241003 2022-05-26 23:13:06 -0700 HSTS synthesized redirect responses should not be blocked by CORS 2022-06-23 13:24:23 -0700 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 achristensen achristensen cdumez webkit-bug-importer youennf oldest_to_newest 1872275 0 achristensen 2022-05-26 23:13:06 -0700 ... 1872277 1 459803 achristensen 2022-05-26 23:17:58 -0700 Created attachment 459803 Patch 1873717 2 459975 achristensen 2022-06-02 16:09:14 -0700 Created attachment 459975 Patch 1873819 3 webkit-bug-importer 2022-06-02 23:14:15 -0700 <rdar://problem/94331699> 1873832 4 459975 youennf 2022-06-02 23:52:09 -0700 Comment on attachment 459975 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=459975&action=review > Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:640 > + NSString *origin = [request valueForHTTPHeaderField:@"Origin"] ?: @"*"; If there is no origin header, we probably do not need to add AccessControlAllowOrigin header. Adding it with '*' does not harm though. > Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:642 > + networkDataTask->willPerformHTTPRedirection(WTFMove(synthesizedResponse), request, [completionHandler = makeBlockPtr(completionHandler), taskIdentifier, shouldIgnoreHSTS](auto&& request) { Seems fine for now. There are corner cases that will not work (CORS preflight for instance) In the future, we could add a dedicated HSTS upgrade signal and let NetworkResourceLoader/NetworkLoadChecker deal with the full case. 1874021 5 ews-feeder 2022-06-03 14:04:03 -0700 Committed r295230 (251284@main): <https://commits.webkit.org/251284@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 459975. 1877791 6 ap 2022-06-23 13:24:23 -0700 This landed as 251285@main, NOT 251284@main. 459803 2022-05-26 23:17:58 -0700 2022-06-02 16:09:12 -0700 Patch bug-241003-20220526231757.patch text/plain 3359 achristensen RnJvbSBjNTgzOTk0M2IyMDU4MGZkNjMyZTRiMzM1MjMzNzkzYzFkZTQwMDdiIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBbGV4IENocmlzdGVuc2VuIDxhY2hyaXN0ZW5zZW5AYXBwbGUu Y29tPgpEYXRlOiBUaHUsIDI2IE1heSAyMDIyIDIzOjEzOjI4IC0wNzAwClN1YmplY3Q6IFtQQVRD SF0gSFNUUyBzeW50aGVzaXplZCByZWRpcmVjdCByZXNwb25zZXMgc2hvdWxkIG5vdCBiZSBibG9j a2VkIGJ5CiBDT1JTIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yNDEw MDMKClJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgoKSWYgYSBjcm9zcy1vcmlnaW4gcmVxdWVz dCBpcyBtYWRlIHRvIGFuIGh0dHAgVVJMIHRoYXQgd291bGQgYmUgdXBncmFkZWQgdG8gYW4gaHR0 cHMgVVJMCmJlY2F1c2Ugb2YgSFNUUywgd2Ugc3ludGhlc2l6ZSBhICJyZXNwb25zZSIgdG8gY2Fs bCB3aWxsUGVyZm9ybUhUVFBSZWRpcmVjdGlvbiB3aXRoLgpVbmZvcnR1bmF0ZWx5LCB0aGlzIHJl c3BvbnNlIGNhbiBmYWlsIENPUlMgY2hlY2tzIGNhdXNpbmcgdGhlIHJlcXVlc3QgdG8gYmUgdW5u ZWNlc3NhcmlseSBibG9ja2VkLgpUbyBwcmV2ZW50IHRoaXMsIGp1c3QgYWRkIENPUlMgaGVhZGVy cyB0byB0aGUgc3ludGhlc2l6ZWQgcmVzcG9uc2VzIGZvciBIU1RTLgoKKiBTb3VyY2UvV2ViS2l0 L05ldHdvcmtQcm9jZXNzL2NvY29hL05ldHdvcmtTZXNzaW9uQ29jb2EubW06CigtW1dLTmV0d29y a1Nlc3Npb25EZWxlZ2F0ZSBVUkxTZXNzaW9uOnRhc2s6X3NjaGVtZVVwZ3JhZGVkOmNvbXBsZXRp b25IYW5kbGVyOl0pOgoqIFRvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Q29jb2EvSFNU Uy5tbToKKFRlc3RXZWJLaXRBUEk6OlRFU1QpOgotLS0KIFNvdXJjZS9XZWJLaXQvTmV0d29ya1By b2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Npb25Db2NvYS5tbSB8IDQgKysrLQogVG9vbHMvVGVzdFdl YktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9IU1RTLm1tICAgICAgICAgICAgIHwgNiArKy0tLS0K IDIgZmlsZXMgY2hhbmdlZCwgNSBpbnNlcnRpb25zKCspLCA1IGRlbGV0aW9ucygtKQoKZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Npb25D b2NvYS5tbSBiL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Np b25Db2NvYS5tbQppbmRleCBmMzY1NGRiMmRmZjkuLmUwNWMwMDEzZjE3ZiAxMDA2NDQKLS0tIGEv U291cmNlL1dlYktpdC9OZXR3b3JrUHJvY2Vzcy9jb2NvYS9OZXR3b3JrU2Vzc2lvbkNvY29hLm1t CisrKyBiL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Npb25D b2NvYS5tbQpAQCAtNjM2LDcgKzYzNiw5IEBAIC0gKHZvaWQpVVJMU2Vzc2lvbjooTlNVUkxTZXNz aW9uICopc2Vzc2lvbiB0YXNrOihOU1VSTFNlc3Npb25UYXNrKil0YXNrIF9zY2hlbWVVCiAgICAg ICAgICAgICBBU1NFUlRfTk9UX1JFQUNIRUQoKTsKICNlbmRpZgogCi0gICAgICAgIG5ldHdvcmtE YXRhVGFzay0+d2lsbFBlcmZvcm1IVFRQUmVkaXJlY3Rpb24oV2ViQ29yZTo6c3ludGhlc2l6ZVJl ZGlyZWN0UmVzcG9uc2VJZk5lY2Vzc2FyeShbdGFzayBjdXJyZW50UmVxdWVzdF0sIHJlcXVlc3Qs IG5pbCksIHJlcXVlc3QsIFtjb21wbGV0aW9uSGFuZGxlciA9IG1ha2VCbG9ja1B0cihjb21wbGV0 aW9uSGFuZGxlciksIHRhc2tJZGVudGlmaWVyLCBzaG91bGRJZ25vcmVIU1RTXShhdXRvJiYgcmVx dWVzdCkgeworICAgICAgICBXZWJDb3JlOjpSZXNvdXJjZVJlc3BvbnNlIHN5bnRoZXNpemVkUmVz cG9uc2UgPSBXZWJDb3JlOjpzeW50aGVzaXplUmVkaXJlY3RSZXNwb25zZUlmTmVjZXNzYXJ5KFt0 YXNrIGN1cnJlbnRSZXF1ZXN0XSwgcmVxdWVzdCwgbmlsKTsKKyAgICAgICAgc3ludGhlc2l6ZWRS ZXNwb25zZS5zZXRIVFRQSGVhZGVyRmllbGQoV2ViQ29yZTo6SFRUUEhlYWRlck5hbWU6OkFjY2Vz