CREDENTIAL: Extend FormData opacity to created Request objects

Source/modules/fetch/Request.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/fetch/Request.h"
 
 #include "bindings/core/v8/Dictionary.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
@@ skipping 245 matching lines @@
             r->headers()->append("Content-Type", init.contentType, exceptionState);
         }
         if (exceptionState.hadException())
             return nullptr;
     }
 
     // "33. Set |r|'s body to |temporaryBody|.
     if (temporaryBody)
         r->m_request->setBuffer(temporaryBody);
 
+    // https://w3c.github.io/webappsec/specs/credentialmanagement/#monkey-patching-fetch-2
+    if (init.opaque || (inputRequest && inputRequest->opaque()))
+        r->makeOpaque();
+
     // "34. Set |r|'s MIME type to the result of extracting a MIME type from
     // |r|'s request's header list."
     r->m_request->setMIMEType(r->m_request->headerList()->extractMIMEType());
 
     // "35. If |input| is a Request object and |input|'s body is non-null, run
     // these substeps:"
     // We set bodyUsed even when the body is null in spite of the
     // spec. See https://github.com/whatwg/fetch/issues/61 for details.
     if (inputRequest) {
         // "1. Set |input|'s body to null."
@@ skipping 274 matching lines @@
 }
 
 DEFINE_TRACE(Request)
 {
     Body::trace(visitor);
     visitor->trace(m_request);
     visitor->trace(m_headers);
 }
 
 } // namespace blink