Attachment 342330 Details for Bug 186441 – WIP Patch

[patch] WIP Patch

186441_wip.patch (text/plain), 1.97 KB, created by Chris Dumez on 2018-06-08 14:24:35 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2018-06-08 14:24:35 PDT

Size: 1.97 KB

patch

obsolete

>diff --git a/LayoutTests/http/tests/security/cors-post-redirect-307-pson-expected.txt b/LayoutTests/http/tests/security/cors-post-redirect-307-pson-expected.txt
>new file mode 100644
>index 00000000000..5ac1a76c4ce
>--- /dev/null
>+++ b/LayoutTests/http/tests/security/cors-post-redirect-307-pson-expected.txt
>@@ -0,0 +1 @@
>+There was no origin header
>diff --git a/LayoutTests/http/tests/security/cors-post-redirect-307-pson.html b/LayoutTests/http/tests/security/cors-post-redirect-307-pson.html
>new file mode 100644
>index 00000000000..133ff75c5a4
>--- /dev/null
>+++ b/LayoutTests/http/tests/security/cors-post-redirect-307-pson.html
>@@ -0,0 +1,25 @@
>+<!DOCTYPE html>
>+<head>
>+<script>
>+if (window.testRunner) {
>+    testRunner.waitUntilDone();
>+    testRunner.dumpAsText();
>+}
>+</script>
>+</head>
>+<body>
>+
>+This test is designed to work only when loaded from http://127.0.0.1:8000
>+
>+<form id='testForm' method='POST'>
>+<input id='redircode' type='hidden' name='redircode' value='307'>
>+</form>
>+
>+<script>
>+
>+var form = document.getElementById('testForm');
>+form.action = "/resources/redirect.php?code=307&url=http://localhost:8000/security/resources/cors-post-redirect-target.php";
>+form.submit();
>+ 
>+</script>
>+</body>
>diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
>index 3fb4f280fa0..f3dc4ebd76e 100644
>--- a/Source/WebCore/loader/FrameLoader.cpp
>+++ b/Source/WebCore/loader/FrameLoader.cpp
>@@ -2832,13 +2832,6 @@ void FrameLoader::addHTTPOriginIfNeeded(ResourceRequest& request, const String&
>     // For non-GET and non-HEAD methods, always send an Origin header so the
>     // server knows we support this feature.
> 
>-    if (origin.isEmpty()) {
>-        // If we don't know what origin header to attach, we attach the value
>-        // for an empty origin.
>-        request.setHTTPOrigin(SecurityOrigin::createUnique()->toString());
>-        return;
>-    }
>-
>     request.setHTTPOrigin(origin);
> }
>

Actions: View | Formatted Diff | Diff

Attachments on bug 186441: 342325 | 342330 | 342332 | 342454 | 342461