Resource Timing: Use original Timing-Allow-Origin for cache validating

Source/core/timing/Performance.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2012 Intel Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 139 matching lines @@
     m_resourceTimingBuffer.clear();
 }
 
 void Performance::webkitSetResourceTimingBufferSize(unsigned size)
 {
     m_resourceTimingBufferSize = size;
     if (isResourceTimingBufferFull())
         dispatchEvent(Event::create(EventTypeNames::webkitresourcetimingbufferfull));
 }
 
-static bool passesTimingAllowCheck(const ResourceResponse& response, Document* requestingDocument)
+static bool passesTimingAllowCheck(const ResourceResponse& response, Document* requestingDocument, const AtomicString& originalTimingAllowOrigin)
 {
     AtomicallyInitializedStatic(AtomicString&, timingAllowOrigin = *new AtomicString("timing-allow-origin"));
 
     RefPtr<SecurityOrigin> resourceOrigin = SecurityOrigin::create(response.url());
     if (resourceOrigin->isSameSchemeHostPort(requestingDocument->securityOrigin()))
         return true;
 
-    const AtomicString& timingAllowOriginString = response.httpHeaderField(timingAllowOrigin);
+    const AtomicString& timingAllowOriginString = originalTimingAllowOrigin.isEmpty() ? response.httpHeaderField(timingAllowOrigin) : originalTimingAllowOrigin;
     if (timingAllowOriginString.isEmpty() || equalIgnoringCase(timingAllowOriginString, "null"))
         return false;
 
     if (timingAllowOriginString == starAtom)
         return true;
 
     const String& securityOrigin = requestingDocument->securityOrigin()->toString();
     Vector<String> timingAllowOrigins;
     timingAllowOriginString.string().split(" ", timingAllowOrigins);
     for (size_t i = 0; i < timingAllowOrigins.size(); ++i) {
         if (timingAllowOrigins[i] == securityOrigin)
             return true;
     }
 
     return false;
 }
 
 static bool allowsTimingRedirect(const Vector<ResourceResponse>& redirectChain, const ResourceResponse& finalResponse, Document* initiatorDocument)
 {
-    if (!passesTimingAllowCheck(finalResponse, initiatorDocument))
+    if (!passesTimingAllowCheck(finalResponse, initiatorDocument, emptyAtom))
         return false;
 
     for (size_t i = 0; i < redirectChain.size(); i++) {
-        if (!passesTimingAllowCheck(redirectChain[i], initiatorDocument))
+        if (!passesTimingAllowCheck(redirectChain[i], initiatorDocument, emptyAtom))
             return false;
     }
 
     return true;
 }
 
 void Performance::addResourceTiming(const ResourceTimingInfo& info, Document* initiatorDocument)
 {
     if (isResourceTimingBufferFull())
         return;
 
     const ResourceResponse& finalResponse = info.finalResponse();
-    bool allowTimingDetails = passesTimingAllowCheck(finalResponse, initiatorDocument);
+    bool allowTimingDetails = passesTimingAllowCheck(finalResponse, initiatorDocument, info.originalTimingAllowOrigin());
     double startTime = info.initialTime();
 
     if (info.redirectChain().isEmpty()) {
         RefPtrWillBeRawPtr<PerformanceEntry> entry = PerformanceResourceTiming::create(info, initiatorDocument, startTime, allowTimingDetails);
         addResourceTimingBuffer(entry);
         return;
     }
 
     const Vector<ResourceResponse>& redirectChain = info.redirectChain();
     bool allowRedirectDetails = allowsTimingRedirect(redirectChain, finalResponse, initiatorDocument);
@@ skipping 61 matching lines @@
 
 void Performance::trace(Visitor* visitor)
 {
     visitor->trace(m_navigation);
     visitor->trace(m_timing);
     visitor->trace(m_resourceTimingBuffer);
     visitor->trace(m_userTiming);
 }
 
 } // namespace WebCore