Bug 119857
| Summary: | Two XHR tests related to cross-origin requests fall victim to port blocking | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Brady Eidson <beidson> |
| Component: | Tools / Tests | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | ap |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Brady Eidson
Two XHR tests related to cross-origin requests fall victim to port blocking.
http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-sync.html and http/tests/xmlhttprequest/simple-cross-origin-denied-events-sync.html both try a cross-origin access to a resource at port :7
The purpose of the access is to test cross-origin denial to "a port that will likely refuse the connection." Unfortunately, because of how early port blocking occurs, that request doesn't even undergo cross-origin evaluation.
While working on my patch in https://bugs.webkit.org/show_bug.cgi?id=119493 I noticed this.
When the network process is used, port blocking doesn't happen preemptively like this, so we *do* perform a cross-origin check as the test originally intended. This changes the output of the test.
I'm not sure if the preemptive port blocking is right, or the lack of it is right, or if both are "correct".
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |