36854 2010-03-30 14:42:58 -0700 REGRESSION (r47291): Body from cross origin preflight response is prepended to the actual response body 2010-04-02 12:45:36 -0700 1 1 1 Unclassified WebKit Page Loading 528+ (Nightly build) Mac (Intel) OS X 10.5 RESOLVED FIXED http://jbei-exwebapp.lbl.gov/maschup/webkit_xdr_bug.html InRadar, Regression P1 Normal --- 1 hirenj ap aa ap eric ossy oldest_to_newest 206190 0 hirenj 2010-03-30 14:42:58 -0700 For a pre-flighted request (triggered for example when the X-Requested-With header is set), any data returned by the preflight request is prepended to the actual request data. In the given url, a cross-domain request is triggered to a simple echo resource. The output for this resource is static, and sets the Access control headers to enable cross-origin requests: curl -i 'http://131.243.44.83/maschup/webkit_xdr_bug.pl' HTTP/1.1 200 OK Date: Tue, 30 Mar 2010 21:34:50 GMT Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny8 with Suhosin-Patch Access-control-allow-headers: X-Requested-With Access-control-max-age: 1728000 Access-control-allow-origin: * Access-control-allow-methods: * Vary: Accept-Encoding Content-Length: 4 Content-Type: text/plain echo The output from this echo script is always static, and always returns the Access-Control headers. When a cross-domain request is triggered from within a recent webkit (i.e. nightly webkit, or Chrome), the responseText contains the body from the preflight request as well as the body from the actual request. This can be seen at the page given in the URL (http://jbei-exwebapp.lbl.gov/maschup/webkit_xdr_bug.html). The HTTP specifications don't seem to say what the user-agent should do with the body of the request. Firefox (3.6.2) returns only the body from the actual request, and Safari (4.0.5 (5531.22.7) OS X 10.5) also returns only the body from the actual request. 206329 1 ap 2010-03-30 19:08:27 -0700 <rdar://problem/7811668> 207514 2 52356 ap 2010-04-01 17:06:26 -0700 Created attachment 52356 proposed fix 207528 3 ap 2010-04-01 17:26:56 -0700 Committed <http://trac.webkit.org/changeset/56955>. 207623 4 eric 2010-04-01 20:44:58 -0700 This appears to have broken the Qt bot: http://build.webkit.org/results/Qt%20Linux%20Release/r56955%20(9480)/http/tests/xmlhttprequest/access-control-response-with-body-diffs.txt 207999 5 ap 2010-04-02 12:26:35 -0700 The test has been skipped on Qt: <http://trac.webkit.org/changeset/56998>. 208010 6 eric 2010-04-02 12:45:36 -0700 Thank you very much for the follow-up Alexey. 