Make net::DataURL's MIME string check stricter

content/child/web_url_loader_impl.cc

Index: content/child/web_url_loader_impl.cc
diff --git a/content/child/web_url_loader_impl.cc b/content/child/web_url_loader_impl.cc
index 18d8b82cce2dd465e40bf4685394354474523339..9c3578b8a3e6d28d3aa9fd4f00651061f0f86ebd 100644
--- a/content/child/web_url_loader_impl.cc
+++ b/content/child/web_url_loader_impl.cc
@@ -137,7 +137,19 @@ bool GetInfoFromDataURL(const GURL& url,
     info->load_timing.request_start_time = now;
     info->request_time = now;
     info->response_time = now;
-    info->headers = NULL;
+
+    scoped_refptr<net::HttpResponseHeaders> headers(
+        new net::HttpResponseHeaders(std::string()));
+    headers->ReplaceStatusLine("HTTP/1.1 200 OK");
+    DCHECK(!mime_type.empty());
+    DCHECK(!charset.empty());
+    std::string content_type_header =
+        "Content-Type: " + mime_type + ";charset=" + charset;

[abarth-chromium, 2014/03/24 16:40:30]

Do we know that mime_type and charset are such that they're not going to break
the grammar of the Content-Type header?

[tyoshino (SeeGerritForStatus), 2014/03/26 17:34:07]

Added mime_type grammar check in net::DataURL::Parse() and charset grammar check
here respectively because data URL RFC says nothing about charset grammar.

Also added unittests.

+    headers->AddHeader(content_type_header);
+    headers->AddHeader("Access-Control-Allow-Origin: *");
+    headers->AddHeader("Access-Control-Allow-Credentials: true");

[abarth-chromium, 2014/03/24 16:40:30]

I don't think you can combine Access-Control-Allow-Origin: * with
Access-Control-Allow-Credentials: true.  That's forbidden by the CORS spec.

[tyoshino (SeeGerritForStatus), 2014/03/24 19:36:58]

robwu@ suggested this change in #21. With
https://codereview.chromium.org/192573011/ and this, Blink can parse data URI
even with withCredentials=true. Otherwise, we need to make some change in Blink
side.

As you suggested that we enable data URI access while keeping it treated as
cross-origin in this comment https://codereview.chromium.org/54173002/#msg2
(when reviewing this patch
https://codereview.chromium.org/54173002/diff/50001/Source/core/loader/Docume...),
I've been trying to address withCredentials issue also by Chromium side
annotation.

Another approach is
- remember that the request was data URI in
DocumentThreadableLoader::loadRequest
- instruct passesAccessControlCheck() to skip credentials check in
DocumentThreadableLoader::didReceiveResponse when the request was data URI

Or it also makes sense, I think, that we rather silently override
allowCredentials of the ThreadableLoaderOptions in XMLHttpRequest::createRequest
when URI is data.

Please tell me you idea about layering.

+    info->headers = headers;
+
     info->mime_type.swap(mime_type);
     info->charset.swap(charset);
     info->security_info.clear();