Chromium Code Reviews| Index: net/url_request/url_request_http_job.cc |
| diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc |
| index b26812dfa397a0da4d29e81c727729fb94ec4c08..cd06b0d25c4d02db7a64ad72dee1d66e1748a0ab 100644 |
| --- a/net/url_request/url_request_http_job.cc |
| +++ b/net/url_request/url_request_http_job.cc |
| @@ -43,6 +43,7 @@ |
| #include "net/url_request/url_request.h" |
| #include "net/url_request/url_request_context.h" |
| #include "net/url_request/url_request_error_job.h" |
| +#include "net/url_request/url_request_job_factory.h" |
| #include "net/url_request/url_request_redirect_job.h" |
| #include "net/url_request/url_request_throttler_header_adapter.h" |
| #include "net/url_request/url_request_throttler_manager.h" |
| @@ -1019,25 +1020,15 @@ Filter* URLRequestHttpJob::SetupFilter() const { |
| } |
| bool URLRequestHttpJob::IsSafeRedirect(const GURL& location) { |
| - // We only allow redirects to certain "safe" protocols. This does not |
| - // restrict redirects to externally handled protocols. Our consumer would |
| - // need to take care of those. |
| - |
| - if (!URLRequest::IsHandledURL(location)) |
| + // HTTP is always safe. |
| + // TODO(pauljensen): Remove once crbug.com/146591 is fixed. |
| + if (location.is_valid() && |
| + (location.scheme() == "http" || location.scheme() == "https")) |
| return true; |
|
mmenke
2013/02/19 17:26:15
nit: Use braces when the conditional is more than
pauljensen
2013/02/20 15:13:27
Done.
|
| - |
| - static const char* kSafeSchemes[] = { |
| - "http", |
| - "https", |
| - "ftp" |
| - }; |
| - |
| - for (size_t i = 0; i < arraysize(kSafeSchemes); ++i) { |
| - if (location.SchemeIs(kSafeSchemes[i])) |
| - return true; |
| - } |
| - |
| - return false; |
| + // Query URLRequestJobFactory as to whether |location| would be safe to |
| + // redirect to. |
| + return request_->context()->job_factory() && |
| + request_->context()->job_factory()->IsSafeRedirectTarget(location); |
| } |
| bool URLRequestHttpJob::NeedsAuth() { |