[Fetch][WIP] Support blob:, about:, and data: URLs.

Source/modules/fetch/FetchManager.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/fetch/FetchManager.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
@@ skipping 137 matching lines @@
         Vector<char> m_buffer;
         bool m_finished;
     };
 
 private:
     Loader(ExecutionContext*, FetchManager*, ScriptPromiseResolver*, FetchRequestData*);
 
     void performBasicFetch();
     void performNetworkError(const String& message);
     void performHTTPFetch(bool corsFlag, bool corsPreflightFlag);
+    void performDataFetch();
     void failed(const String& message);
     void notifyFinished();
     Document* document() const;
     void loadSucceeded();
 
     RawPtrWillBeMember<FetchManager> m_fetchManager;
     PersistentWillBeMember<ScriptPromiseResolver> m_resolver;
     PersistentWillBeMember<FetchRequestData> m_request;
     RefPtr<ThreadableLoader> m_loader;
     bool m_failed;
@@ skipping 27 matching lines @@
     visitor->trace(m_resolver);
     visitor->trace(m_request);
     visitor->trace(m_integrityVerifier);
     ContextLifecycleObserver::trace(visitor);
 }
 
 void FetchManager::Loader::didReceiveResponse(unsigned long, const ResourceResponse& response, PassOwnPtr<WebDataConsumerHandle> handle)
 {
     ASSERT(handle);
 
+    if (response.url().protocolIs("blob") && response.httpStatusCode() == 404) {
+        // "If |blob| is null, return a network error."
+        // https://fetch.spec.whatwg.org/#concept-basic-fetch
+        performNetworkError("Blob not found.");
+        return;
+    }
+
     m_responseHttpStatusCode = response.httpStatusCode();
 
-    // Recompute the tainting if the request was redirected to a different
-    // origin.
-    if (!SecurityOrigin::create(response.url())->isSameSchemeHostPort(m_request->origin().get())) {
+    if (response.url().protocolIsData()) {
+        if (m_request->url().protocolIsData()) {
+            // A direct request to data.
+            m_request->setResponseTainting(FetchRequestData::BasicTainting);
+        } else {
+            // A redirect to data: scheme occured.
+            switch (m_request->mode()) {
+            case WebURLRequest::FetchRequestModeSameOrigin:
+                ASSERT_NOT_REACHED();
+                break;
+            case WebURLRequest::FetchRequestModeNoCORS:
+                m_request->setResponseTainting(FetchRequestData::OpaqueTainting);
+                break;
+            case WebURLRequest::FetchRequestModeCORS:
+            case WebURLRequest::FetchRequestModeCORSWithForcedPreflight:
+                performNetworkError("Fetch API cannot load " + m_request->url().string() + ". Redirects to data: URL are allowed only when mode is \"no-cors\".");
+                return;
+                break;
+            }
+        }
+    } else if (!SecurityOrigin::create(response.url())->isSameSchemeHostPort(m_request->origin().get())) {
+        // Recompute the tainting if the request was redirected to a different
+        // origin.
         switch (m_request->mode()) {
         case WebURLRequest::FetchRequestModeSameOrigin:
             ASSERT_NOT_REACHED();
             break;
         case WebURLRequest::FetchRequestModeNoCORS:
             m_request->setResponseTainting(FetchRequestData::OpaqueTainting);
             break;
         case WebURLRequest::FetchRequestModeCORS:
         case WebURLRequest::FetchRequestModeCORSWithForcedPreflight:
             m_request->setResponseTainting(FetchRequestData::CORSTainting);
@@ skipping 43 matching lines @@
         case FetchRequestData::CORSTainting:
             taintedResponse = responseData->createCORSFilteredResponse();
             break;
         case FetchRequestData::OpaqueTainting:
             taintedResponse = responseData->createOpaqueFilteredResponse();
             break;
         }
     }
 
