Changeset 230681 in webkit


Ignore:
Timestamp:
Apr 16, 2018 2:50:26 PM (6 years ago)
Author:
youenn@apple.com
Message:

Use NetworkLoadChecker to handle synchronous HTTP loads
​https://bugs.webkit.org/show_bug.cgi?id=184240

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

  • web-platform-tests/cors/request-headers-expected.txt:
  • web-platform-tests/XMLHttpRequest/access-control-and-redirects-expected.txt:
  • web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt:
  • web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt:

Source/WebCore:

Update LoaderStrategy::loadResourceSynchronously to pass FetchOptions directly.
Update various call sites accordingly. This allows NetworkProcess to do all necessary checks.
Add an option to disable security checks if NetworkProcess does it for WebProcess.
This option will be also used for regular asynchronous loads in future patches.

Update DocumentThreadableLoader to bypass preflighting and response validation checks in case they are done in NetworkProcess.

Covered by existing and rebased tests.

  • loader/CrossOriginPreflightChecker.cpp:

(WebCore::CrossOriginPreflightChecker::doPreflight):

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
(WebCore::DocumentThreadableLoader::loadRequest):

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadResourceSynchronously):

  • loader/FrameLoader.h:
  • loader/LoaderStrategy.h:
  • xml/XSLTProcessorLibxslt.cpp:

(WebCore::docLoaderFunc):

  • xml/parser/XMLDocumentParserLibxml2.cpp:

(WebCore::openFunc):

Source/WebKit:

For every NetworkResourceLoader synchronous load, we create a NetworkLoadChecker.
NetworkLoadChecker handles all security checks in that case.
This allows supporting cross-origin loads for synchronous XHR.

Updated NetworkCORSPreflightChecker to return the result as a ResourceError.
This is used to convey any error message from NetworkProcess to the JS console.
Ensure NetworkCORSPreflightChecker computes correctly Access-Control-Request-Headers value
by providing the headers set by the application plus Referrer/Origin.

  • NetworkProcess/NetworkCORSPreflightChecker.cpp:

(WebKit::NetworkCORSPreflightChecker::~NetworkCORSPreflightChecker):
(WebKit::NetworkCORSPreflightChecker::willPerformHTTPRedirection):
(WebKit::NetworkCORSPreflightChecker::didReceiveChallenge):
(WebKit::NetworkCORSPreflightChecker::didCompleteWithError):
(WebKit::NetworkCORSPreflightChecker::wasBlocked):
(WebKit::NetworkCORSPreflightChecker::cannotShowURL):

  • NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::checkCORSRequestWithPreflight):

  • NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::NetworkResourceLoader):
(WebKit::NetworkResourceLoader::retrieveCacheEntry):
(WebKit::NetworkResourceLoader::didReceiveResponse):
(WebKit::NetworkResourceLoader::willSendRedirectedRequest):
(WebKit::NetworkResourceLoader::continueWillSendRequest):
(WebKit::NetworkResourceLoader::didRetrieveCacheEntry):
(WebKit::NetworkResourceLoader::validateCacheEntry):

  • NetworkProcess/NetworkResourceLoader.h:
  • WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::loadResourceSynchronously):

  • WebProcess/Network/WebLoaderStrategy.h:

Source/WebKitLegacy:

  • WebCoreSupport/WebResourceLoadScheduler.cpp:

(WebResourceLoadScheduler::loadResourceSynchronously):

  • WebCoreSupport/WebResourceLoadScheduler.h:

LayoutTests:

  • http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt:
  • http/wpt/beacon/cors/cors-preflight-blob-failure.html: Fix buggy assertion.

Test should check for actual request header and not header name in Access-Control-Request-Headers.

  • http/wpt/beacon/cors/cors-preflight-blob-success.html: Ditto.
  • platform/mac-wk1/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt: Added.
  • platform/mac-wk1/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt: Added.
  • platform/mac-wk1/http/tests/xmlhttprequest/cross-origin-no-authorization-expected.txt: Added.
  • platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/access-control-and-redirects-expected.txt: Added.
  • platform/win/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt: Added.
  • platform/win/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt: Added.
  • platform/win/http/tests/xmlhttprequest/cross-origin-no-authorization-expected.txt: Added.
  • platform/mac-highsierra-wk2/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt.
  • platform/mac-highsierra-wk2/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt.
  • platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt.
  • platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt.
  • platform/mac-wk1/imported/w3c/web-platform-tests/cors/request-headers-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/cors/request-headers-expected.txt.
  • platform/win/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
  • platform/win/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt:
  • platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt.
  • platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt.
  • platform/win/imported/w3c/web-platform-tests/cors/request-headers-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/cors/request-headers-expected.txt.
Location:
trunk
Files:
6 added
29 edited
12 copied

