Consider the Access-Control-Allow-Origin header for Background Fetch

content/browser/background_fetch/background_fetch_data_manager.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/background_fetch/background_fetch_data_manager.h"
 
 #include <algorithm>
 #include <queue>
 
 #include "base/memory/ptr_util.h"
 #include "content/browser/background_fetch/background_fetch_constants.h"
 #include "content/browser/background_fetch/background_fetch_context.h"
+#include "content/browser/background_fetch/background_fetch_cross_origin_filter.h"
 #include "content/browser/background_fetch/background_fetch_request_info.h"
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
 #include "content/public/browser/blob_handle.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_item.h"
 #include "third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerResponseType.h"
 
 namespace content {
 
@@ skipping 176 matching lines @@
 
   std::vector<BackgroundFetchSettledFetch> settled_fetches;
   settled_fetches.reserve(requests.size());
 
   std::vector<std::unique_ptr<BlobHandle>> blob_handles;
 
   for (const auto& request : requests) {
     BackgroundFetchSettledFetch settled_fetch;
     settled_fetch.request = request->fetch_request();
 
-    // TODO(peter): Find the appropriate way to generalize CORS security checks.
-    const bool opaque = !registration_id.origin().IsSameOriginWith(
-        url::Origin(request->GetURLChain().back().GetOrigin()));
+    // The |filter| decides which values can be passed on to the Service Worker.
+    BackgroundFetchCrossOriginFilter filter(registration_id.origin(), *request);
 
     settled_fetch.response.url_list = request->GetURLChain();
     settled_fetch.response.response_type =
         blink::kWebServiceWorkerResponseTypeDefault;
 
-    if (!opaque) {
+    // Include the status code, status text and the response's body as a blob
+    // when this is allowed by the CORS protocol.
+    if (filter.CanPopulateBody()) {
       settled_fetch.response.status_code = request->GetResponseCode();
       settled_fetch.response.status_text = request->GetResponseText();
       settled_fetch.response.headers.insert(
           request->GetResponseHeaders().begin(),
           request->GetResponseHeaders().end());
 
-      // Include the response data as a blob backed by the downloaded file.
       if (request->GetFileSize() > 0) {
         DCHECK(!request->GetFilePath().empty());
         std::unique_ptr<BlobHandle> blob_handle =
             blob_storage_context_->CreateFileBackedBlob(
                 request->GetFilePath(), 0 /* offset */, request->GetFileSize(),
                 base::Time() /* expected_modification_time */);
 
         // TODO(peter): Appropriately handle !blob_handle
         if (blob_handle) {
           settled_fetch.response.blob_uuid = blob_handle->GetUUID();
@@ skipping 23 matching lines @@
     std::move(callback).Run(blink::mojom::BackgroundFetchError::INVALID_TAG);
     return;
   }
 
   registrations_.erase(iter);
 
   std::move(callback).Run(blink::mojom::BackgroundFetchError::NONE);
 }
 
 }  // namespace content