QNetwork[http]: Discard or ignore corrupted cache entries

In an attempt to avoid situations like the linked bug-report from
happening again, discard cached entries with no headers and ignore
entries where the payload is smaller than what the header specified (if
it specified anything).

In a future revision we might want to add a length to the cache's
metadata, potentially with a checksum trailing the content.

Task-number: QTBUG-111397
Change-Id: Ie40149ffdaff7886bcd44cbd45605bdb7918e105
Reviewed-by: Konrad Kujawa <konrad.kujawa@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
(cherry picked from commit a6776de0c70d23ac197682c7bef603450cb8b03f)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

2 files changed, 7 insertions, 1 deletions

diff --git a/src/network/access/qnetworkdiskcache.cpp b/src/network/access/qnetworkdiskcache.cpp
index cf6f0a9b14..2fcbd393dc 100644
--- a/src/network/access/qnetworkdiskcache.cpp
+++ b/src/network/access/qnetworkdiskcache.cpp
@@ -670,7 +670,7 @@ bool QCacheItem::read(QFileDevice *device, bool readData)
     if (!device->fileName().endsWith(expectedFilename))
         return false;
 
-    return metaData.isValid();
+    return metaData.isValid() && !metaData.rawHeaders().isEmpty();
 }
 
 QT_END_NAMESPACE
diff --git a/src/network/access/qnetworkreplyhttpimpl.cpp b/src/network/access/qnetworkreplyhttpimpl.cpp
index 58e768583d..0e9b03a836 100644
--- a/src/network/access/qnetworkreplyhttpimpl.cpp
+++ b/src/network/access/qnetworkreplyhttpimpl.cpp
@@ -499,6 +499,12 @@ bool QNetworkReplyHttpImplPrivate::loadFromCacheIfAllowed(QHttpNetworkRequest &h
     QNetworkHeadersPrivate::RawHeadersList::ConstIterator it;
     cacheHeaders.setAllRawHeaders(metaData.rawHeaders());
 
+    it = cacheHeaders.findRawHeader("content-length");
+    if (it != cacheHeaders.rawHeaders.constEnd()) {
+        if (nc->data(httpRequest.url())->size() < it->second.toLongLong())
+            return false; // The data is smaller than the content-length specified
+    }
+
     it = cacheHeaders.findRawHeader("etag");
     if (it != cacheHeaders.rawHeaders.constEnd())
         httpRequest.setHeaderField("If-None-Match", it->second);