Make net::DataURL's MIME string check stricter

content/child/web_url_loader_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // An implementation of WebURLLoader in terms of ResourceLoaderBridge.
 
 #include "content/child/web_url_loader_impl.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
@@ skipping 119 matching lines @@
   std::string mime_type;
   std::string charset;
   if (net::DataURL::Parse(url, &mime_type, &charset, data)) {
     *error_code = net::OK;
     // Assure same time for all time fields of data: URLs.
     Time now = Time::Now();
     info->load_timing.request_start = TimeTicks::Now();
     info->load_timing.request_start_time = now;
     info->request_time = now;
     info->response_time = now;
-    info->headers = NULL;
+
+    scoped_refptr<net::HttpResponseHeaders> headers(
+        new net::HttpResponseHeaders(std::string()));
+    headers->ReplaceStatusLine("HTTP/1.1 200 OK");
+    DCHECK(!mime_type.empty());
+    DCHECK(!charset.empty());
+    std::string content_type_header =
+        "Content-Type: " + mime_type + ";charset=" + charset;

[abarth-chromium, 2014/03/24 16:40:30]

Do we know that mime_type and charset are such that they're not going to break
the grammar of the Content-Type header?

[tyoshino (SeeGerritForStatus), 2014/03/26 17:34:07]

Added mime_type grammar check in net::DataURL::Parse() and charset grammar check
here respectively because data URL RFC says nothing about charset grammar.

Also added unittests.

+    headers->AddHeader(content_type_header);
+    headers->AddHeader("Access-Control-Allow-Origin: *");
+    headers->AddHeader("Access-Control-Allow-Credentials: true");

[abarth-chromium, 2014/03/24 16:40:30]

I don't think you can combine Access-Control-Allow-Origin: * with
Access-Control-Allow-Credentials: true.  That's forbidden by the CORS spec.

[tyoshino (SeeGerritForStatus), 2014/03/24 19:36:58]

robwu@ suggested this change in #21. With
https://codereview.chromium.org/192573011/ and this, Blink can parse data URI
even with withCredentials=true. Otherwise, we need to make some change in Blink
side.

As you suggested that we enable data URI access while keeping it treated as
cross-origin in this comment https://codereview.chromium.org/54173002/#msg2
(when reviewing this patch
https://codereview.chromium.org/54173002/diff/50001/Source/core/loader/Docume...),
I've been trying to address withCredentials issue also by Chromium side
annotation.

Another approach is
- remember that the request was data URI in
DocumentThreadableLoader::loadRequest
- instruct passesAccessControlCheck() to skip credentials check in
DocumentThreadableLoader::didReceiveResponse when the request was data URI

Or it also makes sense, I think, that we rather silently override
allowCredentials of the ThreadableLoaderOptions in XMLHttpRequest::createRequest
when URI is data.

Please tell me you idea about layering.

+    info->headers = headers;
+
     info->mime_type.swap(mime_type);
     info->charset.swap(charset);
     info->security_info.clear();
     info->content_length = data->length();
     info->encoded_data_length = 0;
 
     return true;
   }
 
   *error_code = net::ERR_INVALID_URL;
@@ skipping 715 matching lines @@
 
 void WebURLLoaderImpl::setDefersLoading(bool value) {
   context_->SetDefersLoading(value);
 }
 
 void WebURLLoaderImpl::didChangePriority(WebURLRequest::Priority new_priority) {
   context_->DidChangePriority(new_priority);
 }
 
 }  // namespace content