| Index: third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
|
| diff --git a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
|
| index 6c9c13e7b2768baddbde8ea1191e14bdd4c198c6..adf384456cbde047776266ec431a9c39fe6c78d2 100644
|
| --- a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
|
| +++ b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
|
| @@ -83,8 +83,7 @@ ResourceRequest createAccessControlPreflightRequest(
|
| const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
|
|
|
| if (requestHeaderFields.size() > 0) {
|
| - // Fetch API Spec:
|
| - // https://fetch.spec.whatwg.org/#cors-preflight-fetch-0
|
| + // Fetch API Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch-0
|
| Vector<String> headers;
|
| for (const auto& header : requestHeaderFields) {
|
| if (FetchUtils::isSimpleHeader(header.key, header.value)) {
|
| @@ -92,8 +91,8 @@ ResourceRequest createAccessControlPreflightRequest(
|
| continue;
|
| }
|
| if (equalIgnoringCase(header.key, "referer")) {
|
| - // When the request is from a Worker, referrer header was added
|
| - // by WorkerThreadableLoader. But it should not be added to
|
| + // When the request is from a Worker, referrer header was added by
|
| + // WorkerThreadableLoader. But it should not be added to
|
| // Access-Control-Request-Headers header.
|
| continue;
|
| }
|
| @@ -120,9 +119,8 @@ static bool isOriginSeparator(UChar ch) {
|
| }
|
|
|
| static bool isInterestingStatusCode(int statusCode) {
|
| - // Predicate that gates what status codes should be included in
|
| - // console error messages for responses containing no access
|
| - // control headers.
|
| + // Predicate that gates what status codes should be included in console error
|
| + // messages for responses containing no access control headers.
|
| return statusCode >= 400;
|
| }
|
|
|
| @@ -162,8 +160,8 @@ bool passesAccessControlCheck(const ResourceResponse& response,
|
| const AtomicString& allowOriginHeaderValue =
|
| response.httpHeaderField(allowOriginHeaderName);
|
|
|
| - // Check Suborigins, unless the Access-Control-Allow-Origin is '*',
|
| - // which implies that all Suborigins are okay as well.
|
| + // Check Suborigins, unless the Access-Control-Allow-Origin is '*', which
|
| + // implies that all Suborigins are okay as well.
|
| if (securityOrigin->hasSuborigin() && allowOriginHeaderValue != starAtom) {
|
| const AtomicString& allowSuboriginHeaderValue =
|
| response.httpHeaderField(allowSuboriginHeaderName);
|
| @@ -180,8 +178,8 @@ bool passesAccessControlCheck(const ResourceResponse& response,
|
| }
|
|
|
| if (allowOriginHeaderValue == starAtom) {
|
| - // A wildcard Access-Control-Allow-Origin can not be used if credentials are to be sent,
|
| - // even with Access-Control-Allow-Credentials set to true.
|
| + // A wildcard Access-Control-Allow-Origin can not be used if credentials are
|
| + // to be sent, even with Access-Control-Allow-Credentials set to true.
|
| if (includeCredentials == DoNotAllowStoredCredentials)
|
| return true;
|
| if (response.isHTTP()) {
|
| @@ -266,10 +264,8 @@ bool passesAccessControlCheck(const ResourceResponse& response,
|
| bool passesPreflightStatusCheck(const ResourceResponse& response,
|
| String& errorDescription) {
|
| // CORS preflight with 3XX is considered network error in
|
| - // Fetch API Spec:
|
| - // https://fetch.spec.whatwg.org/#cors-preflight-fetch
|
| - // CORS Spec:
|
| - // http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0
|
| + // Fetch API Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch
|
| + // CORS Spec: http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0
|
| // https://crbug.com/452394
|
| if (response.httpStatusCode() < 200 || response.httpStatusCode() >= 300) {
|
| errorDescription = "Response for preflight has invalid HTTP status code " +
|
| @@ -319,8 +315,8 @@ void extractCorsExposedHeaderNamesList(const ResourceResponse& response,
|
| HTTPHeaderSet& headerSet) {
|
| // If a response was fetched via a service worker, it will always have
|
| // corsExposedHeaderNames set, either from the Access-Control-Expose-Headers
|
| - // header, or explicitly via foreign fetch. For requests that didn't come
|
| - // from a service worker, foreign fetch doesn't apply so just parse the CORS
|
| + // header, or explicitly via foreign fetch. For requests that didn't come from
|
| + // a service worker, foreign fetch doesn't apply so just parse the CORS
|
| // header.
|
| if (response.wasFetchedViaServiceWorker()) {
|
| for (const auto& header : response.corsExposedHeaderNames())
|
| @@ -339,8 +335,8 @@ bool CrossOriginAccessControl::isLegalRedirectLocation(
|
| // https://fetch.spec.whatwg.org/#http-redirect-fetch. Chromium also allows
|
| // the data scheme.
|
| //
|
| - // TODO(tyoshino): This check should be performed regardless of the CORS
|
| - // flag and request's mode.
|
| + // TODO(tyoshino): This check should be performed regardless of the CORS flag
|
| + // and request's mode.
|
| if (!SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(
|
| requestURL.protocol())) {
|
| errorDescription = "Redirect location '" + requestURL.getString() +
|
| @@ -412,8 +408,8 @@ bool CrossOriginAccessControl::handleRedirect(
|
| newRequest.clearHTTPOrigin();
|
| newRequest.setHTTPOrigin(newSecurityOrigin.get());
|
|
|
| - // Unset credentials flag if request's credentials mode is
|
| - // "same-origin" as request's response tainting becomes "cors".
|
| + // Unset credentials flag if request's credentials mode is "same-origin" as
|
| + // request's response tainting becomes "cors".
|
| //
|
| // This is equivalent to the step 2 in
|
| // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
|
|
|