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r230668 r230681  
     12018-04-16  Youenn Fablet  <youenn@apple.com>
     2
     3        Use NetworkLoadChecker to handle synchronous HTTP loads
     4        https://bugs.webkit.org/show_bug.cgi?id=184240
     5
     6        Reviewed by Chris Dumez.
     7
     8        * http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt:
     9        * http/wpt/beacon/cors/cors-preflight-blob-failure.html: Fix buggy assertion.
     10        Test should check for actual request header and not header name in Access-Control-Request-Headers.
     11        * http/wpt/beacon/cors/cors-preflight-blob-success.html: Ditto.
     12        * platform/mac-wk1/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt: Added.
     13        * platform/mac-wk1/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt: Added.
     14        * platform/mac-wk1/http/tests/xmlhttprequest/cross-origin-no-authorization-expected.txt: Added.
     15        * platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/access-control-and-redirects-expected.txt: Added.
     16        * platform/win/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt: Added.
     17        * platform/win/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt: Added.
     18        * platform/win/http/tests/xmlhttprequest/cross-origin-no-authorization-expected.txt: Added.
     19        * platform/mac-highsierra-wk2/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt.
     20        * platform/mac-highsierra-wk2/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt.
     21        * platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt.
     22        * platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt.
     23        * platform/mac-wk1/imported/w3c/web-platform-tests/cors/request-headers-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/cors/request-headers-expected.txt.
     24        * platform/win/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
     25        * platform/win/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt:
     26        * platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt.
     27        * platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt.
     28        * platform/win/imported/w3c/web-platform-tests/cors/request-headers-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/cors/request-headers-expected.txt.
     29
    1302018-04-16  Per Arne Vollan  <pvollan@apple.com>
    231

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt

    r219663 r230681  
    11CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    22CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi due to access control checks.
    3 CONSOLE MESSAGE: line 25: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
    43CONSOLE MESSAGE: Cross-origin redirection to http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    54CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi due to access control checks.

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt

    r219663 r230681  
    1 CONSOLE MESSAGE: line 26: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&access-control-allow-headers=x-webkit&access-control-allow-origin=*&url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
    21CONSOLE MESSAGE: line 26: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&access-control-allow-headers=x-webkit&access-control-allow-origin=*&url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi. Preflight response is not successful
    32CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&access-control-allow-headers=x-webkit&access-control-allow-origin=*&url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi. Preflight response is not successful
    … …  
    87Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&access-control-allow-headers=x-webkit&access-control-allow-origin=*&url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi (sync)
    98Expecting success: true
    10 FAIL: NetworkError:  A network error occurred.
     9PASS: PASS: Cross-domain access allowed.
     10
    1111Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&access-control-allow-headers=x-webkit&access-control-allow-origin=*&url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi(async)
    1212Expecting success: true

  • trunk/LayoutTests/http/wpt/beacon/cors/cors-preflight-blob-failure.html

    r220497 r230681  
    4040      let requested_headers = result['preflight_requested_headers'].toLowerCase()
    4141      assert_true(requested_headers.includes("content-type"), "Content-Type header is requested")
    42       assert_true(requested_headers.includes("referer"), "Referer header is requested")
    43       assert_true(requested_headers.includes("origin"), "Origin header is requested")
     42      assert_false(requested_headers.includes("referer"), "Referer header is requested")
     43      assert_false(requested_headers.includes("origin"), "Origin header is requested")
    4444      assert_equals(result['beacon'], 0, "Did not receive beacon")
    4545    });

  • trunk/LayoutTests/http/wpt/beacon/cors/cors-preflight-blob-success.html

    r220497 r230681  
    3737      assert_equals(result['preflight'], 1, "Received preflight")
    3838      assert_equals(result['preflight_referer'], document.URL, "Preflight referer header")
     39      assert_equals(result['preflight_origin'], 'http://localhost:8800', "Preflight origin header")
    3940      assert_equals(result['preflight_requested_method'], "POST", "Preflight requested method")
    4041      let requested_headers = result['preflight_requested_headers'].toLowerCase()
    4142      assert_true(requested_headers.includes("content-type"), "Content-Type header is requested")
    42       assert_true(requested_headers.includes("referer"), "Referer header is requested")
    43       assert_true(requested_headers.includes("origin"), "Origin header is requested")
     43      assert_false(requested_headers.includes("referer"), "Referer header is requested")
     44      assert_false(requested_headers.includes("origin"), "Origin header is requested")
    4445      assert_equals(result['beacon'], 1, "Received beacon")
    4546    });