52356 2010-04-01 17:06:26 -0700 2010-04-01 17:13:26 -0700 proposed fix PreflightBody.txt text/plain 6815 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1Njk1MykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTcgQEAKKzIwMTAtMDQtMDEgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBs ZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM2ODU0CisgICAgICAgIDxy ZGFyOi8vcHJvYmxlbS83ODExNjY4PiBSRUdSRVNTSU9OIChyNDcyOTEpOiBCb2R5IGZyb20gY3Jv c3Mgb3JpZ2luIHByZWZsaWdodCByZXNwb25zZQorICAgICAgICBpcyBwcmVwZW5kZWQgdG8gdGhl IGFjdHVhbCByZXNwb25zZSBib2R5CisKKyAgICAgICAgVGVzdHM6IGh0dHAvdGVzdHMveG1saHR0 cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtcmVzcG9uc2Utd2l0aC1ib2R5LXN5bmMuaHRtbAorICAg ICAgICAgICAgICAgaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9hY2Nlc3MtY29udHJvbC1yZXNw b25zZS13aXRoLWJvZHkuaHRtbAorCisgICAgICAgICogbG9hZGVyL0RvY3VtZW50VGhyZWFkYWJs ZUxvYWRlci5jcHA6IChXZWJDb3JlOjpEb2N1bWVudFRocmVhZGFibGVMb2FkZXI6OmRpZFJlY2Vp dmVEYXRhKToKKyAgICAgICAgRG9uJ3Qgc2VuZCBkYXRhIHRvIHRoZSBjbGllbnQgd2hlbiBoYW5k bGluZyBhIHByZWZsaWdodCByZXF1ZXN0LgorCiAyMDEwLTA0LTAxICBTaW1vbiBGcmFzZXIgIDxz aW1vbi5mcmFzZXJAYXBwbGUuY29tPgogCiAgICAgICAgIE5vIHJldmlldy4KSW5kZXg6IFdlYkNv cmUvbG9hZGVyL0RvY3VtZW50VGhyZWFkYWJsZUxvYWRlci5jcHAKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2Vi Q29yZS9sb2FkZXIvRG9jdW1lbnRUaHJlYWRhYmxlTG9hZGVyLmNwcAkocmV2aXNpb24gNTY5MjQp CisrKyBXZWJDb3JlL2xvYWRlci9Eb2N1bWVudFRocmVhZGFibGVMb2FkZXIuY3BwCSh3b3JraW5n IGNvcHkpCkBAIC0yMTcsNiArMjE3LDEwIEBAIHZvaWQgRG9jdW1lbnRUaHJlYWRhYmxlTG9hZGVy OjpkaWRSZWNlaXYKICAgICBBU1NFUlQobV9jbGllbnQpOwogICAgIEFTU0VSVF9VTlVTRUQobG9h ZGVyLCBsb2FkZXIgPT0gbV9sb2FkZXIpOwogCisgICAgLy8gSWdub3JlIHJlc3BvbnNlIGJvZHkg b2YgcHJlZmxpZ2h0IHJlcXVlc3RzLgorICAgIGlmIChtX2FjdHVhbFJlcXVlc3QpCisgICAgICAg IHJldHVybjsKKwogICAgIG1fY2xpZW50LT5kaWRSZWNlaXZlRGF0YShkYXRhLCBsZW5ndGhSZWNl aXZlZCk7CiB9CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDU2OTUzKQorKysgTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTAtMDQtMDEgIEFsZXhl eSBQcm9za3VyeWFrb3YgIDxhcEBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTM2ODU0CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS83ODExNjY4PiBSRUdSRVNTSU9O IChyNDcyOTEpOiBCb2R5IGZyb20gY3Jvc3Mgb3JpZ2luIHByZWZsaWdodCByZXNwb25zZQorICAg ICAgICBpcyBwcmVwZW5kZWQgdG8gdGhlIGFjdHVhbCByZXNwb25zZSBib2R5CisKKyAgICAgICAg KiBodHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L2FjY2Vzcy1jb250cm9sLXJlc3BvbnNlLXdpdGgt Ym9keS1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMveG1saHR0cHJl cXVlc3QvYWNjZXNzLWNvbnRyb2wtcmVzcG9uc2Utd2l0aC1ib2R5LXN5bmMtZXhwZWN0ZWQudHh0 OiBBZGRlZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L2FjY2Vzcy1jb250 cm9sLXJlc3BvbnNlLXdpdGgtYm9keS1zeW5jLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGh0dHAv dGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtcmVzcG9uc2Utd2l0aC1ib2R5Lmh0 bWw6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvcmVzb3VyY2Vz L2FjY2Vzcy1jb250cm9sLWFsbG93LXdpdGgtYm9keS5waHA6IEFkZGVkLgorCiAyMDEwLTA0LTAx ICBTaW1vbiBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmll