WebKit merge 41660:41709 (WebKit side)....

third_party/WebKit/WebCore/loader/CrossOriginAccessControl.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 18 matching lines @@
 
 #include "AtomicString.h"
 #include "ResourceResponse.h"
 #include "SecurityOrigin.h"
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
 bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name)
 {
-    return equalIgnoringCase(name, "accept") || equalIgnoringCase(name, "accept-language") || equalIgnoringCase(name, "content-type");
+    return equalIgnoringCase(name, "accept")
+            || equalIgnoringCase(name, "accept-language")
+            || equalIgnoringCase(name, "content-language")
+            || equalIgnoringCase(name, "content-type");
 }
 
 bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap& headerMap)
 {
-    if (method != "GET" && method != "POST")
+    if (method != "GET" && method != "HEAD" && method != "POST")
         return false;
 
     HTTPHeaderMap::const_iterator end = headerMap.end();
     for (HTTPHeaderMap::const_iterator it = headerMap.begin(); it != end; ++it) {
         if (!isOnAccessControlSimpleRequestHeaderWhitelist(it->first))
             return false;
     }
 
+    HTTPHeaderMap::const_iterator contentTypeIter = headerMap.find("Content-Type");
+    if (contentTypeIter != headerMap.end()) {
+        const String& contentType = contentTypeIter->second;
+        if (!equalIgnoringCase(contentType, "application/x-www-form-urlencoded")
+             && !equalIgnoringCase(contentType, "multipart/form-data")
+             && !equalIgnoringCase(contentType, "text/plain"))
+            return false;
+    }
+
     return true;
 }
 
 typedef HashSet<String, CaseFoldingHash> HTTPHeaderSet;
 static HTTPHeaderSet* createAllowedCrossOriginResponseHeadersSet()
 {
     HTTPHeaderSet* headerSet = new HashSet<String, CaseFoldingHash>;
     
     headerSet->add("cache-control");
     headerSet->add("content-language");
@@ skipping 25 matching lines @@
     if (includeCredentials) {
         const String& accessControlCredentialsString = response.httpHeaderField("Access-Control-Allow-Credentials");
         if (accessControlCredentialsString != "true")
             return false;
     }
 
     return true;
 }
 
 } // namespace WebCore