utils/curl: fix headers check for protected urls

[bayandin]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

This PR fixes headers check in url_protected_by_cloudflare? and url_protected_by_incapsula?` methods.

$ brew audit linode-cli --online --git --skip-style --verbose
Error: undefined method `match?' for #<Hash:0x00007fd81a9de668>
Please report this issue:
  https://docs.brew.sh/Troubleshooting
/usr/local/Homebrew/Library/Homebrew/utils/curl.rb:205:in `url_protected_by_cloudflare?'
/usr/local/Homebrew/Library/Homebrew/utils/curl.rb:268:in `curl_check_http_content'
/usr/local/Homebrew/Library/Homebrew/formula_auditor.rb:469:in `audit_homepage'
/usr/local/Homebrew/Library/Homebrew/formula_auditor.rb:845:in `block in audit'
/usr/local/Homebrew/Library/Homebrew/formula_auditor.rb:840:in `each'
/usr/local/Homebrew/Library/Homebrew/formula_auditor.rb:840:in `audit'
/usr/local/Homebrew/Library/Homebrew/dev-cmd/audit.rb:196:in `block in audit'
/usr/local/Homebrew/Library/Homebrew/dev-cmd/audit.rb:180:in `to_h'
/usr/local/Homebrew/Library/Homebrew/dev-cmd/audit.rb:180:in `audit'
/usr/local/Homebrew/Library/Homebrew/brew.rb:110:in `<main>'

Spotted in Homebrew/homebrew-core#100147

[BrewTestBot]

Review period skipped due to critical label.

[bayandin]

I've changed the logic here because the same header won't satisfy both /^Set-Cookie: visid_incap_/i and /^Set-Cookie: incap_ses_/i (I assume that details[:headers] is a regular hash that can't contain several values with the same key, and we got string values here).

/cc @samford

[samford]

Thanks for the fix!

At the moment, headers from #parse_curl_output only include the last instance of a given header (i.e., an earlier header will be overwritten by a later header). :headers was just a string before (i.e., the entire header text from a response in curl output), so this previously checked all instances of a given header in a response.

There can be multiple Set-Cookie headers in a response, so we'll need to modify #parse_curl_output to properly handle multiple instances of a header. The simplest route would be to collect values in an array when a header appears more than once (I've seen this done in some libraries). We will have to update logic that accesses the value (e.g., the methods in this PR) to handle a potential string or array value but there's no good way around that (i.e., concatenating values from multiple headers into one string can lead to problems).

I'll tinker with this a bit (later today) and try to get a PR up.

[MikeMcQuaid]

Thanks @bayandin! Change looks good, optional style tweak which you can decline if desired.