| Index: Source/web/AssociatedURLLoader.cpp
|
| diff --git a/Source/web/AssociatedURLLoader.cpp b/Source/web/AssociatedURLLoader.cpp
|
| index 2d6cfa86c028f9c58cc6f9ca384b76b046fd7869..2741df942976ec4eef083ba02cd95d4eb5ce1d44 100644
|
| --- a/Source/web/AssociatedURLLoader.cpp
|
| +++ b/Source/web/AssociatedURLLoader.cpp
|
| @@ -32,6 +32,7 @@
|
| #include "web/AssociatedURLLoader.h"
|
|
|
| #include "core/fetch/CrossOriginAccessControl.h"
|
| +#include "core/fetch/FetchUtils.h"
|
| #include "core/loader/DocumentThreadableLoader.h"
|
| #include "core/loader/DocumentThreadableLoaderClient.h"
|
| #include "core/xml/XMLHttpRequest.h"
|
| @@ -71,7 +72,7 @@ private:
|
|
|
| void HTTPRequestHeaderValidator::visitHeader(const WebString& name, const WebString& value)
|
| {
|
| - m_isSafe = m_isSafe && isValidHTTPToken(name) && XMLHttpRequest::isAllowedHTTPHeader(name) && isValidHTTPHeaderValue(value);
|
| + m_isSafe = m_isSafe && isValidHTTPToken(name) && !FetchUtils::isForbiddenHeaderName(name) && isValidHTTPHeaderValue(value);
|
| }
|
|
|
| // FIXME: Remove this and use WebCore code that does the same thing.
|
| @@ -326,7 +327,7 @@ void AssociatedURLLoader::loadAsynchronously(const WebURLRequest& request, WebUR
|
| WebURLRequest newRequest(request);
|
| if (m_options.untrustedHTTP) {
|
| WebString method = newRequest.httpMethod();
|
| - allowLoad = isValidHTTPToken(method) && XMLHttpRequest::isAllowedHTTPMethod(method);
|
| + allowLoad = isValidHTTPToken(method) && FetchUtils::isUsefulMethod(method);
|
| if (allowLoad) {
|
| newRequest.setHTTPMethod(XMLHttpRequest::uppercaseKnownHTTPMethod(method));
|
| HTTPRequestHeaderValidator validator;
|
|
|