Give the RequestFetcher access to cross-origin URLs when allowed

Source/web/tests/WebFrameTest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 32 matching lines @@
 #include "core/dom/FullscreenElementStack.h"
 #include "core/dom/Range.h"
 #include "core/editing/Editor.h"
 #include "core/editing/FrameSelection.h"
 #include "core/editing/SpellChecker.h"
 #include "core/editing/VisiblePosition.h"
 #include "core/events/MouseEvent.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
+#include "core/html/HTMLDocument.h"
 #include "core/html/HTMLFormElement.h"
+#include "core/loader/DocumentThreadableLoader.h"
+#include "core/loader/DocumentThreadableLoaderClient.h"
 #include "core/loader/FrameLoadRequest.h"
+#include "core/loader/ThreadableLoader.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Page.h"
 #include "core/rendering/HitTestResult.h"
 #include "core/rendering/RenderView.h"
 #include "core/rendering/TextAutosizer.h"
 #include "core/rendering/compositing/RenderLayerCompositor.h"
 #include "platform/DragImage.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/geometry/FloatRect.h"
 #include "platform/network/ResourceError.h"
 #include "platform/scroll/ScrollbarTheme.h"
+#include "platform/weborigin/SchemeRegistry.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebFloatRect.h"
 #include "public/platform/WebThread.h"
 #include "public/platform/WebURL.h"
 #include "public/platform/WebURLResponse.h"
 #include "public/platform/WebUnitTestSupport.h"
 #include "public/web/WebDataSource.h"
 #include "public/web/WebDocument.h"
 #include "public/web/WebFindOptions.h"
 #include "public/web/WebFormElement.h"
@@ skipping 5530 matching lines @@
     EXPECT_TRUE(client.didNotify());
     EXPECT_EQ(0xff0000ff, frame->document().brandColor());
     // Change of second brand-color meta tag will not change frame's brand
     // color.
     client.reset();
     frame->executeScript(WebScriptSource("document.getElementById('bc2').setAttribute('content', '#00FF00');"));
     EXPECT_TRUE(client.didNotify());
     EXPECT_EQ(0xff0000ff, frame->document().brandColor());
 }
 
+class MockDocumentThreadableLoaderClient : public WebCore::DocumentThreadableLoaderClient {
+public:
+    MockDocumentThreadableLoaderClient() : m_failed(false) { }
+    virtual void didFail(const WebCore::ResourceError&) OVERRIDE { m_failed = true;}
+
+    void reset() { m_failed = false; }
+    bool failed() { return m_failed; }
+
+    bool m_failed;
+};
+
+// FIXME: This would be better as a unittest on DocumentThreadableLoader but it
+// requires spin-up of a frame. It may be possible to remove that requirement

[Nate Chapin, 2014/07/07 17:24:52]

FWIW, this is a nearly universal problem with anything in core/loader/ or
core/fetch/.

+// and convert it to a unittest.
+TEST_F(WebFrameTest, LoaderOriginAccess)
+{
+    FrameTestHelpers::WebViewHelper webViewHelper;
+    webViewHelper.initializeAndLoad("about:blank");
+
+    WebCore::SchemeRegistry::registerURLSchemeAsDisplayIsolated("chrome");
+
+    // Cross-origin request.
+    WebCore::KURL resourceUrl(WebCore::ParsedURLString, "chrome://test.pdf");
+    registerMockedChromeURLLoad("test.pdf");
+
+    RefPtr<WebCore::LocalFrame> frame = toLocalFrame(webViewHelper.webViewImpl()->page()->mainFrame());
+
+    MockDocumentThreadableLoaderClient client;
+    WebCore::ThreadableLoaderOptions options;
+
+    // First try to load the request with regular access. Should fail.
+    options.crossOriginRequestPolicy = WebCore::UseAccessControl;
+    WebCore::ResourceLoaderOptions resourceLoaderOptions;
+    WebCore::DocumentThreadableLoader::loadResourceSynchronously(
+        *frame->document(), WebCore::ResourceRequest(resourceUrl), client, options, resourceLoaderOptions);
+    EXPECT_TRUE(client.failed());
+
+    client.reset();
+    // Try to load the request with cross origin access. Should succeed.
+    options.crossOriginRequestPolicy = WebCore::AllowCrossOriginRequests;
+    WebCore::DocumentThreadableLoader::loadResourceSynchronously(
+        *frame->document(), WebCore::ResourceRequest(resourceUrl), client, options, resourceLoaderOptions);
+    EXPECT_FALSE(client.failed());
+}
+
 } // namespace