Fix a bug in origin header generation for CORS preflight in extensions

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 370 matching lines @@
 
     bool shouldForcePreflight =
         request.isExternalRequest() ||
         InspectorInstrumentation::shouldForceCORSPreflight(m_document);
     bool canSkipPreflight =
         CrossOriginPreflightResultCache::shared().canSkipPreflight(
             getSecurityOrigin()->toString(), crossOriginRequest.url(),
             effectiveAllowCredentials(), crossOriginRequest.httpMethod(),
             crossOriginRequest.httpHeaderFields());
     if (canSkipPreflight && !shouldForcePreflight) {
-      if (getSecurityOrigin())
-        crossOriginRequest.setHTTPOrigin(getSecurityOrigin());
-      if (m_overrideReferrer)
-        crossOriginRequest.setHTTPReferrer(m_referrerAfterRedirect);
-
       prepareCrossOriginRequest(crossOriginRequest);
       loadRequest(crossOriginRequest, crossOriginOptions);
     } else {
-      ResourceRequest preflightRequest = createAccessControlPreflightRequest(
-          crossOriginRequest, getSecurityOrigin());
+      ResourceRequest preflightRequest =
+          createAccessControlPreflightRequest(crossOriginRequest);
+      // TODO: Call prepareCrossOriginRequest(preflightRequest) to also set the

[yhirano, 2017/01/18 05:28:03]

TODO(tyoshino)

[tyoshino (SeeGerritForStatus), 2017/01/18 06:53:42]

Done.

+      // referrer header.
+      if (getSecurityOrigin())
+        preflightRequest.setHTTPOrigin(getSecurityOrigin());
 
       // Create a ResourceLoaderOptions for preflight.
       ResourceLoaderOptions preflightOptions = crossOriginOptions;
       preflightOptions.allowCredentials = DoNotAllowStoredCredentials;
 
       m_actualRequest = crossOriginRequest;
       m_actualOptions = crossOriginOptions;
 
-      prepareCrossOriginRequest(crossOriginRequest);
       loadRequest(preflightRequest, preflightOptions);
     }
   }
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader() {
   CHECK(!m_client);
   DCHECK(!m_resource);
 }
 
@@ skipping 726 matching lines @@
 }
 
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->trace(m_resource);
   visitor->trace(m_document);
   ThreadableLoader::trace(visitor);
   RawResourceClient::trace(visitor);
 }
 
 }  // namespace blink