d2VkIGJ5IERhcmluIEFkbGVyLgpJbmRleDogTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRw cmVxdWVzdC9hY2Nlc3MtY29udHJvbC1yZXNwb25zZS13aXRoLWJvZHktZXhwZWN0ZWQudHh0Cj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNz LWNvbnRyb2wtcmVzcG9uc2Utd2l0aC1ib2R5LWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysr IExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtcmVz cG9uc2Utd2l0aC1ib2R5LWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwzIEBA CitUZXN0IGZvciBidWcgMzY4NTQ6IEJvZHkgZnJvbSBjcm9zcyBvcmlnaW4gcHJlZmxpZ2h0IHJl c3BvbnNlIGlzIHByZXBlbmRlZCB0byB0aGUgYWN0dWFsIHJlc3BvbnNlIGJvZHkuCisKK1BBU1MK SW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRy b2wtcmVzcG9uc2Utd2l0aC1ib2R5LXN5bmMtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExh eW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtcmVzcG9u c2Utd2l0aC1ib2R5LXN5bmMtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVz dHMvaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9hY2Nlc3MtY29udHJvbC1yZXNwb25zZS13aXRo LWJvZHktc3luYy1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMyBAQAorVGVz dCBmb3IgYnVnIDM2ODU0OiBCb2R5IGZyb20gY3Jvc3Mgb3JpZ2luIHByZWZsaWdodCByZXNwb25z ZSBpcyBwcmVwZW5kZWQgdG8gdGhlIGFjdHVhbCByZXNwb25zZSBib2R5LgorCitQQVNTCkluZGV4 OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L2FjY2Vzcy1jb250cm9sLXJl c3BvbnNlLXdpdGgtYm9keS1zeW5jLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0 cC90ZXN0cy94bWxodHRwcmVxdWVzdC9hY2Nlc3MtY29udHJvbC1yZXNwb25zZS13aXRoLWJvZHkt c3luYy5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRw cmVxdWVzdC9hY2Nlc3MtY29udHJvbC1yZXNwb25zZS13aXRoLWJvZHktc3luYy5odG1sCShyZXZp c2lvbiAwKQpAQCAtMCwwICsxLDI0IEBACis8aHRtbD4KKzxib2R5PgorPHA+VGVzdCBmb3IgPGEg aHJlZj0iaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM2ODU0Ij5idWcg MzY4NTQ8YT46CitCb2R5IGZyb20gY3Jvc3Mgb3JpZ2luIHByZWZsaWdodCByZXNwb25zZSBpcyBw cmVwZW5kZWQgdG8gdGhlIGFjdHVhbCByZXNwb25zZSBib2R5LjwvcD4KKzxkaXYgaWQ9cmVzdWx0 PlJ1bm5pbmcgdGVzdC4uLjwvZGl2PgorPHNjcmlwdD4KKworICBpZiAod2luZG93LmxheW91dFRl c3RDb250cm9sbGVyKQorICAgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKwor ICB3aW5kb3cub25sb2FkID0gZnVuY3Rpb24oKSB7CisgICAgICB2YXIgeGhyID0gbmV3IFhNTEh0 dHBSZXF1ZXN0KCk7CisgICAgICAgeGhyLm9wZW4oIkdFVCIsImh0dHA6Ly9sb2NhbGhvc3Q6ODAw MC94bWxodHRwcmVxdWVzdC9yZXNvdXJjZXMvYWNjZXNzLWNvbnRyb2wtYWxsb3ctd2l0aC1ib2R5 LnBocCIsIGZhbHNlKTsKKyAgICAgICB4aHIuc2V0UmVxdWVzdEhlYWRlcigiQ29udGVudC10eXBl IiwgImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCIpOworICAgICAgIHhoci5zZXRS ZXF1ZXN0SGVhZGVyKCJYLVJlcXVlc3RlZC1XaXRoIiwgIlhNTEh0dHBSZXF1ZXN0Iik7CisgICAg ICAgeGhyLnNlbmQobnVsbCk7CisKKyAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicmVz dWx0IikuaW5uZXJIVE1MID0gKHhoci5yZXNwb25zZVRleHQgPT0gImVjaG8iKSA/ICJQQVNTIiA6 