Bug 24492 – Move Local and NoAccess security rules from FrameLoader to SecurityOrigin

• Status: RESOLVED
• Resolution: FIXED
• Component: Page Loading

[Darin Fisher (:fishd, Google)]

Move Local and NoAccess security rules from FrameLoader to SecurityOrigin

This bug is about moving the following functions:

registerURLSchemeAsLocal
shouldTreatURLAsLocal
shouldTreatURLSchemeAsLocal
registerURLSchemeAsNoAccess
shouldTreatURLSchemeAsNoAccess

I also question whether we should keep shouldTreatURLAsLocal.  It seems a bit unnecessary.

[Darin Fisher (:fishd, Google)]

There is some related discussion in bug 24437.

[Jian Li]

We also need to make SecurityOrigin thread safe. Considering making all statics use TLS.

[Darin Fisher (:fishd, Google)]

I think that should be turned into a separate bug.  This one is just above moving some code, which is what I plan to do.

[Jeremy Orlow]

Hm.  Interesting.  This seems a bit related to https://bugs.webkit.org/show_bug.cgi?id=26143 ("SecurityOrigin should probably be split into Origin and EffectiveScriptOrigin").

[Adam Barth]

Stealing.  This is low hanging fruit on my quest to tame FrameLoader.

[Adam Barth]

Created attachment 31251 [details]
patchy

[Darin Fisher (:fishd, Google)]

Comment on attachment 31251 [details]
patchy

> [phone]  Adam Barth  <[e-mail]>
> +
> +        Reviewed by NOBODY (OOPS!).
> +
> +        Moved registerURLSchemeAsLocal and registerURLSchemeAsNoAccess from
> +        FrameLoader to SecurityOrigin.
> +

nit: provide a bug reference.  same goes for the other ChangeLogs.

R=me

[Adam Barth]

> nit: provide a bug reference.  same goes for the other ChangeLogs.

Thanks.  I have trouble remembering to do that for some reason.

[Adam Barth]

Fixed in http://trac.webkit.org/changeset/44664.