Make net::DataURL's MIME string check stricter

webkit/child/weburlloader_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // An implementation of WebURLLoader in terms of ResourceLoaderBridge.
 
 #include "webkit/child/weburlloader_impl.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
@@ skipping 114 matching lines @@
   std::string mime_type;
   std::string charset;
   if (net::DataURL::Parse(url, &mime_type, &charset, data)) {
     *error_code = net::OK;
     // Assure same time for all time fields of data: URLs.
     Time now = Time::Now();
     info->load_timing.request_start = TimeTicks::Now();
     info->load_timing.request_start_time = now;
     info->request_time = now;
     info->response_time = now;
-    info->headers = NULL;
+
+    scoped_refptr<net::HttpResponseHeaders> headers(
+        new net::HttpResponseHeaders(std::string()));
+    headers->ReplaceStatusLine("HTTP/1.1 200 OK");
+    DCHECK(!mime_type.empty());
+    DCHECK(!charset.empty());
+    std::string content_type_header =
+        "Content-Type: " + mime_type + ";charset=" + charset;
+    headers->AddHeader(content_type_header);
+    headers->AddHeader("Access-Control-Allow-Origin: *");

[sof, 2013/11/22 21:42:35]

Thinking about this a bit more, this will work as a device for getting past the
resource sharing check for anonymous CORS requests. It won't work for
credentialled requests.

[tyoshino (SeeGerritForStatus), 2014/03/11 06:40:37]

Right. When withCredentials is set, the response must be with the
Access-Control-Allow-Origin header with a value of the origin of the request.

I don't come up with any use case (or some case where it's convenient) of XHR
with data URL and with withCredentials set. So, I'd like to just adopt this
method. WDYT?

+    info->headers = headers;
+
     info->mime_type.swap(mime_type);
     info->charset.swap(charset);
     info->security_info.clear();
     info->content_length = data->length();
     info->encoded_data_length = 0;
 
     return true;
   }
 
   *error_code = net::ERR_INVALID_URL;
@@ skipping 699 matching lines @@
 
 void WebURLLoaderImpl::setDefersLoading(bool value) {
   context_->SetDefersLoading(value);
 }
 
 void WebURLLoaderImpl::didChangePriority(WebURLRequest::Priority new_priority) {
   context_->DidChangePriority(new_priority);
 }
 
 }  // namespace webkit_glue