Do not handle responses without HttpResponseHeaders as signed exchange.

Bug: 935050
Change-Id: Ibca81508ba52743695d170281ff06670f83923e4
Reviewed-on: https://chromium-review.googlesource.com/c/1493338Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#636331}

content/browser/web_package/signed_exchange_request_handler_browsertest.cc

@@ -455,6 +455,27 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeRequestHandlerDownloadBrowserTest,
             observer->observed_content_disposition());
 }
 
+IN_PROC_BROWSER_TEST_F(SignedExchangeRequestHandlerDownloadBrowserTest,
+                       DataURLDownload) {
+  const GURL sxg_url = GURL("data:application/signed-exchange,");
+  std::unique_ptr<DownloadObserver> observer =
+      std::make_unique<DownloadObserver>(BrowserContext::GetDownloadManager(
+          shell()->web_contents()->GetBrowserContext()));
+
+  embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html"));
+
+  const std::string load_sxg = base::StringPrintf(
+      "const iframe = document.createElement('iframe');"
+      "iframe.src = '%s';"
+      "document.body.appendChild(iframe);",
+      sxg_url.spec().c_str());
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(), load_sxg));
+  observer->WaitUntilDownloadCreated();
+  EXPECT_EQ(sxg_url, observer->observed_url());
+}
+
 class SignedExchangeRequestHandlerRealCertVerifierBrowserTest
     : public SignedExchangeRequestHandlerBrowserTestBase {
  public:

content/browser/web_package/signed_exchange_utils.cc

@@ -58,6 +58,10 @@ bool ShouldHandleAsSignedHTTPExchange(
     return false;
   if (!SignedExchangeRequestHandler::IsSupportedMimeType(head.mime_type))
     return false;
+  // Do not handle responses without HttpResponseHeaders.
+  // (Example: data:application/signed-exchange,)
+  if (!head.headers.get())
+    return false;
   if (download_utils::MustDownload(request_url, head.headers.get(),
                                    head.mime_type)) {
     return false;