OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. |
3 * Copyright (C) 2013, Intel Corporation | 3 * Copyright (C) 2013, Intel Corporation |
4 * | 4 * |
5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
6 * modification, are permitted provided that the following conditions are | 6 * modification, are permitted provided that the following conditions are |
7 * met: | 7 * met: |
8 * | 8 * |
9 * * Redistributions of source code must retain the above copyright | 9 * * Redistributions of source code must retain the above copyright |
10 * notice, this list of conditions and the following disclaimer. | 10 * notice, this list of conditions and the following disclaimer. |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
94 WeakPtrFactory<EmptyDataReader> m_factory; | 94 WeakPtrFactory<EmptyDataReader> m_factory; |
95 }; | 95 }; |
96 | 96 |
97 std::unique_ptr<Reader> obtainReader(Client* client) override { | 97 std::unique_ptr<Reader> obtainReader(Client* client) override { |
98 return WTF::makeUnique<EmptyDataReader>(client); | 98 return WTF::makeUnique<EmptyDataReader>(client); |
99 } | 99 } |
100 const char* debugName() const override { return "EmptyDataHandle"; } | 100 const char* debugName() const override { return "EmptyDataHandle"; } |
101 }; | 101 }; |
102 | 102 |
103 // No-CORS requests are allowed for all these contexts, and plugin contexts with | 103 // No-CORS requests are allowed for all these contexts, and plugin contexts with |
104 // private permission when we set skipServiceWorker flag in PepperURLLoaderHost. | 104 // private permission when we set ServiceWorkerMode to None in |
| 105 // PepperURLLoaderHost. |
105 bool IsNoCORSAllowedContext( | 106 bool IsNoCORSAllowedContext( |
106 WebURLRequest::RequestContext context, | 107 WebURLRequest::RequestContext context, |
107 WebURLRequest::SkipServiceWorker skipServiceWorker) { | 108 WebURLRequest::ServiceWorkerMode serviceWorkerMode) { |
108 switch (context) { | 109 switch (context) { |
109 case WebURLRequest::RequestContextAudio: | 110 case WebURLRequest::RequestContextAudio: |
110 case WebURLRequest::RequestContextVideo: | 111 case WebURLRequest::RequestContextVideo: |
111 case WebURLRequest::RequestContextObject: | 112 case WebURLRequest::RequestContextObject: |
112 case WebURLRequest::RequestContextFavicon: | 113 case WebURLRequest::RequestContextFavicon: |
113 case WebURLRequest::RequestContextImage: | 114 case WebURLRequest::RequestContextImage: |
114 case WebURLRequest::RequestContextScript: | 115 case WebURLRequest::RequestContextScript: |
115 case WebURLRequest::RequestContextWorker: | 116 case WebURLRequest::RequestContextWorker: |
116 case WebURLRequest::RequestContextSharedWorker: | 117 case WebURLRequest::RequestContextSharedWorker: |
117 return true; | 118 return true; |
118 case WebURLRequest::RequestContextPlugin: | 119 case WebURLRequest::RequestContextPlugin: |
119 return skipServiceWorker == WebURLRequest::SkipServiceWorker::All; | 120 return serviceWorkerMode == WebURLRequest::ServiceWorkerMode::None; |
120 default: | 121 default: |
121 return false; | 122 return false; |
122 } | 123 } |
123 } | 124 } |
124 | 125 |
125 } // namespace | 126 } // namespace |
126 | 127 |
127 // Max number of CORS redirects handled in DocumentThreadableLoader. Same number | 128 // Max number of CORS redirects handled in DocumentThreadableLoader. Same number |
128 // as net/url_request/url_request.cc, and same number as | 129 // as net/url_request/url_request.cc, and same number as |
129 // https://fetch.spec.whatwg.org/#concept-http-fetch, Step 4. | 130 // https://fetch.spec.whatwg.org/#concept-http-fetch, Step 4. |
(...skipping 111 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
241 case UseAccessControl: | 242 case UseAccessControl: |
242 if (m_options.preflightPolicy == ForcePreflight) { | 243 if (m_options.preflightPolicy == ForcePreflight) { |
243 newRequest.setFetchRequestMode( | 244 newRequest.setFetchRequestMode( |
244 WebURLRequest::FetchRequestModeCORSWithForcedPreflight); | 245 WebURLRequest::FetchRequestModeCORSWithForcedPreflight); |
245 } else { | 246 } else { |
