| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. | 2 * Copyright (C) 2008 Apple Inc. All Rights Reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
| 8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
| 9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
| 10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
| (...skipping 454 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 465 "' contains a username and password, which is disallowed for" | 465 "' contains a username and password, which is disallowed for" |
| 466 " cross-origin requests."); | 466 " cross-origin requests."); |
| 467 return; | 467 return; |
| 468 } | 468 } |
| 469 default: | 469 default: |
| 470 NOTREACHED(); | 470 NOTREACHED(); |
| 471 } | 471 } |
| 472 } | 472 } |
| 473 | 473 |
| 474 bool CrossOriginAccessControl::HandleRedirect( | 474 bool CrossOriginAccessControl::HandleRedirect( |
| 475 PassRefPtr<SecurityOrigin> security_origin, | 475 RefPtr<SecurityOrigin> current_security_origin, |
| 476 ResourceRequest& new_request, | 476 ResourceRequest& new_request, |
| 477 const ResourceResponse& redirect_response, | 477 const ResourceResponse& redirect_response, |
| 478 StoredCredentials with_credentials, | 478 StoredCredentials with_credentials, |
| 479 ResourceLoaderOptions& options, | 479 ResourceLoaderOptions& options, |
| 480 String& error_message) { | 480 String& error_message) { |
| 481 // http://www.w3.org/TR/cors/#redirect-steps terminology: | 481 // http://www.w3.org/TR/cors/#redirect-steps terminology: |
| 482 const KURL& last_url = redirect_response.Url(); | 482 const KURL& last_url = redirect_response.Url(); |
| 483 const KURL& new_url = new_request.Url(); | 483 const KURL& new_url = new_request.Url(); |
| 484 | 484 |
| 485 RefPtr<SecurityOrigin> current_security_origin = security_origin; | |
| 486 | |
| 487 RefPtr<SecurityOrigin> new_security_origin = current_security_origin; | 485 RefPtr<SecurityOrigin> new_security_origin = current_security_origin; |
| 488 | 486 |
| 489 // TODO(tyoshino): This should be fixed to check not only the last one but | 487 // TODO(tyoshino): This should be fixed to check not only the last one but |
| 490 // all redirect responses. | 488 // all redirect responses. |
| 491 if (!current_security_origin->CanRequest(last_url)) { | 489 if (!current_security_origin->CanRequest(last_url)) { |
| 492 // Follow http://www.w3.org/TR/cors/#redirect-steps | 490 // Follow http://www.w3.org/TR/cors/#redirect-steps |
| 493 CrossOriginAccessControl::RedirectStatus redirect_status = | 491 CrossOriginAccessControl::RedirectStatus redirect_status = |
| 494 CrossOriginAccessControl::CheckRedirectLocation(new_url); | 492 CrossOriginAccessControl::CheckRedirectLocation(new_url); |
| 495 if (redirect_status != kRedirectSuccess) { | 493 if (redirect_status != kRedirectSuccess) { |
| 496 StringBuilder builder; | 494 StringBuilder builder; |
| (...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 537 // | 535 // |
| 538 // This is equivalent to the step 2 in | 536 // This is equivalent to the step 2 in |
| 539 // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch | 537 // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch |
| 540 if (options.credentials_requested == kClientDidNotRequestCredentials) | 538 if (options.credentials_requested == kClientDidNotRequestCredentials) |
| 541 options.allow_credentials = kDoNotAllowStoredCredentials; | 539 options.allow_credentials = kDoNotAllowStoredCredentials; |
| 542 } | 540 } |
| 543 return true; | 541 return true; |
| 544 } | 542 } |
| 545 | 543 |
| 546 } // namespace blink | 544 } // namespace blink |
| OLD | NEW |