Make playback fail if redirected to a different origin.

webkit/glue/media/simple_data_source.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/media/simple_data_source.h"
 
 #include "base/message_loop.h"
 #include "base/process_util.h"
 #include "media/base/filter_host.h"
 #include "net/base/data_url.h"
@@ skipping 95 matching lines @@
 void SimpleDataSource::SetURLLoaderForTest(WebKit::WebURLLoader* mock_loader) {
   url_loader_.reset(mock_loader);
   keep_test_loader_ = true;
 }
 
 void SimpleDataSource::willSendRequest(
     WebKit::WebURLLoader* loader,
     WebKit::WebURLRequest& newRequest,
     const WebKit::WebURLResponse& redirectResponse) {
   DCHECK(MessageLoop::current() == render_loop_);
+  base::AutoLock auto_lock(lock_);
 
   // Only allow |single_origin_| if we haven't seen a different origin yet.
   if (single_origin_)
     single_origin_ = url_.GetOrigin() == GURL(newRequest.url()).GetOrigin();
 
+  // Enforce same-origin policy and cause redirects to other origins to
+  // look like network errors.
+  // http://dev.w3.org/html5/spec/Overview.html#concept-media-load-resource
+  // http://dev.w3.org/html5/spec/Overview.html#fetch
+  if (!single_origin_) {
+    DoneInitialization_Locked(false);
+    return;
+  }
+
   url_ = newRequest.url();
 }
 
 void SimpleDataSource::didSendData(
     WebKit::WebURLLoader* loader,
     unsigned long long bytesSent,
     unsigned long long totalBytesToBeSent) {
   NOTIMPLEMENTED();
 }
 
@@ skipping 144 matching lines @@
     // If scheme is file or data, say we are loaded.
     host()->SetLoaded(url_.SchemeIsFile() || url_.SchemeIs(kDataScheme));
   } else {
     host()->SetError(media::PIPELINE_ERROR_NETWORK);
   }
   initialize_callback_->Run();
   initialize_callback_.reset();
 }
 
 }  // namespace webkit_glue