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r230667 r230681  
     12018-04-16  Youenn Fablet  <youenn@apple.com>
     2
     3        Use NetworkLoadChecker to handle synchronous HTTP loads
     4        https://bugs.webkit.org/show_bug.cgi?id=184240
     5
     6        Reviewed by Chris Dumez.
     7
     8        * web-platform-tests/cors/request-headers-expected.txt:
     9        * web-platform-tests/XMLHttpRequest/access-control-and-redirects-expected.txt:
     10        * web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt:
     11        * web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt:
     12
    1132018-04-16  Antoine Quint  <graouts@apple.com>
    214

  • trunk/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/access-control-and-redirects-expected.txt

    r222307 r230681  
    1 CONSOLE MESSAGE: line 15: XMLHttpRequest cannot load http://127.0.0.1:8800/XMLHttpRequest/resources/redirect-cors.py?location=http://127.0.0.1:8800/XMLHttpRequest/resources/access-control-basic-allow.py&allow_origin=true. Cross-origin redirection denied by Cross-Origin Resource Sharing policy.
    21
    32FAIL Local sync redirect to remote origin  A network error occurred.
    43PASS Local async redirect to remote origin
    5 FAIL Remote sync redirect to local origin  A network error occurred.
     4PASS Remote sync redirect to local origin
    65PASS Remote async redirect to local origin
    7 FAIL Remote sync redirect to same remote origin  A network error occurred.
     6PASS Remote sync redirect to same remote origin
    87PASS Remote async redirect to same remote origin
    98

  • trunk/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader-expected.txt

    r215164 r230681  
    11Blocked access to external URL http://www1.localhost:8800/XMLHttpRequest/resources/auth2/corsenabled.py
    2 CONSOLE MESSAGE: line 26: XMLHttpRequest cannot load http://www1.localhost:8800/XMLHttpRequest/resources/auth2/corsenabled.py due to access control checks.
    32
    43FAIL XMLHttpRequest: send() - "Basic" authenticated CORS request using setRequestHeader() (expects to succeed)  A network error occurred.

  • trunk/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred-expected.txt

    r204117 r230681  
    11Blocked access to external URL http://www1.localhost:8800/XMLHttpRequest/resources/auth7/corsenabled.py
    2 CONSOLE MESSAGE: line 33: XMLHttpRequest cannot load http://www1.localhost:8800/XMLHttpRequest/resources/auth7/corsenabled.py due to access control checks.
    32Blocked access to external URL http://www1.localhost:8800/XMLHttpRequest/resources/auth8/corsenabled-no-authorize.py
    4 CONSOLE MESSAGE: line 33: XMLHttpRequest cannot load http://www1.localhost:8800/XMLHttpRequest/resources/auth8/corsenabled-no-authorize.py due to access control checks.
    53
    64FAIL CORS request with setRequestHeader auth to URL accepting Authorization header assert_true: responseText should contain the right user and password expected true got false

  • trunk/LayoutTests/imported/w3c/web-platform-tests/cors/request-headers-expected.txt

    r220731 r230681  
    11Blocked access to external URL http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=x-print
    2 CONSOLE MESSAGE: line 22: XMLHttpRequest cannot load http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=x-print due to access control checks.
    32Blocked access to external URL http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=x-print,
    4 CONSOLE MESSAGE: line 36: XMLHttpRequest cannot load http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=x-print, due to access control checks.
    53Blocked access to external URL http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=x-print
    6 CONSOLE MESSAGE: line 51: XMLHttpRequest cannot load http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=x-print due to access control checks.
    74Blocked access to external URL http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=,y-lol,x-PriNT,%20,,,Y-PRINT
    8 CONSOLE MESSAGE: line 59: XMLHttpRequest cannot load http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=,y-lol,x-PriNT,%20,,,Y-PRINT due to access control checks.
    95Blocked access to external URL http://www1.localhost:8800/cors/resources/cors-makeheader.py?headers=,y-lol,x-PriNT,%20,,,Y-PRINT
    106Request headers