c0NvbnRyb2xBbGxvd09yaWdpbiwgIioiX3MpOworICAgICAgICBuZXR3b3JrRGF0YVRhc2stPndp bGxQZXJmb3JtSFRUUFJlZGlyZWN0aW9uKFdURk1vdmUoc3ludGhlc2l6ZWRSZXNwb25zZSksIHJl cXVlc3QsIFtjb21wbGV0aW9uSGFuZGxlciA9IG1ha2VCbG9ja1B0cihjb21wbGV0aW9uSGFuZGxl ciksIHRhc2tJZGVudGlmaWVyLCBzaG91bGRJZ25vcmVIU1RTXShhdXRvJiYgcmVxdWVzdCkgewog I2lmICFMT0dfRElTQUJMRUQKICAgICAgICAgICAgIExPRyhOZXR3b3JrU2Vzc2lvbiwgIiVsbHUg X3NjaGVtZVVwZ3JhZGVkIGNvbXBsZXRpb25IYW5kbGVyICglcykiLCB0YXNrSWRlbnRpZmllciwg cmVxdWVzdC51cmwoKS5zdHJpbmcoKS51dGY4KCkuZGF0YSgpKTsKICNlbHNlCmRpZmYgLS1naXQg YS9Ub29scy9UZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdENvY29hL0hTVFMubW0gYi9Ub29scy9U ZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdENvY29hL0hTVFMubW0KaW5kZXggZDI4ZTg3ZmExMDBj Li4zOTc1NjMyNzI1ZmQgMTAwNjQ0Ci0tLSBhL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2Vi S2l0Q29jb2EvSFNUUy5tbQorKysgYi9Ub29scy9UZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdENv Y29hL0hTVFMubW0KQEAgLTExNCwxMCArMTE0LDggQEAgVEVTVChIU1RTLCBUaGlyZFBhcnR5KQog ICAgIEVYUEVDVF9XS19TVFJFUSh3ZWJWaWV3LmdldCgpLlVSTC5hYnNvbHV0ZVN0cmluZywgImh0 dHBzOi8vZXhhbXBsZS5jb20vIik7CiAKICAgICBbd2ViVmlldyBsb2FkUmVxdWVzdDpbTlNVUkxS ZXF1ZXN0IHJlcXVlc3RXaXRoVVJMOltOU1VSTCBVUkxXaXRoU3RyaW5nOkAiaHR0cDovL2V4YW1w bGUub3JnLyJdXV07Ci0gICAgLy8gRklYTUU6IFRoaXMgc2hvdWxkIGJlICJodHRwOi8vZXhhbXBs ZS5jb20vIGhpIiBidXQgdGhlIHJlc3BvbnNlIGdlbmVyYXRlZCBpbiBfc2NoZW1lVXBncmFkZWQg aXMgZmFpbGluZyBhIENPUlMgY2hlY2suCi0gICAgLy8gVGhpcyBzaG91bGQgYmUgZml4ZWQgdG8g ZGlzYWJsZSBDT1JTIGNoZWNrcyBmb3IgSFNUUyAicmVkaXJlY3RzIgotICAgIEVYUEVDVF9XS19T VFJFUShbd2ViVmlldyBfdGVzdF93YWl0Rm9yQWxlcnRdLCAiICIpOwotICAgIEVYUEVDVF9FUSho dHRwU2VydmVyLnRvdGFsUmVxdWVzdHMoKSwgMXUpOworICAgIEVYUEVDVF9XS19TVFJFUShbd2Vi VmlldyBfdGVzdF93YWl0Rm9yQWxlcnRdLCAiaHR0cDovL2V4YW1wbGUuY29tLyBoaSIpOworICAg IEVYUEVDVF9FUShodHRwU2VydmVyLnRvdGFsUmVxdWVzdHMoKSwgMnUpOwogfQogCiBURVNUKEhT VFMsIENyb3NzT3JpZ2luUmVkaXJlY3QpCi0tIAoyLjMyLjAgKEFwcGxlIEdpdC0xMzIpCgo= 459975 2022-06-02 16:09:14 -0700 2022-06-03 14:04:04 -0700 Patch bug-241003-20220602160913.patch text/plain 3442 achristensen RnJvbSAxZGFkZDdjMGI4NGFhMzFjNWQzMzZiYTVjMThmNzI2YmZjNThjZTAwIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBbGV4IENocmlzdGVuc2VuIDxhY2hyaXN0ZW5zZW5AYXBwbGUu