Merge 96610 - Resource loader should block HTTP redirects to local resources

Source/WebCore/loader/MainResourceLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer. 
@@ skipping 164 matching lines @@
     // deferrals plays less of a part in this function in preventing the bad behavior deferring 
     // callbacks is meant to prevent.
     ASSERT(!newRequest.isNull());
 
     // The additional processing can do anything including possibly removing the last
     // reference to this object; one example of this is 3266216.
     RefPtr<MainResourceLoader> protect(this);
 
     ASSERT(documentLoader()->timing()->fetchStart);
     if (!redirectResponse.isNull()) {
+        // If the redirecting url is not allowed to display content from the target origin,
+        // then block the redirect.
+        RefPtr<SecurityOrigin> redirectingOrigin = SecurityOrigin::create(redirectResponse.url());
+        if (!redirectingOrigin->canDisplay(newRequest.url())) {
+            FrameLoader::reportLocalLoadFailed(m_frame.get(), newRequest.url().string());
+            cancel();
+            return;
+        }
+
         DocumentLoadTiming* documentLoadTiming = documentLoader()->timing();
 
         // Check if the redirected url is allowed to access the redirecting url's timing information.
         RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(newRequest.url());
         if (!securityOrigin->canRequest(redirectResponse.url()))
             documentLoadTiming->hasCrossOriginRedirect = true;
 
         documentLoadTiming->redirectCount++;
         if (!documentLoadTiming->redirectStart)
             documentLoadTiming->redirectStart = documentLoadTiming->fetchStart;
@@ skipping 442 matching lines @@
             startDataLoadTimer();
         else {
             ResourceRequest r(m_initialRequest);
             m_initialRequest = ResourceRequest();
             loadNow(r);
         }
     }
 }
 
 }