| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. |
| 3 * Copyright (C) 2013, Intel Corporation | 3 * Copyright (C) 2013, Intel Corporation |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions are | 6 * modification, are permitted provided that the following conditions are |
| 7 * met: | 7 * met: |
| 8 * | 8 * |
| 9 * * Redistributions of source code must retain the above copyright | 9 * * Redistributions of source code must retain the above copyright |
| 10 * notice, this list of conditions and the following disclaimer. | 10 * notice, this list of conditions and the following disclaimer. |
| (...skipping 232 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 243 | 243 |
| 244 RefPtr<DocumentThreadableLoader> protect(this); | 244 RefPtr<DocumentThreadableLoader> protect(this); |
| 245 | 245 |
| 246 // FIXME: Support redirect in Fetch API. | 246 // FIXME: Support redirect in Fetch API. |
| 247 if (resource->resourceRequest().requestContext() == blink::WebURLRequest::Re
questContextFetch) { | 247 if (resource->resourceRequest().requestContext() == blink::WebURLRequest::Re
questContextFetch) { |
| 248 m_client->didFailRedirectCheck(); | 248 m_client->didFailRedirectCheck(); |
| 249 request = ResourceRequest(); | 249 request = ResourceRequest(); |
| 250 return; | 250 return; |
| 251 } | 251 } |
| 252 | 252 |
| 253 if (!isAllowedByPolicy(request.url())) { | 253 if (!isAllowedByContentSecurityPolicy(request.url())) { |
| 254 m_client->didFailRedirectCheck(); | 254 m_client->didFailRedirectCheck(); |
| 255 request = ResourceRequest(); | 255 request = ResourceRequest(); |
| 256 m_requestStartedSeconds = 0.0; | 256 m_requestStartedSeconds = 0.0; |
| 257 return; | 257 return; |
| 258 } | 258 } |
| 259 | 259 |
| 260 // Allow same origin requests to continue after allowing clients to audit th
e redirect. | 260 // Allow same origin requests to continue after allowing clients to audit th
e redirect. |
| 261 if (isAllowedRedirect(request.url())) { | 261 if (isAllowedRedirect(request.url())) { |
| 262 if (m_client->isDocumentThreadableLoaderClient()) | 262 if (m_client->isDocumentThreadableLoaderClient()) |
| 263 static_cast<DocumentThreadableLoaderClient*>(m_client)->willSendRequ
est(request, redirectResponse); | 263 static_cast<DocumentThreadableLoaderClient*>(m_client)->willSendRequ
est(request, redirectResponse); |
| (...skipping 290 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 554 // No exception for file:/// resources, see <rdar://problem/4962298>. | 554 // No exception for file:/// resources, see <rdar://problem/4962298>. |
| 555 // Also, if we have an HTTP response, then it wasn't a network error in fact
. | 555 // Also, if we have an HTTP response, then it wasn't a network error in fact
. |
| 556 if (!error.isNull() && !requestURL.isLocalFile() && response.httpStatusCode(
) <= 0) { | 556 if (!error.isNull() && !requestURL.isLocalFile() && response.httpStatusCode(
) <= 0) { |
| 557 m_client->didFail(error); | 557 m_client->didFail(error); |
| 558 return; | 558 return; |
| 559 } | 559 } |
| 560 | 560 |
| 561 // FIXME: A synchronous request does not tell us whether a redirect happened
or not, so we guess by comparing the | 561 // FIXME: A synchronous request does not tell us whether a redirect happened
or not, so we guess by comparing the |
| 562 // request and response URLs. This isn't a perfect test though, since a serv
er can serve a redirect to the same URL that was | 562 // request and response URLs. This isn't a perfect test though, since a serv
er can serve a redirect to the same URL that was |
| 563 // requested. Also comparing the request and response URLs as strings will f
ail if the requestURL still has its credentials. | 563 // requested. Also comparing the request and response URLs as strings will f
ail if the requestURL still has its credentials. |
| 564 if (requestURL != response.url() && (!isAllowedByPolicy(response.url()) || !
isAllowedRedirect(response.url()))) { | 564 if (requestURL != response.url() && (!isAllowedByContentSecurityPolicy(respo
nse.url()) || !isAllowedRedirect(response.url()))) { |
| 565 m_client->didFailRedirectCheck(); | 565 m_client->didFailRedirectCheck(); |
| 566 return; | 566 return; |
| 567 } | 567 } |
| 568 | 568 |
| 569 handleResponse(identifier, response); | 569 handleResponse(identifier, response); |
| 570 | 570 |
| 571 SharedBuffer* data = resource->resourceBuffer(); | 571 SharedBuffer* data = resource->resourceBuffer(); |
| 572 if (data) | 572 if (data) |
| 573 handleReceivedData(data->data(), data->size()); | 573 handleReceivedData(data->data(), data->size()); |
| 574 | 574 |
| 575 handleSuccessfulFinish(identifier, 0.0); | 575 handleSuccessfulFinish(identifier, 0.0); |
| 576 } | 576 } |
| 577 | 577 |
| 578 bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url) const | 578 bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url) const |
| 579 { | 579 { |
| 580 if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) | 580 if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) |
| 581 return true; | 581 return true; |
| 582 | 582 |
| 583 return m_sameOriginRequest && securityOrigin()->canRequest(url); | 583 return m_sameOriginRequest && securityOrigin()->canRequest(url); |
| 584 } | 584 } |
| 585 | 585 |
| 586 bool DocumentThreadableLoader::isAllowedByPolicy(const KURL& url) const | 586 bool DocumentThreadableLoader::isAllowedByContentSecurityPolicy(const KURL& url)
const |
| 587 { | 587 { |
| 588 if (m_options.contentSecurityPolicyEnforcement != EnforceConnectSrcDirective
) | 588 if (m_options.contentSecurityPolicyEnforcement != EnforceConnectSrcDirective
) |
| 589 return true; | 589 return true; |
| 590 return m_document.contentSecurityPolicy()->allowConnectToSource(url); | 590 return m_document.contentSecurityPolicy()->allowConnectToSource(url); |
| 591 } | 591 } |
| 592 | 592 |
| 593 StoredCredentials DocumentThreadableLoader::effectiveAllowCredentials() const | 593 StoredCredentials DocumentThreadableLoader::effectiveAllowCredentials() const |
| 594 { | 594 { |
| 595 if (m_forceDoNotAllowStoredCredentials) | 595 if (m_forceDoNotAllowStoredCredentials) |
| 596 return DoNotAllowStoredCredentials; | 596 return DoNotAllowStoredCredentials; |
| 597 return m_resourceLoaderOptions.allowCredentials; | 597 return m_resourceLoaderOptions.allowCredentials; |
| 598 } | 598 } |
| 599 | 599 |
| 600 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const | 600 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const |
| 601 { | 601 { |
| 602 return m_securityOrigin ? m_securityOrigin.get() : m_document.securityOrigin
(); | 602 return m_securityOrigin ? m_securityOrigin.get() : m_document.securityOrigin
(); |
| 603 } | 603 } |
| 604 | 604 |
| 605 } // namespace blink | 605 } // namespace blink |
| OLD | NEW |