Function headerValue

common/transferprotocol.cpp:185–222

Field names are case-insensitive (RFC 9110 5.1). Go's net/http canonicalises them before writing, so chlink's "X-CP-Token" reaches us as "X-Cp-Token": a case-sensitive lookup finds no PIN and every chlink upload dies with 403. Matching is also anchored to the start of a header line, so a value that happens to contain " :" cannot impersonate the header.

    // Matching is also anchored to the start of a header line, so a value that
    // happens to contain "<key>:" cannot impersonate the header.
    std::string headerValue(const std::string& headers, const std::string& key)
    {
        size_t lineStart = 0;
        while (lineStart < headers.size()) {
            size_t lineEnd = headers.find("\r\n", lineStart);
            if (lineEnd == std::string::npos) {
                lineEnd = headers.size();
            }

            size_t colon = headers.find(':', lineStart);
            if (colon != std::string::npos && colon < lineEnd && colon - lineStart == key.size()) {
                bool match = true;
                for (size_t i = 0; i < key.size(); ++i) {
                    if (tolower((unsigned char)headers[lineStart + i]) != tolower((unsigned char)key[i])) {
                        match = false;
                        break;
                    }
                }
                if (match) {
                    size_t valueStart = colon + 1;
                    while (valueStart < lineEnd && (headers[valueStart] == ' ' || headers[valueStart] == '\t')) {
                        valueStart++;
                    }
                    size_t valueEnd = lineEnd;
                    while (valueEnd > valueStart && (headers[valueEnd - 1] == ' ' || headers[valueEnd - 1] == '\t')) {
                        valueEnd--;
                    }
                    return headers.substr(valueStart, valueEnd - valueStart);
                }
            }

            if (lineEnd == headers.size()) {
                break;
            }
            lineStart = lineEnd + 2;
        }
        return "";
    }

    bool constantTimeEquals(const std::string& a, const std::string& b)
    {