Make playback fail if redirected to a different origin.

webkit/glue/media/buffered_resource_loader.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/media/buffered_resource_loader.h"
 
 #include "base/format_macros.h"
 #include "base/string_util.h"
 #include "net/base/net_errors.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebKit.h"
@@ skipping 230 matching lines @@
     const WebURLResponse& redirectResponse) {
 
   // The load may have been stopped and |start_callback| is destroyed.
   // In this case we shouldn't do anything.
   if (!start_callback_.get()) {
     // Set the url in the request to an invalid value (empty url).
     newRequest.setURL(WebKit::WebURL());
     return;
   }
 
-  if (!IsProtocolSupportedForMedia(newRequest.url())) {
+    // Only allow |single_origin_| if we haven't seen a different origin yet.
+  if (single_origin_)
+    single_origin_ = url_.GetOrigin() == GURL(newRequest.url()).GetOrigin();
+
+  // Enforce same-origin policy and cause redirects to other origins to
+  // look like network errors.
+  // http://dev.w3.org/html5/spec/Overview.html#concept-media-load-resource
+  // http://dev.w3.org/html5/spec/Overview.html#fetch
+  if (!single_origin_ || !IsProtocolSupportedForMedia(newRequest.url())) {
     // Set the url in the request to an invalid value (empty url).
     newRequest.setURL(WebKit::WebURL());
     DoneStart(net::ERR_ADDRESS_INVALID);
-    Stop();
     return;
   }
 
-  // Only allow |single_origin_| if we haven't seen a different origin yet.
-  if (single_origin_)
-    single_origin_ = url_.GetOrigin() == GURL(newRequest.url()).GetOrigin();
-
   url_ = newRequest.url();
 }
 
 void BufferedResourceLoader::didSendData(
     WebURLLoader* loader,
     unsigned long long bytes_sent,
     unsigned long long total_bytes_to_be_sent) {
   NOTIMPLEMENTED();
 }
 
@@ skipping 305 matching lines @@
   start_callback_->RunWithParams(Tuple1<int>(error));
   start_callback_.reset();
 }
 
 void BufferedResourceLoader::NotifyNetworkEvent() {
   if (event_callback_.get())
     event_callback_->Run();
 }
 
 }  // namespace webkit_glue