Sec-WebSocket-Extensions header field must not appear more than once in an HTTP response.
https://bugs.webkit.org/show_bug.cgi?id=115128

Patch by Lamarque V. Souza <Lamarque.Souza@basyskom.com> on 2013-04-25
Reviewed by Alexey Proskuryakov.

Source/WebCore:

According to WebSocket specification Sec-WebSocket-Extensions header field
must not appear more than once in an HTTP response. It is ok if it appears
more than once in client request. Also add a check for invalid UTF-8
characters when parsing Sec-WebSocket-Extensions quoted string.

Test: http/tests/websocket/tests/hybi/handshake-fail-by-more-extensions-header.html

* Modules/websockets/WebSocketExtensionParser.cpp:
(WebCore::WebSocketExtensionParser::consumeQuotedString): Return false if there is
invalid character in the quoted string being parsed.
* Modules/websockets/WebSocketHandshake.cpp:
(WebCore::WebSocketHandshake::readHTTPHeaders): Check if Sec-WebSocket-Extensions
appears more than once in header response. Abort handshake if it does.

LayoutTests:

* http/tests/websocket/tests/hybi/handshake-fail-by-more-extensions-header-expected.txt: Added.
* http/tests/websocket/tests/hybi/handshake-fail-by-more-extensions-header.html: Added.
* http/tests/websocket/tests/hybi/handshake-fail-by-more-extensions-header_wsh.py: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149120 268f45cc-cd09-0410-ab3c-d52691b4dbfc