 }
             },
             None => unreachable!()