From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Date: Sun, 3 Mar 2024 09:03:16 +0000 (+0000)
Subject: hsts: match header names case insensitively
X-Git-Tag: archive/raspbian/5.15.13+dfsg-2+rpi1~1^2^2~25
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=adfd5f4059a1234ec5eb55d8a0246b3923d073ab;p=qtbase-opensource-src.git

hsts: match header names case insensitively

Origin: upstream, https://download.qt.io/official_releases/qt/5.15/CVE-2023-32762-qtbase-5.15.diff
Last-Update: 2023-05-22

Header field names are always considered to be case-insensitive.

Gbp-Pq: Name CVE-2023-32762.diff
---

diff --git a/src/network/access/qhsts.cpp b/src/network/access/qhsts.cpp
index 0cef0ad3d..be7ef7ff5 100644
--- a/src/network/access/qhsts.cpp
+++ b/src/network/access/qhsts.cpp
@@ -364,8 +364,8 @@ quoted-pair    = "\" CHAR
 bool QHstsHeaderParser::parse(const QList<QPair<QByteArray, QByteArray>> &headers)
 {
     for (const auto &h : headers) {
-        // We use '==' since header name was already 'trimmed' for us:
-        if (h.first == "Strict-Transport-Security") {
+        // We compare directly because header name was already 'trimmed' for us:
+        if (h.first.compare("Strict-Transport-Security", Qt::CaseInsensitive) == 0) {
             header = h.second;
             // RFC6797, 8.1:
             //