Y29tPgpEYXRlOiBUaHUsIDIgSnVuIDIwMjIgMTY6MDY6MDMgLTA3MDAKU3ViamVjdDogW1BBVENI XSBIU1RTIHN5bnRoZXNpemVkIHJlZGlyZWN0IHJlc3BvbnNlcyBzaG91bGQgbm90IGJlIGJsb2Nr ZWQgYnkKIENPUlMgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTI0MTAw MwoKUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCgpJZiBhIGNyb3NzLW9yaWdpbiByZXF1ZXN0 IGlzIG1hZGUgdG8gYW4gaHR0cCBVUkwgdGhhdCB3b3VsZCBiZSB1cGdyYWRlZCB0byBhbiBodHRw cyBVUkwKYmVjYXVzZSBvZiBIU1RTLCB3ZSBzeW50aGVzaXplIGEgInJlc3BvbnNlIiB0byBjYWxs IHdpbGxQZXJmb3JtSFRUUFJlZGlyZWN0aW9uIHdpdGguClVuZm9ydHVuYXRlbHksIHRoaXMgcmVz cG9uc2UgY2FuIGZhaWwgQ09SUyBjaGVja3MgY2F1c2luZyB0aGUgcmVxdWVzdCB0byBiZSB1bm5l Y2Vzc2FyaWx5IGJsb2NrZWQuClRvIHByZXZlbnQgdGhpcywganVzdCBhZGQgQ09SUyBoZWFkZXJz IHRvIHRoZSBzeW50aGVzaXplZCByZXNwb25zZXMgZm9yIEhTVFMuCgoqIFNvdXJjZS9XZWJLaXQv TmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Npb25Db2NvYS5tbToKKC1bV0tOZXR3b3Jr U2Vzc2lvbkRlbGVnYXRlIFVSTFNlc3Npb246dGFzazpfc2NoZW1lVXBncmFkZWQ6Y29tcGxldGlv bkhhbmRsZXI6XSk6CiogVG9vbHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9IU1RT Lm1tOgooVGVzdFdlYktpdEFQSTo6VEVTVCk6Ci0tLQogU291cmNlL1dlYktpdC9OZXR3b3JrUHJv Y2Vzcy9jb2NvYS9OZXR3b3JrU2Vzc2lvbkNvY29hLm1tIHwgNSArKysrLQogVG9vbHMvVGVzdFdl YktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9IU1RTLm1tICAgICAgICAgICAgIHwgNiArKy0tLS0K IDIgZmlsZXMgY2hhbmdlZCwgNiBpbnNlcnRpb25zKCspLCA1IGRlbGV0aW9ucygtKQoKZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Npb25D b2NvYS5tbSBiL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Np b25Db2NvYS5tbQppbmRleCBmMzY1NGRiMmRmZjkuLjVkMTczNTkwZTE4YiAxMDA2NDQKLS0tIGEv U291cmNlL1dlYktpdC9OZXR3b3JrUHJvY2Vzcy9jb2NvYS9OZXR3b3JrU2Vzc2lvbkNvY29hLm1t CisrKyBiL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvY29jb2EvTmV0d29ya1Nlc3Npb25D b2NvYS5tbQpAQCAtNjM2LDcgKzYzNiwxMCBAQCAtICh2b2lkKVVSTFNlc3Npb246KE5TVVJMU2Vz c2lvbiAqKXNlc3Npb24gdGFzazooTlNVUkxTZXNzaW9uVGFzayopdGFzayBfc2NoZW1lVQogICAg ICAgICAgICAgQVNTRVJUX05PVF9SRUFDSEVEKCk7CiAjZW5kaWYKIAotICAgICAgICBuZXR3b3Jr RGF0YVRhc2stPndpbGxQZXJmb3JtSFRUUFJlZGlyZWN0aW9uKFdlYkNvcmU6OnN5bnRoZXNpemVS ZWRpcmVjdFJlc3BvbnNlSWZOZWNlc3NhcnkoW3Rhc2sgY3VycmVudFJlcXVlc3RdLCByZXF1ZXN0 LCBuaWwpLCByZXF1ZXN0LCBbY29tcGxldGlvbkhhbmRsZXIgPSBtYWtlQmxvY2tQdHIoY29tcGxl dGlvbkhhbmRsZXIpLCB0YXNrSWRlbnRpZmllciwgc2hvdWxkSWdub3JlSFNUU10oYXV0byYmIHJl cXVlc3QpIHsKKyAgICAgICAgV2ViQ29yZTo6UmVzb3VyY2VSZXNwb25zZSBzeW50aGVzaXplZFJl