Block all scripts from setting unsafe headers in XMLHttpRequest

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 903 matching lines @@
     if (m_state != OPENED || m_loader) {
         ec = INVALID_STATE_ERR;
         return;
     }
 
     if (!isValidHTTPToken(name) || !isValidHTTPHeaderValue(value)) {
         ec = SYNTAX_ERR;
         return;
     }
 
-    // A privileged script can set any headers.
-    if (!securityOrigin()->canLoadLocalResources() && !isAllowedHTTPHeader(name)) {
+    // No script (privileged or not) can set unsafe headers.
+    if (!isAllowedHTTPHeader(name)) {
         logConsoleError(scriptExecutionContext(), "Refused to set unsafe header \"" + name + "\"");
         return;
     }
 
     setRequestHeaderInternal(name, value);
 }
 
 void XMLHttpRequest::setRequestHeaderInternal(const AtomicString& name, const String& value)
 {
     HTTPHeaderMap::AddResult result = m_requestHeaders.add(name, value);
@@ skipping 354 matching lines @@
     info.addMember(m_responseDocument, "responseDocument");
     info.addMember(m_binaryResponseBuilder, "binaryResponseBuilder");
     info.addMember(m_responseArrayBuffer, "responseArrayBuffer");
     info.addMember(m_lastSendURL, "lastSendURL");
     info.addMember(m_eventTargetData, "eventTargetData");
     info.addMember(m_progressEventThrottle, "progressEventThrottle");
     info.addMember(m_securityOrigin, "securityOrigin");
 }
 
 } // namespace WebCore