| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. |
| 3 * Copyright (C) 2013, Intel Corporation | 3 * Copyright (C) 2013, Intel Corporation |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions are | 6 * modification, are permitted provided that the following conditions are |
| 7 * met: | 7 * met: |
| 8 * | 8 * |
| 9 * * Redistributions of source code must retain the above copyright | 9 * * Redistributions of source code must retain the above copyright |
| 10 * notice, this list of conditions and the following disclaimer. | 10 * notice, this list of conditions and the following disclaimer. |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 94 WeakPtrFactory<EmptyDataReader> m_factory; | 94 WeakPtrFactory<EmptyDataReader> m_factory; |
| 95 }; | 95 }; |
| 96 | 96 |
| 97 std::unique_ptr<Reader> obtainReader(Client* client) override { | 97 std::unique_ptr<Reader> obtainReader(Client* client) override { |
| 98 return WTF::makeUnique<EmptyDataReader>(client); | 98 return WTF::makeUnique<EmptyDataReader>(client); |
| 99 } | 99 } |
| 100 const char* debugName() const override { return "EmptyDataHandle"; } | 100 const char* debugName() const override { return "EmptyDataHandle"; } |
| 101 }; | 101 }; |
| 102 | 102 |
| 103 // No-CORS requests are allowed for all these contexts, and plugin contexts with | 103 // No-CORS requests are allowed for all these contexts, and plugin contexts with |
| 104 // private permission when we set skipServiceWorker flag in PepperURLLoaderHost. | 104 // private permission when we set ServiceWorkerMode to None in |
| 105 // PepperURLLoaderHost. |
| 105 bool IsNoCORSAllowedContext( | 106 bool IsNoCORSAllowedContext( |
| 106 WebURLRequest::RequestContext context, | 107 WebURLRequest::RequestContext context, |
| 107 WebURLRequest::SkipServiceWorker skipServiceWorker) { | 108 WebURLRequest::ServiceWorkerMode serviceWorkerMode) { |
| 108 switch (context) { | 109 switch (context) { |
| 109 case WebURLRequest::RequestContextAudio: | 110 case WebURLRequest::RequestContextAudio: |
| 110 case WebURLRequest::RequestContextVideo: | 111 case WebURLRequest::RequestContextVideo: |
| 111 case WebURLRequest::RequestContextObject: | 112 case WebURLRequest::RequestContextObject: |
| 112 case WebURLRequest::RequestContextFavicon: | 113 case WebURLRequest::RequestContextFavicon: |
| 113 case WebURLRequest::RequestContextImage: | 114 case WebURLRequest::RequestContextImage: |
| 114 case WebURLRequest::RequestContextScript: | 115 case WebURLRequest::RequestContextScript: |
| 115 case WebURLRequest::RequestContextWorker: | 116 case WebURLRequest::RequestContextWorker: |
| 116 case WebURLRequest::RequestContextSharedWorker: | 117 case WebURLRequest::RequestContextSharedWorker: |
| 117 return true; | 118 return true; |
| 118 case WebURLRequest::RequestContextPlugin: | 119 case WebURLRequest::RequestContextPlugin: |
| 119 return skipServiceWorker == WebURLRequest::SkipServiceWorker::All; | 120 return serviceWorkerMode == WebURLRequest::ServiceWorkerMode::None; |
| 120 default: | 121 default: |
| 121 return false; | 122 return false; |
| 122 } | 123 } |
| 123 } | 124 } |
| 124 | 125 |
| 125 } // namespace | 126 } // namespace |
| 126 | 127 |
| 127 // Max number of CORS redirects handled in DocumentThreadableLoader. Same number | 128 // Max number of CORS redirects handled in DocumentThreadableLoader. Same number |
| 128 // as net/url_request/url_request.cc, and same number as | 129 // as net/url_request/url_request.cc, and same number as |
| 129 // https://fetch.spec.whatwg.org/#concept-http-fetch, Step 4. | 130 // https://fetch.spec.whatwg.org/#concept-http-fetch, Step 4. |
| (...skipping 111 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 241 case UseAccessControl: | 242 case UseAccessControl: |
| 242 if (m_options.preflightPolicy == ForcePreflight) { | 243 if (m_options.preflightPolicy == ForcePreflight) { |
| 243 newRequest.setFetchRequestMode( | 244 newRequest.setFetchRequestMode( |
| 244 WebURLRequest::FetchRequestModeCORSWithForcedPreflight); | 245 WebURLRequest::FetchRequestModeCORSWithForcedPreflight); |
| 245 } else { | 246 } else { |
