Index: Source/modules/serviceworkers/ServiceWorkerContainer.cpp |
diff --git a/Source/modules/serviceworkers/ServiceWorkerContainer.cpp b/Source/modules/serviceworkers/ServiceWorkerContainer.cpp |
index 4ff54d1bd11d1b975e50308788614944896fb173..7967890dffcb968ba03c2ea8007ecbc647ba5452 100644 |
--- a/Source/modules/serviceworkers/ServiceWorkerContainer.cpp |
+++ b/Source/modules/serviceworkers/ServiceWorkerContainer.cpp |
@@ -135,6 +135,11 @@ ScriptPromise ServiceWorkerContainer::registerServiceWorker(ScriptState* scriptS |
return promise; |
} |
+ if (!patternURL.string().startsWith(scriptURL.baseAsString())) { |
+ resolver->reject(DOMException::create(SecurityError, "The scope must be under the directory of the script URL.")); |
+ return promise; |
+ } |
+ |
m_provider->registerServiceWorker(patternURL, scriptURL, new CallbackPromiseAdapter<ServiceWorkerRegistration, ServiceWorkerError>(resolver)); |
return promise; |