tree affd69c3f2f0debf556ddae2d5204454297b1af3
parent 8772ecae5b9d7afa517a4fb08d24bee6213c4175
author Yao Xiao <yaoxia@chromium.org> 1685205169 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1685206641 -0700

[Topics] pad topics header to make it harder to expose information via its length

What:
Switch to a different header format to allow padding.
Example: "t=(1;v=chrome.1:1:2), p=P00000000000"

The total length of the inner topics list plus the padding depends on the number of distinct version in the underlying epochs:
- If it's 0 or 1, use 27
  ("100;v=chrome.1:1:10 200 300")
- If it's 2, use 43
  ("100;v=chrome.1:1:10 200;v=chrome.1:1:20 300")
- If it's 3, use 59
  ("100;v=chrome.1:1:10 200;v=chrome.1:1:20 300;v=chrome.1:1:30")

This assumes maximum 3 digit topic ID, 2 digit model version,
and 1 digit config version and taxonomy version.

Why: Servers typically have a GET request size limit e.g. 8KB, and
will return an error when the limit is reached. An attacker can rely
this to learn the number of topics for a different origin.

Bug: 1443540
Change-Id: Ieadad5730870457ae219f4db30b072f829771ac4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4553756
Commit-Queue: Yao Xiao <yaoxia@chromium.org>
Reviewed-by: Josh Karlin <jkarlin@chromium.org>
Reviewed-by: Dominic Farolino <dom@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1150078}