     Response* r = Response::create(m_resolver->executionContext(), taintedResponse);
+    if (response.url().protocolIsData()) {
+        // An "Access-Control-Allow-Origin" header is added for data: URLs
+        // but no headers except for "Content-Type" should exist,
+        // according to the spec:
+        // https://fetch.spec.whatwg.org/#concept-basic-fetch
+        r->headers()->headerList()->remove("Access-Control-Allow-Origin");
+    }
     r->headers()->setGuard(Headers::ImmutableGuard);
 
     if (m_request->integrity().isEmpty()) {
         m_resolver->resolve(r);
         m_resolver.clear();
     } else {
         ASSERT(!m_integrityVerifier);
         m_integrityVerifier = new SRIVerifier(handle, updater, r, this, m_request->integrity(), response.url());
     }
 }
@@ skipping 156 matching lines @@
     }
 }
 
 void FetchManager::Loader::performBasicFetch()
 {
     // "To perform a basic fetch using |request|, switch on |request|'s url's
     // scheme, and run the associated steps:"
     if (SchemeRegistry::shouldTreatURLSchemeAsSupportingFetchAPI(m_request->url().protocol())) {
         // "Return the result of performing an HTTP fetch using |request|."
         performHTTPFetch(false, false);
+    } else if (m_request->url().protocolIsData()) {
+        performDataFetch();
+    } else if (m_request->url().protocolIs("blob")) {
+        performHTTPFetch(false, false);
     } else {
         // FIXME: implement other protocols.
         performNetworkError("Fetch API cannot load " + m_request->url().string() + ". URL scheme \"" + m_request->url().protocol() + "\" is not supported.");
     }
 }
 
 void FetchManager::Loader::performNetworkError(const String& message)
 {
     failed(message);
 }
@@ skipping 66 matching lines @@
     case WebURLRequest::FetchRequestModeCORSWithForcedPreflight:
         threadableLoaderOptions.crossOriginRequestPolicy = UseAccessControl;
         break;
     }
     InspectorInstrumentation::willStartFetch(executionContext(), this);
     m_loader = ThreadableLoader::create(*executionContext(), this, request, threadableLoaderOptions, resourceLoaderOptions);
     if (!m_loader)
         performNetworkError("Can't create ThreadableLoader");
 }
 
+void FetchManager::Loader::performDataFetch()
+{
+    ASSERT(m_request->url().protocolIsData());
+
+    ResourceRequest request(m_request->url());
+    request.setRequestContext(m_request->context());
+    request.setUseStreamOnResponse(true);
+    request.setHTTPMethod("GET");
+    request.setFetchRedirectMode(WebURLRequest::FetchRedirectModeError);
+
+    ResourceLoaderOptions resourceLoaderOptions;
+    resourceLoaderOptions.dataBufferingPolicy = DoNotBufferData;
+    resourceLoaderOptions.securityOrigin = m_request->origin().get();
+
+    ThreadableLoaderOptions threadableLoaderOptions;
+    threadableLoaderOptions.contentSecurityPolicyEnforcement = ContentSecurityPolicy::shouldBypassMainWorld(executionContext()) ? DoNotEnforceContentSecurityPolicy : EnforceConnectSrcDirective;
+    // We set AllowCrossOriginRequests to allow requests to data: URLs (which
+    // are considered as cross-origin) in 'same-origin' mode.
+    threadableLoaderOptions.crossOriginRequestPolicy = AllowCrossOriginRequests;
+
+    InspectorInstrumentation::willStartFetch(executionContext(), this);
+    m_loader = ThreadableLoader::create(*executionContext(), this, request, threadableLoaderOptions, resourceLoaderOptions);
+    if (!m_loader)
+        performNetworkError("Can't create ThreadableLoader");
+}
+
 void FetchManager::Loader::failed(const String& message)
 {
     if (m_failed || m_finished)
         return;
     m_failed = true;
     if (!message.isEmpty())
         executionContext()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
     if (m_resolver) {
         if (!m_resolver->executionContext() || m_resolver->executionContext()->activeDOMObjectsAreStopped())
             return;
@@ skipping 56 matching lines @@
 
 DEFINE_TRACE(FetchManager)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_executionContext);
     visitor->trace(m_loaders);
 #endif
 }
 
 } // namespace blink