| 246 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS); | 247 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS); |
| 247 } | 248 } |
| 248 break; | 249 break; |
| 249 case AllowCrossOriginRequests: | 250 case AllowCrossOriginRequests: |
| 250 SECURITY_CHECK(IsNoCORSAllowedContext(m_requestContext, | 251 SECURITY_CHECK(IsNoCORSAllowedContext(m_requestContext, |
| 251 request.skipServiceWorker())); | 252 request.getServiceWorkerMode())); |
| 252 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNoCORS); | 253 newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNoCORS); |
| 253 break; | 254 break; |
| 254 } | 255 } |
| 255 if (m_resourceLoaderOptions.allowCredentials == AllowStoredCredentials) { | 256 if (m_resourceLoaderOptions.allowCredentials == AllowStoredCredentials) { |
| 256 newRequest.setFetchCredentialsMode( | 257 newRequest.setFetchCredentialsMode( |
| 257 WebURLRequest::FetchCredentialsModeInclude); | 258 WebURLRequest::FetchCredentialsModeInclude); |
| 258 } else { | 259 } else { |
| 259 newRequest.setFetchCredentialsMode( | 260 newRequest.setFetchCredentialsMode( |
| 260 WebURLRequest::FetchCredentialsModeSameOrigin); | 261 WebURLRequest::FetchCredentialsModeSameOrigin); |
| 261 } | 262 } |
| 262 } | 263 } |
| 263 | 264 |
| 264 // We assume that ServiceWorker is skipped for sync requests and unsupported | 265 // We assume that ServiceWorker is skipped for sync requests and unsupported |
| 265 // protocol requests by content/ code. | 266 // protocol requests by content/ code. |
| 266 if (m_async && | 267 if (m_async && |
| 267 request.skipServiceWorker() == WebURLRequest::SkipServiceWorker::None && | 268 request.getServiceWorkerMode() == WebURLRequest::ServiceWorkerMode::All && |
| 268 SchemeRegistry::shouldTreatURLSchemeAsAllowingServiceWorkers( | 269 SchemeRegistry::shouldTreatURLSchemeAsAllowingServiceWorkers( |
| 269 request.url().protocol()) && | 270 request.url().protocol()) && |
| 270 m_document->fetcher()->isControlledByServiceWorker()) { | 271 m_document->fetcher()->isControlledByServiceWorker()) { |
| 271 if (newRequest.fetchRequestMode() == WebURLRequest::FetchRequestModeCORS || | 272 if (newRequest.fetchRequestMode() == WebURLRequest::FetchRequestModeCORS || |
| 272 newRequest.fetchRequestMode() == | 273 newRequest.fetchRequestMode() == |
| 273 WebURLRequest::FetchRequestModeCORSWithForcedPreflight) { | 274 WebURLRequest::FetchRequestModeCORSWithForcedPreflight) { |
| 274 m_fallbackRequestForServiceWorker = ResourceRequest(request); | 275 m_fallbackRequestForServiceWorker = ResourceRequest(request); |
| 275 // m_fallbackRequestForServiceWorker is used when a regular controlling | 276 // m_fallbackRequestForServiceWorker is used when a regular controlling |
| 276 // service worker doesn't handle a cross origin request. When this happens | 277 // service worker doesn't handle a cross origin request. When this happens |
| 277 // we still want to give foreign fetch a chance to handle the request, so | 278 // we still want to give foreign fetch a chance to handle the request, so |
| 278 // only skip the controlling service worker for the fallback request. This | 279 // only skip the controlling service worker for the fallback request. This |
| 279 // is currently safe because of http://crbug.com/604084 the | 280 // is currently safe because of http://crbug.com/604084 the |
| 280 // wasFallbackRequiredByServiceWorker flag is never set when foreign fetch | 281 // wasFallbackRequiredByServiceWorker flag is never set when foreign fetch |
| 281 // handled a request. | 282 // handled a request. |
| 282 m_fallbackRequestForServiceWorker.setSkipServiceWorker( | 283 m_fallbackRequestForServiceWorker.setServiceWorkerMode( |
| 283 WebURLRequest::SkipServiceWorker::Controlling); | 284 WebURLRequest::ServiceWorkerMode::Foreign); |
| 284 } | 285 } |
| 285 loadRequest(newRequest, m_resourceLoaderOptions); | 286 loadRequest(newRequest, m_resourceLoaderOptions); |
| 286 return; | 287 return; |
| 287 } | 288 } |
| 288 | 289 |
| 289 dispatchInitialRequest(newRequest); | 290 dispatchInitialRequest(newRequest); |
| 290 } | 291 } |
| 291 | 292 |
| 292 void DocumentThreadableLoader::dispatchInitialRequest( | 293 void DocumentThreadableLoader::dispatchInitialRequest( |
