CORS-RFC1918: Teach ResourceRequest about "external" requests

third_party/WebKit/Source/modules/fetch/FetchManager.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/fetch/FetchManager.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8ThrowException.h"
@@ skipping 520 matching lines @@
         request.addHTTPHeaderField(AtomicString(list[i]->first), AtomicString(list[i]->second));
     }
 
     if (m_request->method() != HTTPNames::GET && m_request->method() != HTTPNames::HEAD) {
         if (m_request->buffer()) {
             request.setHTTPBody(m_request->buffer()->drainAsFormData());
         }
     }
     request.setFetchRedirectMode(m_request->redirect());
     request.setUseStreamOnResponse(true);
+    request.setExternalRequestStateFromRequestorAddressSpace(executionContext()->securityContext().addressSpace());
 
     // "2. Append `Referer`/empty byte sequence, if |HTTPRequest|'s |referrer|
     // is none, and `Referer`/|HTTPRequest|'s referrer, serialized and utf-8
     // encoded, otherwise, to HTTPRequest's header list.
     //
     // The following code also invokes "determine request's referrer" which is
     // written in "Main fetch" operation.
     ASSERT(m_request->getReferrerPolicy() == ReferrerPolicyDefault);
     // Request's referrer policy is always default, so use the client's one.
     // TODO(yhirano): Fix here when we introduce requet's referrer policy.
@@ skipping 75 matching lines @@
     if (m_request->method() != HTTPNames::GET) {
         performNetworkError("Only 'GET' method is allowed for data URLs in Fetch API.");
         return;
     }
 
     ResourceRequest request(m_request->url());
     request.setRequestContext(m_request->context());
     request.setUseStreamOnResponse(true);
     request.setHTTPMethod(m_request->method());
     request.setFetchRedirectMode(WebURLRequest::FetchRedirectModeError);
+    // We intentionally skip 'setExternalRequestStateFromRequestorAddressSpace', as 'data:' can never be external.
 
     ResourceLoaderOptions resourceLoaderOptions;
     resourceLoaderOptions.dataBufferingPolicy = DoNotBufferData;
     resourceLoaderOptions.securityOrigin = m_request->origin().get();
 
     ThreadableLoaderOptions threadableLoaderOptions;
     threadableLoaderOptions.contentSecurityPolicyEnforcement = ContentSecurityPolicy::shouldBypassMainWorld(executionContext()) ? DoNotEnforceContentSecurityPolicy : EnforceContentSecurityPolicy;
     threadableLoaderOptions.crossOriginRequestPolicy = AllowCrossOriginRequests;
 
     InspectorInstrumentation::willStartFetch(executionContext(), this);
@@ skipping 66 matching lines @@
     loader->dispose();
 }
 
 DEFINE_TRACE(FetchManager)
 {
     visitor->trace(m_executionContext);
     visitor->trace(m_loaders);
 }
 
 } // namespace blink