Attachment 103070 Details for Bug 65694 – patch 3

[patch] patch 3

prevent_preflight_3.patch (text/plain), 7.82 KB, created by Per-Erik Brodin on 2011-08-05 07:20:17 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Per-Erik Brodin

Created: 2011-08-05 07:20:17 PDT

Size: 7.82 KB

patch

obsolete

>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 848a822..1ba4c2c 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,24 @@
>+2011-08-05  Per-Erik Brodin  <per-erik.brodin@ericsson.com>
>+
>+        Make it possible to explicitly prevent a preflight via ThreadableLoaderOptions
>+        https://bugs.webkit.org/show_bug.cgi?id=65694
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        No new tests since there is no change in behavior.
>+
>+        * fileapi/FileReaderLoader.cpp:
>+        (WebCore::FileReaderLoader::start):
>+        * loader/DocumentThreadableLoader.cpp:
>+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
>+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
>+        * loader/ThreadableLoader.h:
>+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions):
>+        * notifications/Notification.cpp:
>+        (WebCore::Notification::startLoading):
>+        * xml/XMLHttpRequest.cpp:
>+        (WebCore::XMLHttpRequest::createRequest):
>+
> 2011-08-05  Yury Semikhatsky  <yurys@chromium.org>
> 
>         Web Inspector: constrain maximum depth for returnByValue objects
>diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
>index 50ea0af..15137e7 100644
>--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
>+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
>@@ -88,7 +88,7 @@ void FileReaderLoader::start(ScriptExecutionContext* scriptExecutionContext, Blo
>     ThreadableLoaderOptions options;
>     options.sendLoadCallbacks = true;
>     options.sniffContent = false;
>-    options.forcePreflight = false;
>+    options.preflightPolicy = ConsiderPreflight;
>     options.allowCredentials = true;
>     options.crossOriginRequestPolicy = DenyCrossOriginRequests;
> 
>diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
>index 4656d2c..a0ac1e5 100644
>--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
>+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
>@@ -98,7 +98,7 @@ DocumentThreadableLoader::DocumentThreadableLoader(Document* document, Threadabl
>     OwnPtr<ResourceRequest> crossOriginRequest = adoptPtr(new ResourceRequest(request));
>     updateRequestForAccessControl(*crossOriginRequest, securityOrigin(), m_options.allowCredentials);
> 
>-    if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(crossOriginRequest->httpMethod(), crossOriginRequest->httpHeaderFields()))
>+    if ((m_options.preflightPolicy == ConsiderPreflight && isSimpleCrossOriginAccessRequest(crossOriginRequest->httpMethod(), crossOriginRequest->httpHeaderFields())) || m_options.preflightPolicy == PreventPreflight)
>         makeSimpleCrossOriginAccessRequest(*crossOriginRequest);
>     else {
>         m_actualRequest = crossOriginRequest.release();
>@@ -112,7 +112,8 @@ DocumentThreadableLoader::DocumentThreadableLoader(Document* document, Threadabl
> 
> void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const ResourceRequest& request)
> {
>-    ASSERT(isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()));
>+    ASSERT(m_options.preflightPolicy != ForcePreflight);
>+    ASSERT(m_options.preflightPolicy == PreventPreflight || isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()));
> 
>     // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
>     // FIXME: Consider allowing simple CORS requests to non-HTTP URLs.
>diff --git a/Source/WebCore/loader/ThreadableLoader.h b/Source/WebCore/loader/ThreadableLoader.h
>index c02b4a5..430a60b 100644
>--- a/Source/WebCore/loader/ThreadableLoader.h
>+++ b/Source/WebCore/loader/ThreadableLoader.h
>@@ -55,13 +55,19 @@ namespace WebCore {
>         UseAccessControl,
>         AllowCrossOriginRequests
>     };
>-    
>+
>+    enum PreflightPolicy {
