Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(35)

Side by Side Diff: Source/core/loader/DocumentThreadableLoader.cpp

Issue 149643003: Improve handling of CORS redirects for some resource loads. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Track source origin via ResourceLoaderOptions.securityOrigin Created 6 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
3 * Copyright (C) 2013, Intel Corporation 3 * Copyright (C) 2013, Intel Corporation
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are 6 * modification, are permitted provided that the following conditions are
7 * met: 7 * met:
8 * 8 *
9 * * Redistributions of source code must retain the above copyright 9 * * Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer. 10 * notice, this list of conditions and the following disclaimer.
(...skipping 444 matching lines...) Expand 10 before | Expand all | Expand 10 after
455 if (m_options.contentSecurityPolicyEnforcement != EnforceConnectSrcDirective ) 455 if (m_options.contentSecurityPolicyEnforcement != EnforceConnectSrcDirective )
456 return true; 456 return true;
457 return m_document->contentSecurityPolicy()->allowConnectToSource(url); 457 return m_document->contentSecurityPolicy()->allowConnectToSource(url);
458 } 458 }
459 459
460 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const 460 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const
461 { 461 {
462 return m_options.securityOrigin ? m_options.securityOrigin.get() : m_documen t->securityOrigin(); 462 return m_options.securityOrigin ? m_options.securityOrigin.get() : m_documen t->securityOrigin();
463 } 463 }
464 464
465 bool DocumentThreadableLoader::checkCrossOriginAccessRedirectionUrl(const KURL& requestUrl, String& errorDescription)
466 {
467 if (!SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(requestUrl.protocol() )) {
468 errorDescription = "The request was redirected to a URL ('" + requestUrl .string() + "') which has a disallowed scheme for cross-origin requests.";
469 return false;
470 }
471
472 if (!(requestUrl.user().isEmpty() && requestUrl.pass().isEmpty())) {
473 errorDescription = "The request was redirected to a URL ('" + requestUrl .string() + "') containing userinfo, which is disallowed for cross-origin reques ts.";
474 return false;
475 }
476
477 return true;
478 }
479
480 } // namespace WebCore 465 } // namespace WebCore
OLDNEW
« Source/core/fetch/ResourceFetcher.cpp ('K') | « Source/core/loader/DocumentThreadableLoader.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698