ICgiRkFJTDogIiArIHhoci5yZXNwb25zZVRleHQpOworICB9OworICAKKzwvc2NyaXB0PgorCis8 L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1 ZXN0L2FjY2Vzcy1jb250cm9sLXJlc3BvbnNlLXdpdGgtYm9keS5odG1sCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYWNjZXNzLWNvbnRyb2wtcmVz cG9uc2Utd2l0aC1ib2R5Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3htbGh0dHByZXF1ZXN0L2FjY2Vzcy1jb250cm9sLXJlc3BvbnNlLXdpdGgtYm9keS5odG1s CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMyIEBACis8aHRtbD4KKzxib2R5PgorPHA+VGVzdCBm b3IgPGEgaHJlZj0iaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM2ODU0 Ij5idWcgMzY4NTQ8YT46CitCb2R5IGZyb20gY3Jvc3Mgb3JpZ2luIHByZWZsaWdodCByZXNwb25z ZSBpcyBwcmVwZW5kZWQgdG8gdGhlIGFjdHVhbCByZXNwb25zZSBib2R5LjwvcD4KKzxkaXYgaWQ9 cmVzdWx0PlJ1bm5pbmcgdGVzdC4uLjwvZGl2PgorPHNjcmlwdD4KKworICBpZiAod2luZG93Lmxh eW91dFRlc3RDb250cm9sbGVyKSB7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4 dCgpOworICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRVbnRpbERvbmUoKTsKKyAgfQorCisg IHdpbmRvdy5vbmxvYWQgPSBmdW5jdGlvbigpIHsKKyAgICAgIHZhciB4aHIgPSBuZXcgWE1MSHR0 cFJlcXVlc3QoKTsKKyAgICAgIHhoci5vbnJlYWR5c3RhdGVjaGFuZ2U9ZnVuY3Rpb24oKSB7Cisg ICAgICAgIGlmICh4aHIucmVhZHlTdGF0ZT09NCkgeworICAgICAgICAgIGRvY3VtZW50LmdldEVs ZW1lbnRCeUlkKCJyZXN1bHQiKS5pbm5lckhUTUwgPSAoeGhyLnJlc3BvbnNlVGV4dCA9PSAiZWNo byIpID8gIlBBU1MiIDogKCJGQUlMOiAiICsgeGhyLnJlc3BvbnNlVGV4dCk7CisgICAgICAgICAg aWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICAgICAgICAgIGxheW91dFRlc3RD b250cm9sbGVyLm5vdGlmeURvbmUoKTsKKyAgICAgICAgfQorICAgICAgIH07CisKKyAgICAgICB4 aHIub3BlbigiR0VUIiwiaHR0cDovL2xvY2FsaG9zdDo4MDAwL3htbGh0dHByZXF1ZXN0L3Jlc291 cmNlcy9hY2Nlc3MtY29udHJvbC1hbGxvdy13aXRoLWJvZHkucGhwIik7CisgICAgICAgeGhyLnNl dFJlcXVlc3RIZWFkZXIoIkNvbnRlbnQtdHlwZSIsICJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVy bGVuY29kZWQiKTsKKyAgICAgICB4aHIuc2V0UmVxdWVzdEhlYWRlcigiWC1SZXF1ZXN0ZWQtV2l0 aCIsICJYTUxIdHRwUmVxdWVzdCIpOworICAgICAgIHhoci5zZW5kKG51bGwpOworICB9OworICAK Kzwvc2NyaXB0PgorCis8L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3htbGh0dHByZXF1ZXN0L3Jlc291cmNlcy9hY2Nlc3MtY29udHJvbC1hbGxvdy13aXRoLWJv ZHkucGhwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVl c3QvcmVzb3VyY2VzL2FjY2Vzcy1jb250cm9sLWFsbG93LXdpdGgtYm9keS5waHAJKHJldmlzaW9u IDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L3Jlc291cmNlcy9h Y2Nlc3MtY29udHJvbC1hbGxvdy13aXRoLWJvZHkucGhwCShyZXZpc2lvbiAwKQpAQCAtMCwwICsx LDEwIEBACis8P3BocAorICAgIGhlYWRlcigiQWNjZXNzLWNvbnRyb2wtYWxsb3ctaGVhZGVyczog WC1SZXF1ZXN0ZWQtV2l0aCIpOworICAgIGhlYWRlcigiQWNjZXNzLWNvbnRyb2wtbWF4LWFnZTog MCIpOworICAgIGhlYWRlcigiQWNjZXNzLWNvbnRyb2wtYWxsb3ctb3JpZ2luOiAqIik7CisgICAg aGVhZGVyKCJBY2Nlc3MtY29udHJvbC1hbGxvdy1tZXRob2RzOiAqIik7CisgICAgaGVhZGVyKCJW YXJ5OiBBY2NlcHQtRW5jb2RpbmciKTsKKyAgICBoZWFkZXIoIkNvbnRlbnQtVHlwZTogdGV4dC9w bGFpbiIpOworCisgICAgcHJpbnQgImVjaG8iCis/Pgo=