246 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS); | 247 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS); |
247 } | 248 } |
248 break; | 249 break; |
249 case AllowCrossOriginRequests: | 250 case AllowCrossOriginRequests: |
250 SECURITY_CHECK(IsNoCORSAllowedContext(m_requestContext, | 251 SECURITY_CHECK(IsNoCORSAllowedContext(m_requestContext, |
251 request.skipServiceWorker())); | 252 request.getServiceWorkerMode())); |
252 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNoCORS); | 253 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNoCORS); |
253 break; | 254 break; |
254 } | 255 } |
255 if (m_resourceLoaderOptions.allowCredentials == AllowStoredCredentials) { | 256 if (m_resourceLoaderOptions.allowCredentials == AllowStoredCredentials) { |
256 newRequest.setFetchCredentialsMode( | 257 newRequest.setFetchCredentialsMode( |
257 WebURLRequest::FetchCredentialsModeInclude); | 258 WebURLRequest::FetchCredentialsModeInclude); |
258 } else { | 259 } else { |
259 newRequest.setFetchCredentialsMode( | 260 newRequest.setFetchCredentialsMode( |
260 WebURLRequest::FetchCredentialsModeSameOrigin); | 261 WebURLRequest::FetchCredentialsModeSameOrigin); |
261 } | 262 } |
262 } | 263 } |
263 | 264 |
264 // We assume that ServiceWorker is skipped for sync requests and unsupported | 265 // We assume that ServiceWorker is skipped for sync requests and unsupported |
265 // protocol requests by content/ code. | 266 // protocol requests by content/ code. |
266 if (m_async && | 267 if (m_async && |
267 request.skipServiceWorker() == WebURLRequest::SkipServiceWorker::None && | 268 request.getServiceWorkerMode() == WebURLRequest::ServiceWorkerMode::All && |
268 SchemeRegistry::shouldTreatURLSchemeAsAllowingServiceWorkers( | 269 SchemeRegistry::shouldTreatURLSchemeAsAllowingServiceWorkers( |
269 request.url().protocol()) && | 270 request.url().protocol()) && |
270 m_document->fetcher()->isControlledByServiceWorker()) { | 271 m_document->fetcher()->isControlledByServiceWorker()) { |
271 if (newRequest.fetchRequestMode() == WebURLRequest::FetchRequestModeCORS || | 272 if (newRequest.fetchRequestMode() == WebURLRequest::FetchRequestModeCORS || |
272 newRequest.fetchRequestMode() == | 273 newRequest.fetchRequestMode() == |
273 WebURLRequest::FetchRequestModeCORSWithForcedPreflight) { | 274 WebURLRequest::FetchRequestModeCORSWithForcedPreflight) { |
274 m_fallbackRequestForServiceWorker = ResourceRequest(request); | 275 m_fallbackRequestForServiceWorker = ResourceRequest(request); |
275 // m_fallbackRequestForServiceWorker is used when a regular controlling | 276 // m_fallbackRequestForServiceWorker is used when a regular controlling |
276 // service worker doesn't handle a cross origin request. When this happens | 277 // service worker doesn't handle a cross origin request. When this happens |
277 // we still want to give foreign fetch a chance to handle the request, so | 278 // we still want to give foreign fetch a chance to handle the request, so |
278 // only skip the controlling service worker for the fallback request. This | 279 // only skip the controlling service worker for the fallback request. This |
279 // is currently safe because of http://crbug.com/604084 the | 280 // is currently safe because of http://crbug.com/604084 the |
280 // wasFallbackRequiredByServiceWorker flag is never set when foreign fetch | 281 // wasFallbackRequiredByServiceWorker flag is never set when foreign fetch |
281 // handled a request. | 282 // handled a request. |
282 m_fallbackRequestForServiceWorker.setSkipServiceWorker( | 283 m_fallbackRequestForServiceWorker.setServiceWorkerMode( |
283 WebURLRequest::SkipServiceWorker::Controlling); | 284 WebURLRequest::ServiceWorkerMode::Foreign); |
284 } | 285 } |
285 loadRequest(newRequest, m_resourceLoaderOptions); | 286 loadRequest(newRequest, m_resourceLoaderOptions); |
286 return; | 287 return; |
287 } | 288 } |
288 | 289 |
289 dispatchInitialRequest(newRequest); | 290 dispatchInitialRequest(newRequest); |
290 } | 291 } |
291 | 292 |