| 293 const ResourceRequest& request) { | 294 const ResourceRequest& request) { |
| (...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 367 // example, referrer. We need to accept them. For security, we must reject | 368 // example, referrer. We need to accept them. For security, we must reject |
| 368 // forbidden headers/methods at the point we accept user's input. Not here. | 369 // forbidden headers/methods at the point we accept user's input. Not here. |
| 369 if (!request.isExternalRequest() && | 370 if (!request.isExternalRequest() && |
| 370 ((m_options.preflightPolicy == ConsiderPreflight && | 371 ((m_options.preflightPolicy == ConsiderPreflight && |
| 371 FetchUtils::isSimpleOrForbiddenRequest(request.httpMethod(), | 372 FetchUtils::isSimpleOrForbiddenRequest(request.httpMethod(), |
| 372 request.httpHeaderFields())) || | 373 request.httpHeaderFields())) || |
| 373 m_options.preflightPolicy == PreventPreflight)) { | 374 m_options.preflightPolicy == PreventPreflight)) { |
| 374 prepareCrossOriginRequest(crossOriginRequest); | 375 prepareCrossOriginRequest(crossOriginRequest); |
| 375 loadRequest(crossOriginRequest, crossOriginOptions); | 376 loadRequest(crossOriginRequest, crossOriginOptions); |
| 376 } else { | 377 } else { |
| 377 // Explicitly set the SkipServiceWorker flag here. Although the page is not | 378 // Explicitly set the ServiceWorkerMode to None here. Although the page is |
| 378 // controlled by a SW at this point, a new SW may be controlling the page | 379 // not controlled by a SW at this point, a new SW may be controlling the |
| 379 // when this request gets sent later. We should not send the actual request | 380 // page when this request gets sent later. We should not send the actual |
| 380 // to the SW. https://crbug.com/604583 | 381 // request to the SW. https://crbug.com/604583 |
| 381 // Similarly we don't want any requests that could involve a CORS preflight | 382 // Similarly we don't want any requests that could involve a CORS preflight |
| 382 // to get intercepted by a foreign fetch service worker, even if we have the | 383 // to get intercepted by a foreign fetch service worker, even if we have the |
| 383 // result of the preflight cached already. https://crbug.com/674370 | 384 // result of the preflight cached already. https://crbug.com/674370 |
| 384 crossOriginRequest.setSkipServiceWorker( | 385 crossOriginRequest.setServiceWorkerMode( |
| 385 WebURLRequest::SkipServiceWorker::All); | 386 WebURLRequest::ServiceWorkerMode::None); |
| 386 | 387 |
| 387 bool shouldForcePreflight = | 388 bool shouldForcePreflight = |
| 388 request.isExternalRequest() || | 389 request.isExternalRequest() || |
| 389 InspectorInstrumentation::shouldForceCORSPreflight(m_document); | 390 InspectorInstrumentation::shouldForceCORSPreflight(m_document); |
| 390 bool canSkipPreflight = | 391 bool canSkipPreflight = |
| 391 CrossOriginPreflightResultCache::shared().canSkipPreflight( | 392 CrossOriginPreflightResultCache::shared().canSkipPreflight( |
| 392 getSecurityOrigin()->toString(), crossOriginRequest.url(), | 393 getSecurityOrigin()->toString(), crossOriginRequest.url(), |
| 393 effectiveAllowCredentials(), crossOriginRequest.httpMethod(), | 394 effectiveAllowCredentials(), crossOriginRequest.httpMethod(), |
| 394 crossOriginRequest.httpHeaderFields()); | 395 crossOriginRequest.httpHeaderFields()); |
| 395 if (canSkipPreflight && !shouldForcePreflight) { | 396 if (canSkipPreflight && !shouldForcePreflight) { |
| (...skipping 753 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1149 } | 1150 } |
| 1150 | 1151 |
| 1151 DEFINE_TRACE(DocumentThreadableLoader) { | 1152 DEFINE_TRACE(DocumentThreadableLoader) { |
| 1152 visitor->trace(m_resource); | 1153 visitor->trace(m_resource); |
| 1153 visitor->trace(m_document); | 1154 visitor->trace(m_document); |
| 1154 ThreadableLoader::trace(visitor); | 1155 ThreadableLoader::trace(visitor); |
| 1155 RawResourceClient::trace(visitor); | 1156 RawResourceClient::trace(visitor); |
| 1156 } | 1157 } |
| 1157 | 1158 |
| 1158 } // namespace blink | 1159 } // namespace blink |
| OLD | NEW |