| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2006, 2007, 2010, 2011 Apple Inc. All rights reserved. | 2 * Copyright (C) 2006, 2007, 2010, 2011 Apple Inc. All rights reserved. |
| 3 * (C) 2007 Graham Dennis (graham.dennis@gmail.com) | 3 * (C) 2007 Graham Dennis (graham.dennis@gmail.com) |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
| 7 * are met: | 7 * are met: |
| 8 * | 8 * |
| 9 * 1. Redistributions of source code must retain the above copyright | 9 * 1. Redistributions of source code must retain the above copyright |
| 10 * notice, this list of conditions and the following disclaimer. | 10 * notice, this list of conditions and the following disclaimer. |
| (...skipping 154 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 165 passedRedirectResponse.toResourceResponse()); | 165 passedRedirectResponse.toResourceResponse()); |
| 166 | 166 |
| 167 newRequest.setRedirectStatus( | 167 newRequest.setRedirectStatus( |
| 168 ResourceRequest::RedirectStatus::FollowedRedirect); | 168 ResourceRequest::RedirectStatus::FollowedRedirect); |
| 169 | 169 |
| 170 const KURL originalURL = newRequest.url(); | 170 const KURL originalURL = newRequest.url(); |
| 171 | 171 |
| 172 if (!isManualRedirectFetchRequest(m_resource->resourceRequest())) { | 172 if (!isManualRedirectFetchRequest(m_resource->resourceRequest())) { |
| 173 ResourceRequestBlockedReason blockedReason = context().canRequest( | 173 ResourceRequestBlockedReason blockedReason = context().canRequest( |
| 174 m_resource->getType(), newRequest, newRequest.url(), | 174 m_resource->getType(), newRequest, newRequest.url(), |
| 175 m_resource->options(), m_resource->isUnusedPreload(), | 175 m_resource->options(), |
| 176 /* Don't send security violation reports for unused preloads */ |
| 177 (m_resource->isUnusedPreload() |
| 178 ? FetchContext::SecurityViolationReportingPolicy::SuppressReporting |
| 179 : FetchContext::SecurityViolationReportingPolicy::Report), |
| 176 FetchRequest::UseDefaultOriginRestrictionForType); | 180 FetchRequest::UseDefaultOriginRestrictionForType); |
| 177 if (blockedReason != ResourceRequestBlockedReason::None) { | 181 if (blockedReason != ResourceRequestBlockedReason::None) { |
| 178 cancelForRedirectAccessCheckError(newRequest.url(), blockedReason); | 182 cancelForRedirectAccessCheckError(newRequest.url(), blockedReason); |
| 179 return false; | 183 return false; |
| 180 } | 184 } |
| 181 | 185 |
| 182 if (m_resource->options().corsEnabled == IsCORSEnabled) { | 186 if (m_resource->options().corsEnabled == IsCORSEnabled) { |
| 183 RefPtr<SecurityOrigin> sourceOrigin = | 187 RefPtr<SecurityOrigin> sourceOrigin = |
| 184 m_resource->options().securityOrigin; | 188 m_resource->options().securityOrigin; |
| 185 if (!sourceOrigin.get()) | 189 if (!sourceOrigin.get()) |
| (...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 251 } | 255 } |
| 252 | 256 |
| 253 FetchContext& ResourceLoader::context() const { | 257 FetchContext& ResourceLoader::context() const { |
| 254 return m_fetcher->context(); | 258 return m_fetcher->context(); |
| 255 } | 259 } |
| 256 | 260 |
| 257 ResourceRequestBlockedReason ResourceLoader::canAccessResponse( | 261 ResourceRequestBlockedReason ResourceLoader::canAccessResponse( |
| 258 Resource* resource, | 262 Resource* resource, |
| 259 const ResourceResponse& response) const { | 263 const ResourceResponse& response) const { |
| 260 // Redirects can change the response URL different from one of request. | 264 // Redirects can change the response URL different from one of request. |
| 261 bool forPreload = resource->isUnusedPreload(); | 265 bool unusedPreload = resource->isUnusedPreload(); |
| 262 ResourceRequestBlockedReason blockedReason = | 266 ResourceRequestBlockedReason blockedReason = context().canRequest( |
| 263 context().canRequest(resource->getType(), resource->resourceRequest(), | 267 resource->getType(), resource->resourceRequest(), response.url(), |
