Code: bool ProxyClientSocket::SanitizeProxyRedirect(HttpResponseInfo* response,
                                              const GURL& url) {
//// static
   DCHECK(response && response->headers.get());
 
   std::string location;
   if (!response->headers->IsRedirect(&location))
     return false;
 
  std::string fake_response_headers =
      base::StringPrintf("HTTP/1.0 302 Found\n"
                         "Location: %s\n"
                         "Content-length: 0\n"
                         "Connection: close\n"
                         "\n",
                         location.c_str());
   std::string raw_headers =
       HttpUtil::AssembleRawHeaders(fake_response_headers.data(),
                                    fake_response_headers.length());
  response->headers = new HttpResponseHeaders(raw_headers);

  return true;
}

Vulnerability Type: 
CWE ID: CWE-19
Summary: net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Commit Message: Sanitize headers in Proxy Authentication Required responses

BUG=431504

Review URL: https://codereview.chromium.org/769043003

Cr-Commit-Position: refs/heads/master@{#310014}