c3BvbnNlID0gV2ViQ29yZTo6c3ludGhlc2l6ZVJlZGlyZWN0UmVzcG9uc2VJZk5lY2Vzc2FyeShb dGFzayBjdXJyZW50UmVxdWVzdF0sIHJlcXVlc3QsIG5pbCk7CisgICAgICAgIE5TU3RyaW5nICpv cmlnaW4gPSBbcmVxdWVzdCB2YWx1ZUZvckhUVFBIZWFkZXJGaWVsZDpAIk9yaWdpbiJdID86IEAi KiI7CisgICAgICAgIHN5bnRoZXNpemVkUmVzcG9uc2Uuc2V0SFRUUEhlYWRlckZpZWxkKFdlYkNv cmU6OkhUVFBIZWFkZXJOYW1lOjpBY2Nlc3NDb250cm9sQWxsb3dPcmlnaW4sIG9yaWdpbik7Cisg ICAgICAgIG5ldHdvcmtEYXRhVGFzay0+d2lsbFBlcmZvcm1IVFRQUmVkaXJlY3Rpb24oV1RGTW92 ZShzeW50aGVzaXplZFJlc3BvbnNlKSwgcmVxdWVzdCwgW2NvbXBsZXRpb25IYW5kbGVyID0gbWFr ZUJsb2NrUHRyKGNvbXBsZXRpb25IYW5kbGVyKSwgdGFza0lkZW50aWZpZXIsIHNob3VsZElnbm9y ZUhTVFNdKGF1dG8mJiByZXF1ZXN0KSB7CiAjaWYgIUxPR19ESVNBQkxFRAogICAgICAgICAgICAg TE9HKE5ldHdvcmtTZXNzaW9uLCAiJWxsdSBfc2NoZW1lVXBncmFkZWQgY29tcGxldGlvbkhhbmRs ZXIgKCVzKSIsIHRhc2tJZGVudGlmaWVyLCByZXF1ZXN0LnVybCgpLnN0cmluZygpLnV0ZjgoKS5k YXRhKCkpOwogI2Vsc2UKZGlmZiAtLWdpdCBhL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2Vi S2l0Q29jb2EvSFNUUy5tbSBiL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Q29jb2Ev SFNUUy5tbQppbmRleCBkMjhlODdmYTEwMGMuLjM5NzU2MzI3MjVmZCAxMDA2NDQKLS0tIGEvVG9v bHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9IU1RTLm1tCisrKyBiL1Rvb2xzL1Rl c3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Q29jb2EvSFNUUy5tbQpAQCAtMTE0LDEwICsxMTQsOCBA QCBURVNUKEhTVFMsIFRoaXJkUGFydHkpCiAgICAgRVhQRUNUX1dLX1NUUkVRKHdlYlZpZXcuZ2V0 KCkuVVJMLmFic29sdXRlU3RyaW5nLCAiaHR0cHM6Ly9leGFtcGxlLmNvbS8iKTsKIAogICAgIFt3 ZWJWaWV3IGxvYWRSZXF1ZXN0OltOU1VSTFJlcXVlc3QgcmVxdWVzdFdpdGhVUkw6W05TVVJMIFVS TFdpdGhTdHJpbmc6QCJodHRwOi8vZXhhbXBsZS5vcmcvIl1dXTsKLSAgICAvLyBGSVhNRTogVGhp cyBzaG91bGQgYmUgImh0dHA6Ly9leGFtcGxlLmNvbS8gaGkiIGJ1dCB0aGUgcmVzcG9uc2UgZ2Vu ZXJhdGVkIGluIF9zY2hlbWVVcGdyYWRlZCBpcyBmYWlsaW5nIGEgQ09SUyBjaGVjay4KLSAgICAv LyBUaGlzIHNob3VsZCBiZSBmaXhlZCB0byBkaXNhYmxlIENPUlMgY2hlY2tzIGZvciBIU1RTICJy ZWRpcmVjdHMiCi0gICAgRVhQRUNUX1dLX1NUUkVRKFt3ZWJWaWV3IF90ZXN0X3dhaXRGb3JBbGVy dF0sICIgIik7Ci0gICAgRVhQRUNUX0VRKGh0dHBTZXJ2ZXIudG90YWxSZXF1ZXN0cygpLCAxdSk7 CisgICAgRVhQRUNUX1dLX1NUUkVRKFt3ZWJWaWV3IF90ZXN0X3dhaXRGb3JBbGVydF0sICJodHRw Oi8vZXhhbXBsZS5jb20vIGhpIik7CisgICAgRVhQRUNUX0VRKGh0dHBTZXJ2ZXIudG90YWxSZXF1 ZXN0cygpLCAydSk7CiB9CiAKIFRFU1QoSFNUUywgQ3Jvc3NPcmlnaW5SZWRpcmVjdCkKLS0gCjIu MzIuMCAoQXBwbGUgR2l0LTEzMikKCg==