For media element fetches, remove user:pass components always.

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 852 matching lines @@
                     m_mediaSource = nullptr;
                     attemptLoad = false;
                 }
             }
         }
     }
 
     if (attemptLoad && canLoadURL(url, contentType, keySystem)) {
         ASSERT(!webMediaPlayer());
 
-        if (m_preload == MediaPlayer::None) {
+        if (m_preload == MediaPlayer::None)
             m_delayingLoadForPreloadNone = true;
-        } else {
-            m_player->load(loadType(), m_currentSrc, corsMode());
-        }
+        else
+            startPlayerLoad();
     } else {
         mediaLoadingFailed(MediaPlayer::FormatError);
     }
 
     // If there is no poster to display, allow the media engine to render video frames as soon as
     // they are available.
     updateDisplayState();
 
     if (renderer())
         renderer()->updateFromElement();
 }
 
+void HTMLMediaElement::startPlayerLoad()
+{
+    // Filter out user:pass as those two URL components aren't
+    // considered for media resource fetches (including for the CORS
+    // use-credentials mode.) That behavior aligns with Gecko, with IE
+    // being more restrictive and not allowing fetches to such URLs.
+    //
+    // Spec reference: http://whatwg.org/c/#concept-media-load-resource
+    //
+    // FIXME: when the HTML spec switches to specifying resource
+    // fetches in terms of Fetch (http://fetch.spec.whatwg.org), and
+    // along with that potentially also specifying a setting for its
+    // 'authentication flag' to control how user:pass embedded in a
+    // media resource URL should be treated, then update the handling
+    // here to match.
+    KURL requestURL = m_currentSrc;
+    if (!requestURL.user().isEmpty())
+        requestURL.setUser(String());
+    if (!requestURL.pass().isEmpty())
+        requestURL.setPass(String());
+
+    m_player->load(loadType(), requestURL, corsMode());
+}
+
 void HTMLMediaElement::setPlayerPreload()
 {
     m_player->setPreload(m_preload);
 
     if (m_delayingLoadForPreloadNone && m_preload != MediaPlayer::None)
         startDelayedLoad();
 }
 
 void HTMLMediaElement::startDelayedLoad()
 {
     ASSERT(m_delayingLoadForPreloadNone);
 
     m_delayingLoadForPreloadNone = false;
 
-    m_player->load(loadType(), m_currentSrc, corsMode());
+    startPlayerLoad();
 }
 
 WebMediaPlayer::LoadType HTMLMediaElement::loadType() const
 {
     if (m_mediaSource)
         return WebMediaPlayer::LoadTypeMediaSource;
 
     if (isMediaStreamURL(m_currentSrc.string()))
         return WebMediaPlayer::LoadTypeMediaStream;
 
@@ skipping 2696 matching lines @@
 {
     visitor->trace(m_currentSourceNode);
     visitor->trace(m_nextChildNodeToConsider);
     visitor->trace(m_textTracks);
     visitor->trace(m_textTracksWhenResourceSelectionBegan);
     WillBeHeapSupplementable<HTMLMediaElement>::trace(visitor);
     HTMLElement::trace(visitor);
 }
 
 }