Make net::DataURL's MIME string check stricter

webkit/child/weburlloader_impl.cc

Index: webkit/child/weburlloader_impl.cc
diff --git a/webkit/child/weburlloader_impl.cc b/webkit/child/weburlloader_impl.cc
index 27092d5c62d4f430160d8e1c862916e85b8b4446..212e6965b5d491db2e1cc5d834e95720febd0ea8 100644
--- a/webkit/child/weburlloader_impl.cc
+++ b/webkit/child/weburlloader_impl.cc
@@ -132,7 +132,18 @@ bool GetInfoFromDataURL(const GURL& url,
     info->load_timing.request_start_time = now;
     info->request_time = now;
     info->response_time = now;
-    info->headers = NULL;
+
+    scoped_refptr<net::HttpResponseHeaders> headers(
+        new net::HttpResponseHeaders(std::string()));
+    headers->ReplaceStatusLine("HTTP/1.1 200 OK");
+    DCHECK(!mime_type.empty());
+    DCHECK(!charset.empty());
+    std::string content_type_header =
+        "Content-Type: " + mime_type + ";charset=" + charset;
+    headers->AddHeader(content_type_header);
+    headers->AddHeader("Access-Control-Allow-Origin: *");

[sof, 2013/11/22 21:42:35]

Thinking about this a bit more, this will work as a device for getting past the
resource sharing check for anonymous CORS requests. It won't work for
credentialled requests.

[tyoshino (SeeGerritForStatus), 2014/03/11 06:40:37]

Right. When withCredentials is set, the response must be with the
Access-Control-Allow-Origin header with a value of the origin of the request.

I don't come up with any use case (or some case where it's convenient) of XHR
with data URL and with withCredentials set. So, I'd like to just adopt this
method. WDYT?

+    info->headers = headers;
+
     info->mime_type.swap(mime_type);
     info->charset.swap(charset);
     info->security_info.clear();