For media element fetches, remove user:pass components always.

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 852 matching lines @@
                     m_mediaSource = nullptr;
                     attemptLoad = false;
                 }
             }
         }
     }
 
     if (attemptLoad && canLoadURL(url, contentType, keySystem)) {
         ASSERT(!webMediaPlayer());
 
-        if (m_preload == MediaPlayer::None) {
+        if (m_preload == MediaPlayer::None)
             m_delayingLoadForPreloadNone = true;
-        } else {
-            m_player->load(loadType(), m_currentSrc, corsMode());
-        }
+        else
+            startLoad();

[acolwell GONE FROM CHROMIUM, 2014/05/16 17:32:19]

nit: s/startLoad/startPlayerLoad/ just to make it clear that this isn't
referring to the HTMLMediaElement load()

[sof, 2014/05/16 19:51:31]

That's a clearer name, thanks.

     } else {
         mediaLoadingFailed(MediaPlayer::FormatError);
     }
 
     // If there is no poster to display, allow the media engine to render video frames as soon as
     // they are available.
     updateDisplayState();
 
     if (renderer())
         renderer()->updateFromElement();
 }
 
+void HTMLMediaElement::startLoad()
+{
+    // Filter out user:pass as the information isn't supplied for
+    // media resource fetches (including CORS use-credentials).
+    // Compatible behavior, and what the embedder currently does

[Nate Chapin, 2014/05/16 16:55:36]

Grammar Nit: I'm not 100% sure I've read this correctly. Should this be "This is
compatible behavior, ...", referring to the last sentence?

[sof, 2014/05/16 19:51:31]

I tried to make the comment minimal, but compressed it too much, I suppose.
Expanded it a bit, and hopefully also clearer.

+    // regardless.

[acolwell GONE FROM CHROMIUM, 2014/05/16 17:32:19]

Please put relevant spec references for this behavior.

[sof, 2014/05/16 19:51:31]

Done, but the treatment of these URL forms isn't (yet) covered by the spec.
Fetch does cover this, we just have to wait for the HTML spec to "fetch-ify" its
various resource fetch algorithms. Expanded the FIXME to make that clear.

+    //
+    // FIXME: when the spec switches to being Fetch-based, and
+    // explicitly sets the authentication flag, adjust handling.
+    KURL requestURL = m_currentSrc;
+    if (!requestURL.user().isEmpty())
+        requestURL.setUser(String());
+    if (!requestURL.pass().isEmpty())
+        requestURL.setPass(String());
+
+    m_player->load(loadType(), requestURL, corsMode());
+}
+
 void HTMLMediaElement::setPlayerPreload()
 {
     m_player->setPreload(m_preload);
 
     if (m_delayingLoadForPreloadNone && m_preload != MediaPlayer::None)
         startDelayedLoad();
 }
 
 void HTMLMediaElement::startDelayedLoad()
 {
     ASSERT(m_delayingLoadForPreloadNone);
 
     m_delayingLoadForPreloadNone = false;
 
-    m_player->load(loadType(), m_currentSrc, corsMode());
+    startLoad();
 }
 
 WebMediaPlayer::LoadType HTMLMediaElement::loadType() const
 {
     if (m_mediaSource)
         return WebMediaPlayer::LoadTypeMediaSource;
 
     if (isMediaStreamURL(m_currentSrc.string()))
         return WebMediaPlayer::LoadTypeMediaStream;
 
@@ skipping 2696 matching lines @@
 {
     visitor->trace(m_currentSourceNode);
     visitor->trace(m_nextChildNodeToConsider);
     visitor->trace(m_textTracks);
     visitor->trace(m_textTracksWhenResourceSelectionBegan);
     WillBeHeapSupplementable<HTMLMediaElement>::trace(visitor);
     HTMLElement::trace(visitor);
 }
 
 }