[hackerone] Request-OTR and debounce services use improper comparator for host cache

[pilgrim-brave]

Despite both being canonicalized by GURL, the string hosts that end up in host_cache_ can still be not-quite-equal to the actual host. Need to either further canonicalize hosts before comparing, or use a comparator function like url::DomainIs.

This affects any service that maintains its own host cache, which currently includes Request-OTR and debounce services.

credit: https://hackerone.com/reports/2107964 by nishimunea

[LaurenWags]

@pes10k @pilgrim-brave could we get a test plan for this and let us know if it needs to be checked on all OSes? If it doesn't need manual QA can change the label to QA/No.

[pes10k]

labeled QA/No, thanks @LaurenWags !

[LaurenWags]

sounds good, thanks @pes10k. Just confirming, is the release-notes/include label still accurate?

[pes10k]

sure, though i think it'd be fine to just say

• bug fixes in determining which origins and URLs triggered debouncing and request-OTR protections