292 void DocumentThreadableLoader::dispatchInitialRequest( | 293 void DocumentThreadableLoader::dispatchInitialRequest( |
293 const ResourceRequest& request) { | 294 const ResourceRequest& request) { |
(...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
367 // example, referrer. We need to accept them. For security, we must reject | 368 // example, referrer. We need to accept them. For security, we must reject |
368 // forbidden headers/methods at the point we accept user's input. Not here. | 369 // forbidden headers/methods at the point we accept user's input. Not here. |
369 if (!request.isExternalRequest() && | 370 if (!request.isExternalRequest() && |
370 ((m_options.preflightPolicy == ConsiderPreflight && | 371 ((m_options.preflightPolicy == ConsiderPreflight && |
371 FetchUtils::isSimpleOrForbiddenRequest(request.httpMethod(), | 372 FetchUtils::isSimpleOrForbiddenRequest(request.httpMethod(), |
372 request.httpHeaderFields())) || | 373 request.httpHeaderFields())) || |
373 m_options.preflightPolicy == PreventPreflight)) { | 374 m_options.preflightPolicy == PreventPreflight)) { |
374 prepareCrossOriginRequest(crossOriginRequest); | 375 prepareCrossOriginRequest(crossOriginRequest); |
375 loadRequest(crossOriginRequest, crossOriginOptions); | 376 loadRequest(crossOriginRequest, crossOriginOptions); |
376 } else { | 377 } else { |
377 // Explicitly set the SkipServiceWorker flag here. Although the page is not | 378 // Explicitly set the ServiceWorkerMode to None here. Although the page is |
378 // controlled by a SW at this point, a new SW may be controlling the page | 379 // not controlled by a SW at this point, a new SW may be controlling the |
379 // when this request gets sent later. We should not send the actual request | 380 // page when this request gets sent later. We should not send the actual |
380 // to the SW. https://crbug.com/604583 | 381 // request to the SW. https://crbug.com/604583 |
381 // Similarly we don't want any requests that could involve a CORS preflight | 382 // Similarly we don't want any requests that could involve a CORS preflight |
382 // to get intercepted by a foreign fetch service worker, even if we have the | 383 // to get intercepted by a foreign fetch service worker, even if we have the |
383 // result of the preflight cached already. https://crbug.com/674370 | 384 // result of the preflight cached already. https://crbug.com/674370 |
384 crossOriginRequest.setSkipServiceWorker( | 385 crossOriginRequest.setServiceWorkerMode( |
385 WebURLRequest::SkipServiceWorker::All); | 386 WebURLRequest::ServiceWorkerMode::None); |
386 | 387 |
387 bool shouldForcePreflight = | 388 bool shouldForcePreflight = |
388 request.isExternalRequest() || | 389 request.isExternalRequest() || |
389 InspectorInstrumentation::shouldForceCORSPreflight(m_document); | 390 InspectorInstrumentation::shouldForceCORSPreflight(m_document); |
390 bool canSkipPreflight = | 391 bool canSkipPreflight = |
391 CrossOriginPreflightResultCache::shared().canSkipPreflight( | 392 CrossOriginPreflightResultCache::shared().canSkipPreflight( |
392 getSecurityOrigin()->toString(), crossOriginRequest.url(), | 393 getSecurityOrigin()->toString(), crossOriginRequest.url(), |
393 effectiveAllowCredentials(), crossOriginRequest.httpMethod(), | 394 effectiveAllowCredentials(), crossOriginRequest.httpMethod(), |
394 crossOriginRequest.httpHeaderFields()); | 395 crossOriginRequest.httpHeaderFields()); |
395 if (canSkipPreflight && !shouldForcePreflight) { | 396 if (canSkipPreflight && !shouldForcePreflight) { |
(...skipping 753 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1149 } | 1150 } |
1150 | 1151 |
1151 DEFINE_TRACE(DocumentThreadableLoader) { | 1152 DEFINE_TRACE(DocumentThreadableLoader) { |
1152 visitor->trace(m_resource); | 1153 visitor->trace(m_resource); |
1153 visitor->trace(m_document); | 1154 visitor->trace(m_document); |
1154 ThreadableLoader::trace(visitor); | 1155 ThreadableLoader::trace(visitor); |
1155 RawResourceClient::trace(visitor); | 1156 RawResourceClient::trace(visitor); |
1156 } | 1157 } |
1157 | 1158 |
1158 } // namespace blink | 1159 } // namespace blink |
OLD | NEW |