| 264 response.url(), resource->options(), forPreload, | 268 resource->options(), |
| 265 FetchRequest::UseDefaultOriginRestrictionForType); | 269 /* Don't send security violation reports for unused preloads */ |
| 270 (unusedPreload |
| 271 ? FetchContext::SecurityViolationReportingPolicy::SuppressReporting |
| 272 : FetchContext::SecurityViolationReportingPolicy::Report), |
| 273 FetchRequest::UseDefaultOriginRestrictionForType); |
| 266 if (blockedReason != ResourceRequestBlockedReason::None) | 274 if (blockedReason != ResourceRequestBlockedReason::None) |
| 267 return blockedReason; | 275 return blockedReason; |
| 268 | 276 |
| 269 SecurityOrigin* sourceOrigin = resource->options().securityOrigin.get(); | 277 SecurityOrigin* sourceOrigin = resource->options().securityOrigin.get(); |
| 270 if (!sourceOrigin) | 278 if (!sourceOrigin) |
| 271 sourceOrigin = context().getSecurityOrigin(); | 279 sourceOrigin = context().getSecurityOrigin(); |
| 272 | 280 |
| 273 if (sourceOrigin->canRequestNoSuborigin(response.url())) | 281 if (sourceOrigin->canRequestNoSuborigin(response.url())) |
| 274 return ResourceRequestBlockedReason::None; | 282 return ResourceRequestBlockedReason::None; |
| 275 | 283 |
| 276 // Use the original response instead of the 304 response for a successful | 284 // Use the original response instead of the 304 response for a successful |
| 277 // revaldiation. | 285 // revaldiation. |
| 278 const ResourceResponse& responseForAccessControl = | 286 const ResourceResponse& responseForAccessControl = |
| 279 (resource->isCacheValidator() && response.httpStatusCode() == 304) | 287 (resource->isCacheValidator() && response.httpStatusCode() == 304) |
| 280 ? resource->response() | 288 ? resource->response() |
| 281 : response; | 289 : response; |
| 282 | 290 |
| 283 CrossOriginAccessControl::AccessStatus corsStatus = | 291 CrossOriginAccessControl::AccessStatus corsStatus = |
| 284 CrossOriginAccessControl::checkAccess( | 292 CrossOriginAccessControl::checkAccess( |
| 285 responseForAccessControl, resource->options().allowCredentials, | 293 responseForAccessControl, resource->options().allowCredentials, |
| 286 sourceOrigin); | 294 sourceOrigin); |
| 287 if (corsStatus != CrossOriginAccessControl::kAccessAllowed) { | 295 if (corsStatus != CrossOriginAccessControl::kAccessAllowed) { |
| 288 resource->setCORSFailed(); | 296 resource->setCORSFailed(); |
| 289 if (!forPreload) { | 297 if (!unusedPreload) { |
| 290 String resourceType = Resource::resourceTypeToString( | 298 String resourceType = Resource::resourceTypeToString( |
| 291 resource->getType(), resource->options().initiatorInfo.name); | 299 resource->getType(), resource->options().initiatorInfo.name); |
| 292 StringBuilder builder; | 300 StringBuilder builder; |
| 293 builder.append("Access to "); | 301 builder.append("Access to "); |
| 294 builder.append(resourceType); | 302 builder.append(resourceType); |
| 295 builder.append(" at '"); | 303 builder.append(" at '"); |
| 296 builder.append(response.url().getString()); | 304 builder.append(response.url().getString()); |
| 297 builder.append("' from origin '"); | 305 builder.append("' from origin '"); |
| 298 builder.append(sourceOrigin->toString()); | 306 builder.append(sourceOrigin->toString()); |
| 299 builder.append("' has been blocked by CORS policy: "); | 307 builder.append("' has been blocked by CORS policy: "); |
| (...skipping 213 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 513 return; | 521 return; |
| 514 | 522 |
| 515 // Don't activate if cache policy is explicitly set. | 523 // Don't activate if cache policy is explicitly set. |
| 516 if (request.getCachePolicy() != WebCachePolicy::UseProtocolCachePolicy) | 524 if (request.getCachePolicy() != WebCachePolicy::UseProtocolCachePolicy) |
| 517 return; | 525 return; |
| 518 | 526 |
| 519 m_isCacheAwareLoadingActivated = true; | 527 m_isCacheAwareLoadingActivated = true; |
| 520 } | 528 } |
| 521 | 529 |
| 522 } // namespace blink | 530 } // namespace blink |
| OLD | NEW |