Description: fix cache-poisoning attacks via an HTTP request with an absolute-URI
Origin: backport, http://bazaar.launchpad.net/~squid/squid/3.4/revision/13240
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823968

Index: squid3-3.3.8/src/client_side.cc
===================================================================
--- squid3-3.3.8.orig/src/client_side.cc	2016-06-07 07:26:45.000000000 -0400
+++ squid3-3.3.8/src/client_side.cc	2016-06-07 10:01:03.478547071 -0400
@@ -2651,6 +2651,23 @@
         goto finish;
     }
 
+    // when absolute-URI is provided Host header should be ignored. However
+    // some code still uses Host directly so normalize it.
+    // For now preserve the case where Host is completely absent.
+    if (request->header.has(HDR_HOST)) {
+        const char *host = request->header.getStr(HDR_HOST);
+        MemBuf authority;
+        authority.init();
+        if (request->port != urlDefaultPort(request->protocol))
+            authority.Printf("%s:%d", request->GetHost(), request->port);
+        else
+            authority.Printf("%s", request->GetHost());
+        debugs(33, 5, "URL domain " << authority.buf << " overrides header Host: " << host);
+        // URL authority overrides Host header
+        request->header.delById(HDR_HOST);
+        request->header.putStr(HDR_HOST, authority.buf);
+    }
+
     request->clientConnectionManager = conn;
 
     request->flags.accelerated = http->flags.accel;
