Cross origin requests to same origin should match

third_party/WebKit/Source/core/fetch/ResourceLoaderOptions.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 61 matching lines @@
     RequestAsynchronously
 };
 
 // A resource fetch can be marked as being CORS enabled. The loader
 // must perform an access check upon seeing the response.
 enum CORSEnabled {
     NotCORSEnabled,
     IsCORSEnabled
 };
 
+enum SameOrigin {
+    NotSameOrigin,
+    IsSameOrigin
+};
+
 struct ResourceLoaderOptions {
     USING_FAST_MALLOC(ResourceLoaderOptions);
 public:
     ResourceLoaderOptions()
         : dataBufferingPolicy(BufferData)
         , allowCredentials(DoNotAllowStoredCredentials)
         , credentialsRequested(ClientDidNotRequestCredentials)
         , contentSecurityPolicyOption(CheckContentSecurityPolicy)
         , requestInitiatorContext(DocumentContext)
         , synchronousPolicy(RequestAsynchronously)
         , corsEnabled(NotCORSEnabled)
+        , sameOrigin(NotSameOrigin)

[Nate Chapin, 2016/03/17 22:58:18]

This will make non-CORS loads always be marked NotSameOrigin. That seems
strange?

[Yoav Weiss, 2016/03/18 07:53:14]

True. Maybe a third value is needed

     {
     }
 
     ResourceLoaderOptions(
         DataBufferingPolicy dataBufferingPolicy,
         StoredCredentials allowCredentials,
         CredentialRequest credentialsRequested,
         ContentSecurityPolicyDisposition contentSecurityPolicyOption,
         RequestInitiatorContext requestInitiatorContext)
         : dataBufferingPolicy(dataBufferingPolicy)
         , allowCredentials(allowCredentials)
         , credentialsRequested(credentialsRequested)
         , contentSecurityPolicyOption(contentSecurityPolicyOption)
         , requestInitiatorContext(requestInitiatorContext)
         , synchronousPolicy(RequestAsynchronously)
         , corsEnabled(NotCORSEnabled)
+        , sameOrigin(NotSameOrigin)
     {
     }
 
     // Answers the question "can a separate request with these
     // different options be re-used" (e.g. preload request)
     // The safe (but possibly slow) answer is always false.
-    bool canReuseRequest(const ResourceLoaderOptions& other) const
-    {
-        // dataBufferingPolicy differences are believed to be safe for re-use.
-        // FIXME: check allowCredentials.
-        // FIXME: check credentialsRequested.
-        // FIXME: check contentSecurityPolicyOption.
-        // initiatorInfo is purely informational and should be benign for re-use.
-        // requestInitiatorContext is benign (indicates document vs. worker)
-        // synchronousPolicy (safe to re-use an async XHR response for sync, etc.)
-        return corsEnabled == other.corsEnabled;
-        // securityOrigin has more complicated checks which callers are responsible for.
-    }
+    bool canReuseRequest(const ResourceLoaderOptions& other) const;
 
     // When adding members, CrossThreadResourceLoaderOptionsData should be
     // updated.
     DataBufferingPolicy dataBufferingPolicy;
     StoredCredentials allowCredentials; // Whether HTTP credentials and cookies are sent with the request.
     CredentialRequest credentialsRequested; // Whether the client (e.g. XHR) wanted credentials in the first place.
     ContentSecurityPolicyDisposition contentSecurityPolicyOption;
     FetchInitiatorInfo initiatorInfo;
     RequestInitiatorContext requestInitiatorContext;
     SynchronousPolicy synchronousPolicy;
     CORSEnabled corsEnabled; // If the resource is loaded out-of-origin, whether or not to use CORS.
     RefPtr<SecurityOrigin> securityOrigin;
+    SameOrigin sameOrigin;
 };
 
 // Encode AtomicString (in FetchInitiatorInfo) as String to cross threads.
 struct CrossThreadResourceLoaderOptionsData {
     DISALLOW_NEW();
     explicit CrossThreadResourceLoaderOptionsData(const ResourceLoaderOptions& options)
         : dataBufferingPolicy(options.dataBufferingPolicy)
         , allowCredentials(options.allowCredentials)
         , credentialsRequested(options.credentialsRequested)
         , contentSecurityPolicyOption(options.contentSecurityPolicyOption)
         , initiatorInfo(options.initiatorInfo)
         , requestInitiatorContext(options.requestInitiatorContext)
         , synchronousPolicy(options.synchronousPolicy)
         , corsEnabled(options.corsEnabled)
-        , securityOrigin(options.securityOrigin ? options.securityOrigin->isolatedCopy() : nullptr) { }
+        , securityOrigin(options.securityOrigin ? options.securityOrigin->isolatedCopy() : nullptr)
+        , sameOrigin(options.sameOrigin) { }
 
     operator ResourceLoaderOptions() const
     {
         ResourceLoaderOptions options;
         options.dataBufferingPolicy = dataBufferingPolicy;
         options.allowCredentials = allowCredentials;
         options.credentialsRequested = credentialsRequested;
         options.contentSecurityPolicyOption = contentSecurityPolicyOption;
         options.initiatorInfo = initiatorInfo;
         options.requestInitiatorContext = requestInitiatorContext;
         options.synchronousPolicy = synchronousPolicy;
         options.corsEnabled = corsEnabled;
         options.securityOrigin = securityOrigin;
+        options.sameOrigin = sameOrigin;
         return options;
     }
 
     DataBufferingPolicy dataBufferingPolicy;
     StoredCredentials allowCredentials;
     CredentialRequest credentialsRequested;
     ContentSecurityPolicyDisposition contentSecurityPolicyOption;
     CrossThreadFetchInitiatorInfoData initiatorInfo;
     RequestInitiatorContext requestInitiatorContext;
     SynchronousPolicy synchronousPolicy;
     CORSEnabled corsEnabled;
     RefPtr<SecurityOrigin> securityOrigin;
+    SameOrigin sameOrigin;
 };
 
 template <>
 struct CrossThreadCopier<ResourceLoaderOptions> {
     using Type = CrossThreadResourceLoaderOptionsData;
     static Type copy(const ResourceLoaderOptions& options)
     {
         return CrossThreadResourceLoaderOptionsData(options);
     }
 };
 
 } // namespace blink
 
 #endif // ResourceLoaderOptions_h