third_party/WebKit/Source/modules/fetch/Request.cpp - Issue 1918253002: CREDENTIAL: Credentials should be submitted within a registrable domain.

Unified Diff: third_party/WebKit/Source/modules/fetch/Request.cpp

Issue 1918253002: CREDENTIAL: Credentials should be submitted within a registrable domain. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: php Created 4 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: third_party/WebKit/Source/modules/fetch/Request.cpp

diff --git a/third_party/WebKit/Source/modules/fetch/Request.cpp b/third_party/WebKit/Source/modules/fetch/Request.cpp

index 54ddc5f9c1b5540c19eafb54c963f94dc017bedd..099638b5c87175da5f3df5d357fdcd06e5c2182f 100644

--- a/third_party/WebKit/Source/modules/fetch/Request.cpp

+++ b/third_party/WebKit/Source/modules/fetch/Request.cpp

@@ -18,6 +18,7 @@

#include "platform/HTTPNames.h"

#include "platform/network/HTTPParsers.h"

#include "platform/network/ResourceRequest.h"

+#include "platform/weborigin/OriginAccessEntry.h"

#include "platform/weborigin/Referrer.h"

#include "public/platform/WebURLRequest.h"

#include "public/platform/modules/serviceworker/WebServiceWorkerRequest.h"

@@ -326,9 +327,9 @@ Request* Request::createRequestWithRequestOrString(ScriptState* scriptState, Req

if (request->credentials() == WebURLRequest::FetchCredentialsModePassword) {

r->getHeaders()->append(HTTPNames::Content_Type, init.contentType, exceptionState);

- // TODO(mkwst): This should be a registrable-domain match.

- if (!origin->canRequest(r->url())) {

- exceptionState.throwTypeError("Credentials may only be submitted to same-origin endpoints.");

+ const OriginAccessEntry& accessEntry = OriginAccessEntry(r->url().protocol(), r->url().host(), OriginAccessEntry::AllowRegisterableDomains);

vabr (Chromium) 2016/04/26 16:49:18 This should be just const OriginAccessEntry, not a

Mike West 2016/04/26 18:14:15 Indeed, thanks!

+ if (accessEntry.matchesDomain(*origin) == OriginAccessEntry::DoesNotMatchOrigin) {

+ exceptionState.throwTypeError("Credentials may only be submitted to endpoints on the same registrable domain.");

vabr (Chromium) 2016/04/26 16:49:19 nit: The spelling in the spec is with "e" between

Mike West 2016/04/26 18:14:15 Ha! That's a typo in the spec, thanks (see https:/

return nullptr;

}

« no previous file with comments | « third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/echo-post.php ('k') | no next file » | no next file with comments »