Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(888)

Unified Diff: Source/core/fetch/ResourceFetcher.cpp

Issue 954233003: Enable SRI only for same origin and CORS content. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Rebase on ToT Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: Source/core/fetch/ResourceFetcher.cpp
diff --git a/Source/core/fetch/ResourceFetcher.cpp b/Source/core/fetch/ResourceFetcher.cpp
index 4539a04d838e6c3a7fd524cee244a31cc4aa923b..2062e2450b13190262a097886484ba2afcc56aef 100644
--- a/Source/core/fetch/ResourceFetcher.cpp
+++ b/Source/core/fetch/ResourceFetcher.cpp
@@ -582,7 +582,7 @@ bool ResourceFetcher::canRequest(Resource::Type type, const ResourceRequest& res
return !MixedContentChecker::shouldBlockFetch(effectiveFrame, resourceRequest, url, mixedContentReporting);
}
-bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url) const
+bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url, AccessControlLoggingDecision logErrorsDecision) const
{
// Redirects can change the response URL different from one of request.
if (!canRequest(resource->type(), resource->resourceRequest(), url, resource->options(), resource->isUnusedPreload(), FetchRequest::UseDefaultOriginRestrictionForType))
@@ -598,7 +598,7 @@ bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sour
if (!resource->passesAccessControlCheck(document(), sourceOrigin, errorDescription)) {
if (resource->type() == Resource::Font)
toFontResource(resource)->setCORSFailed();
- if (frame() && frame()->document()) {
+ if ((logErrorsDecision == ShouldLogAccessControlErrors) && frame() && frame()->document()) {
String resourceType = Resource::resourceTypeToString(resource->type(), resource->options().initiatorInfo);
frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, resourceType + " from origin '" + SecurityOrigin::create(url)->toString() + "' has been blocked from loading by Cross-Origin Resource Sharing policy: " + errorDescription));
}

Powered by Google App Engine
This is Rietveld 408576698