Relax cross-origin partial response requirements for CORS presence.

media/blink/buffered_data_source.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/blink/buffered_data_source.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/single_thread_task_runner.h"
@@ skipping 413 matching lines @@
   ReadOperation::Run(read_op_.Pass(), kReadError);
 }
 
 bool BufferedDataSource::CheckPartialResponseURL(
     const GURL& partial_response_original_url) const {
   // We check the redirected URL of partial responses in case malicious
   // attackers scan the bytes of other origin resources by mixing their
   // generated bytes and the target response. See http://crbug.com/489060#c32
   // for details.
   // If the origin of the new response is different from the first response we
-  // deny the redirected response.
-  return response_original_url_.GetOrigin() ==
-         partial_response_original_url.GetOrigin();
+  // deny the redirected response unless the crossorigin attribute has been set.
+  return (response_original_url_.GetOrigin() ==
+          partial_response_original_url.GetOrigin()) ||
+         DidPassCORSAccessCheck();
 }
 
 void BufferedDataSource::ReadCallback(
     BufferedResourceLoader::Status status,
     int bytes_read) {
   DCHECK(render_task_runner_->BelongsToCurrentThread());
 
   // TODO(scherkus): we shouldn't have to lock to signal host(), see
   // http://crbug.com/113712 for details.
   base::AutoLock auto_lock(lock_);
@@ skipping 118 matching lines @@
   }
 
   // If media is currently playing or the page indicated preload=auto or the
   // the server does not support the byte range request or we do not want to go
   // too far ahead of the read head, use threshold strategy to enable/disable
   // deferring when the buffer is full/depleted.
   loader_->UpdateDeferStrategy(BufferedResourceLoader::kCapacityDefer);
 }
 
 }  // namespace media