>+        ConsiderPreflight,
>+        ForcePreflight,
>+        PreventPreflight
>+    };
>+
>     struct ThreadableLoaderOptions {
>-        ThreadableLoaderOptions() : sendLoadCallbacks(false), sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(DenyCrossOriginRequests), shouldBufferData(true) { }
>+        ThreadableLoaderOptions() : sendLoadCallbacks(false), sniffContent(false), allowCredentials(false), preflightPolicy(ConsiderPreflight), crossOriginRequestPolicy(DenyCrossOriginRequests), shouldBufferData(true) { }
>         bool sendLoadCallbacks;
>         bool sniffContent;
>         bool allowCredentials;  // Whether HTTP credentials and cookies are sent with the request.
>-        bool forcePreflight;  // If AccessControl is used, whether to force a preflight.
>+        PreflightPolicy preflightPolicy; // If AccessControl is used, how to determine if a preflight is needed.
>         CrossOriginRequestPolicy crossOriginRequestPolicy;
>         bool shouldBufferData;
>         RefPtr<SecurityOrigin> securityOrigin;
>diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/notifications/Notification.cpp
>index 308dbb1..68855a0 100644
>--- a/Source/WebCore/notifications/Notification.cpp
>+++ b/Source/WebCore/notifications/Notification.cpp
>@@ -168,7 +168,7 @@ void Notification::startLoading()
>     ThreadableLoaderOptions options;
>     options.sendLoadCallbacks = false;
>     options.sniffContent = false;
>-    options.forcePreflight = false;
>+    options.preflightPolicy = ConsiderPreflight;
>     options.allowCredentials = AllowStoredCredentials;
>     options.crossOriginRequestPolicy = AllowCrossOriginRequests;
>     m_loader = ThreadableLoader::create(scriptExecutionContext(), this, ResourceRequest(iconURL()), options);
>diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
>index 6634167..dcb8ae5 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.cpp
>+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
>@@ -649,7 +649,7 @@ void XMLHttpRequest::createRequest(ExceptionCode& ec)
>     ThreadableLoaderOptions options;
>     options.sendLoadCallbacks = true;
>     options.sniffContent = false;
>-    options.forcePreflight = uploadEvents;
>+    options.preflightPolicy = uploadEvents ? ForcePreflight : ConsiderPreflight;
>     options.allowCredentials = m_sameOriginRequest || m_includeCredentials;
>     options.crossOriginRequestPolicy = UseAccessControl;
>     options.securityOrigin = securityOrigin();
>diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
>index 421c1fe..9c83a48 100644
>--- a/Source/WebKit/chromium/ChangeLog
>+++ b/Source/WebKit/chromium/ChangeLog
>@@ -1,3 +1,13 @@
>+2011-08-05  Per-Erik Brodin  <per-erik.brodin@ericsson.com>
>+
>+        Make it possible to explicitly prevent a preflight via ThreadableLoaderOptions
>+        https://bugs.webkit.org/show_bug.cgi?id=65694
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * src/AssociatedURLLoader.cpp:
>+        (WebKit::AssociatedURLLoader::loadAsynchronously):
>+
> 2011-08-04  James Robinson  <jamesr@chromium.org>
> 
>         Unreviewed.  Rolled DEPS.
>diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
>index 770ec9c..789fe73 100644
>--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
>+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
>@@ -229,7 +229,7 @@ void AssociatedURLLoader::loadAsynchronously(const WebURLRequest& request, WebUR
>     options.sendLoadCallbacks = true; // Always send callbacks.
>     options.sniffContent = m_options.sniffContent;
>     options.allowCredentials = m_options.allowCredentials;
>-    options.forcePreflight = m_options.forcePreflight;
>+    options.preflightPolicy = m_options.forcePreflight ? ForcePreflight : ConsiderPreflight;
>     options.crossOriginRequestPolicy = static_cast<WebCore::CrossOriginRequestPolicy>(m_options.crossOriginRequestPolicy);
>     options.shouldBufferData = false;
>

Actions: View | Formatted Diff | Diff

Attachments on bug 65694: 102933 | 102966 | 103070