Bug 19242 – Data URLs should set an Access-Control-Origin of "null"

• Status: RESOLVED
• Resolution: FIXED
• Component: XML

[Adam Barth]

Data URLs should set an Access-Control-Origin of "null".  Currently, we're setting the header to the empty string.

[Adam Barth]

Created attachment 21332 [details]
untested patch

Here's a patch.  It's untested at the moment.  I really wish I had a Mac...  :)

[Sam Weinig]

Comment on attachment 21332 [details]
untested patch

I think the logic for:
     String accessControlOrigin = m_doc->securityOrigin()->toString();
+    if (accessControlOrigin.isEmpty())
+        accessControlOrigin = "null";
should be lifted out into a separate function.  There is one other places that put the access-control-origin into the request that you have missed, in handleAsynchronousMethodCheckResult where the helper should be used.

[Adam Barth]

Created attachment 21554 [details]
patch with test

This turned out to be a bit more involved than I expected, but here's an improved patch.

[Adam Barth]

Comment on attachment 21554 [details]
patch with test

Actually, I'm not sure this patch is right w.r.t. document that have set their document.domain property.  Let me test how this works in other browsers.

[Adam Barth]

Created attachment 21619 [details]
patch

This patch handles document.domain properly (and adds a test for this behavior).  As a side effect, this should also fix Bug 15100.

[Adam Barth]

Created attachment 21620 [details]
patch

Oops.  Attached the old version of the patch before.

[Sam Weinig]

Comment on attachment 21620 [details]
patch

This includes some document.domain changes that I think should be landed separately.

[Sam Weinig]

Created attachment 21644 [details]
updated and tweaked

Adam, I took the chunk of your patch that relates to this specific bug and tweaked it a bit.  If something looks amiss, please let me know.

[Adam Barth]

> Adam, I took the chunk of your patch that relates to this specific bug and
> tweaked it a bit.  If something looks amiss, please let me know.

Yeah that looks right.  Thanks.

[Adam Barth]

Fixed in r34504.