  • trunk/Source/WebCore/ChangeLog

    r230679 r230681  
     12018-04-16  Youenn Fablet  <youenn@apple.com>
     2
     3        Use NetworkLoadChecker to handle synchronous HTTP loads
     4        https://bugs.webkit.org/show_bug.cgi?id=184240
     5
     6        Reviewed by Chris Dumez.
     7
     8        Update LoaderStrategy::loadResourceSynchronously to pass FetchOptions directly.
     9        Update various call sites accordingly. This allows NetworkProcess to do all necessary checks.
     10        Add an option to disable security checks if NetworkProcess does it for WebProcess.
     11        This option will be also used for regular asynchronous loads in future patches.
     12
     13        Update DocumentThreadableLoader to bypass preflighting and response validation checks in case they are done in NetworkProcess.
     14
     15        Covered by existing and rebased tests.
     16
     17        * loader/CrossOriginPreflightChecker.cpp:
     18        (WebCore::CrossOriginPreflightChecker::doPreflight):
     19        * loader/DocumentThreadableLoader.cpp:
     20        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
     21        (WebCore::DocumentThreadableLoader::loadRequest):
     22        * loader/FrameLoader.cpp:
     23        (WebCore::FrameLoader::loadResourceSynchronously):
     24        * loader/FrameLoader.h:
     25        * loader/LoaderStrategy.h:
     26        * xml/XSLTProcessorLibxslt.cpp:
     27        (WebCore::docLoaderFunc):
     28        * xml/parser/XMLDocumentParserLibxml2.cpp:
     29        (WebCore::openFunc):
     30
    1312018-04-16  Christopher Reid  <chris.reid@sony.com>
    232

  • trunk/Source/WebCore/loader/CrossOriginPreflightChecker.cpp

    r228241 r230681  
    131131    RefPtr<SharedBuffer> data;
    132132
    133     unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, StoredCredentialsPolicy::DoNotUse, ClientCredentialPolicy::CannotAskClientForCredentials, error, response, data);
     133    unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions { }, { }, error, response, data);
    134134
    135135    if (!error.isNull()) {

  • trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r229907 r230681  
    4545#include "InspectorInstrumentation.h"
    4646#include "LoadTiming.h"
     47#include "LoaderStrategy.h"
    4748#include "Performance.h"
    4849#include "ProgressTracker.h"
    … …  
    107108    ASSERT(m_async || m_referrer.isEmpty());
    108109
     110    // No need to do preflight if the network stack will do it for us.
     111    if (!m_async && platformStrategies()->loaderStrategy()->isDoingLoadingSecurityChecks())
     112        m_options.preflightPolicy = PreventPreflight;
     113
    109114    // Referrer and Origin headers should be set after the preflight if any.
    110115    ASSERT(!request.hasHTTPReferrer() && !request.hasHTTPOrigin());
    … …  
    117122
    118123    // Copy headers if we need to replay the request after a redirection.
    119     if (m_async && m_options.mode == FetchOptions::Mode::Cors)
     124    if (!m_async || m_options.mode == FetchOptions::Mode::Cors)
    120125        m_originalHeaders = request.httpHeaderFields();
    121126
    … …  
    510515        if (!frameLoader.mixedContentChecker().canRunInsecureContent(m_document.securityOrigin(), requestURL))
    511516            return;
    512         identifier = frameLoader.loadResourceSynchronously(request, m_options.storedCredentialsPolicy, m_options.clientCredentialPolicy, error, response, data);
     517        identifier = frameLoader.loadResourceSynchronously(request, m_options.clientCredentialPolicy, m_options, *m_originalHeaders, error, response, data);
    513518    }
    514519
    … …  
    527532    }
    528533
    529     // FIXME: FrameLoader::loadSynchronously() does not tell us whether a redirect happened or not, so we guess by comparing the
    530     // request and response URLs. This isn't a perfect test though, since a server can serve a redirect to the same URL that was
    531     // requested. Also comparing the request and response URLs as strings will fail if the requestURL still has its credentials.
    532     bool didRedirect = requestURL != response.url();
    533     if (didRedirect) {
    534         if (!isAllowedByContentSecurityPolicy(response.url(), ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
    535             reportContentSecurityPolicyError(requestURL);
    536             return;
    537         }
    538         if (!isAllowedRedirect(response.url())) {
    539             reportCrossOriginResourceSharingError(requestURL);
    540             return;
    541         }
    542     }
    543 
    544     if (!m_sameOriginRequest) {
    545         if (m_options.mode == FetchOptions::Mode::NoCors)
    546             response.setTainting(ResourceResponse::Tainting::Opaque);
    547         else {
    548             ASSERT(m_options.mode == FetchOptions::Mode::Cors);
    549             response.setTainting(ResourceResponse::Tainting::Cors);
    550             String accessControlErrorDescription;
    551             if (!passesAccessControlCheck(response, m_options.storedCredentialsPolicy, securityOrigin(), accessControlErrorDescription)) {
    552                 logErrorAndFail(ResourceError(errorDomainWebKitInternal, 0, response.url(), accessControlErrorDescription, ResourceError::Type::AccessControl));
     534    if (!platformStrategies()->loaderStrategy()->isDoingLoadingSecurityChecks()) {
     535        // FIXME: FrameLoader::loadSynchronously() does not tell us whether a redirect happened or not, so we guess by comparing the
     536        // request and response URLs. This isn't a perfect test though, since a server can serve a redirect to the same URL that was
     537        // requested. Also comparing the request and response URLs as strings will fail if the requestURL still has its credentials.
     538        bool didRedirect = requestURL != response.url();
     539        if (didRedirect) {
     540            if (!isAllowedByContentSecurityPolicy(response.url(), ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
     541                reportContentSecurityPolicyError(requestURL);
    553542                return;
     543            }
     544            if (!isAllowedRedirect(response.url())) {
     545                reportCrossOriginResourceSharingError(requestURL);
     546                return;
     547            }
     548        }
     549
     550        if (!m_sameOriginRequest) {
     551            if (m_options.mode == FetchOptions::Mode::NoCors)
     552                response.setTainting(ResourceResponse::Tainting::Opaque);
     553            else {
     554                ASSERT(m_options.mode == FetchOptions::Mode::Cors);
     555                response.setTainting(ResourceResponse::Tainting::Cors);
     556                String accessControlErrorDescription;
     557                if (!passesAccessControlCheck(response, m_options.storedCredentialsPolicy, securityOrigin(), accessControlErrorDescription)) {
     558                    logErrorAndFail(ResourceError(errorDomainWebKitInternal, 0, response.url(), accessControlErrorDescription, ResourceError::Type::AccessControl));
     559                    return;
     560                }
    554561            }
    555562        }

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r230676 r230681  
    28362836}
    28372837
    2838 unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentialsPolicy storedCredentialsPolicy, ClientCredentialPolicy clientCredentialPolicy, ResourceError& error, ResourceResponse& response, RefPtr<SharedBuffer>& data)
     2838unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, ClientCredentialPolicy clientCredentialPolicy, const FetchOptions& options, const HTTPHeaderMap& originalRequestHeaders, ResourceError& error, ResourceResponse& response, RefPtr<SharedBuffer>& data)
    28392839{
    28402840    ASSERT(m_frame.document());
    … …  
    28802880        if (!documentLoader()->applicationCacheHost().maybeLoadSynchronously(newRequest, error, response, data)) {
    28812881            Vector<char> buffer;
    2882             platformStrategies()->loaderStrategy()->loadResourceSynchronously(*this, identifier, newRequest, storedCredentialsPolicy, clientCredentialPolicy, error, response, buffer);
     2882            platformStrategies()->loaderStrategy()->loadResourceSynchronously(*this, identifier, newRequest, clientCredentialPolicy, options, originalRequestHeaders, error, response, buffer);
    28832883            data = SharedBuffer::create(WTFMove(buffer));
    28842884            documentLoader()->applicationCacheHost().maybeLoadFallbackSynchronously(newRequest, error, response, data);

  • trunk/Source/WebCore/loader/FrameLoader.h

    r230458 r230681  
    119119    WEBCORE_EXPORT void loadArchive(Ref<Archive>&&);
    120120#endif
    121     unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentialsPolicy, ClientCredentialPolicy, ResourceError&, ResourceResponse&, RefPtr<SharedBuffer>& data);
     121    unsigned long loadResourceSynchronously(const ResourceRequest&, ClientCredentialPolicy, const FetchOptions&, const HTTPHeaderMap&, ResourceError&, ResourceResponse&, RefPtr<SharedBuffer>& data);
    122122
    123123    void changeLocation(FrameLoadRequest&&);

  • trunk/Source/WebCore/loader/LoaderStrategy.h

    r230007 r230681  
    2626#pragma once
    2727
     28#include "FetchOptions.h"
    2829#include "ResourceLoadPriority.h"
    2930#include "ResourceLoaderOptions.h"
    … …  
    5657public:
    5758    virtual void loadResource(Frame&, CachedResource&, ResourceRequest&&, const ResourceLoaderOptions&, CompletionHandler<void(RefPtr<SubresourceLoader>&&)>&&) = 0;
    58     virtual void loadResourceSynchronously(FrameLoader&, unsigned long identifier, const ResourceRequest&, StoredCredentialsPolicy, ClientCredentialPolicy, ResourceError&, ResourceResponse&, Vector<char>& data) = 0;
     59    virtual void loadResourceSynchronously(FrameLoader&, unsigned long identifier, const ResourceRequest&, ClientCredentialPolicy, const FetchOptions&, const HTTPHeaderMap&, ResourceError&, ResourceResponse&, Vector<char>& data) = 0;
    5960
    6061    virtual void remove(ResourceLoader*) = 0;
    … …  
    7980    virtual void addOnlineStateChangeListener(WTF::Function<void(bool)>&&) = 0;
    8081
     82    virtual bool isDoingLoadingSecurityChecks() const { return false; }
     83
    8184protected:
    8285    virtual ~LoaderStrategy();

  • trunk/Source/WebCore/xml/XSLTProcessorLibxslt.cpp

    r223476 r230681  
    112112        bool requestAllowed = globalCachedResourceLoader->frame() && globalCachedResourceLoader->document()->securityOrigin().canRequest(url);
    113113        if (requestAllowed) {
    114             globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, StoredCredentialsPolicy::Use, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
     114            FetchOptions options;
     115            options.mode = FetchOptions::Mode::SameOrigin;
     116            options.credentials = FetchOptions::Credentials::Include;
     117            globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, ClientCredentialPolicy::MayAskClientForCredentials, options, { }, error, response, data);
    115118            if (error.isNull())
    116119                requestAllowed = globalCachedResourceLoader->document()->securityOrigin().canRequest(response.url());

  • trunk/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp

    r225731 r230681  
    449449        // FIXME: We should restore the original global error handler as well.
    450450
    451         if (cachedResourceLoader->frame())
    452             cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, StoredCredentialsPolicy::Use, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
     451        if (cachedResourceLoader->frame()) {
     452            FetchOptions options;
     453            options.mode = FetchOptions::Mode::SameOrigin;
     454            options.credentials = FetchOptions::Credentials::Include;
     455            cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, ClientCredentialPolicy::MayAskClientForCredentials, options, { }, error, response, data);
     456        }
    453457    }
    454458

  • trunk/Source/WebKit/ChangeLog

    r230675 r230681  
     12018-04-16  Youenn Fablet  <youenn@apple.com>
     2
     3        Use NetworkLoadChecker to handle synchronous HTTP loads
     4        https://bugs.webkit.org/show_bug.cgi?id=184240
     5
     6        Reviewed by Chris Dumez.
     7
     8        For every NetworkResourceLoader synchronous load, we create a NetworkLoadChecker.
     9        NetworkLoadChecker handles all security checks in that case.
     10        This allows supporting cross-origin loads for synchronous XHR.
     11
     12        Updated NetworkCORSPreflightChecker to return the result as a ResourceError.
     13        This is used to convey any error message from NetworkProcess to the JS console.
     14        Ensure NetworkCORSPreflightChecker computes correctly Access-Control-Request-Headers value
     15        by providing the headers set by the application plus Referrer/Origin.
     16
     17        * NetworkProcess/NetworkCORSPreflightChecker.cpp:
     18        (WebKit::NetworkCORSPreflightChecker::~NetworkCORSPreflightChecker):
     19        (WebKit::NetworkCORSPreflightChecker::willPerformHTTPRedirection):
     20        (WebKit::NetworkCORSPreflightChecker::didReceiveChallenge):
     21        (WebKit::NetworkCORSPreflightChecker::didCompleteWithError):
     22        (WebKit::NetworkCORSPreflightChecker::wasBlocked):
     23        (WebKit::NetworkCORSPreflightChecker::cannotShowURL):
     24        * NetworkProcess/NetworkLoadChecker.cpp:
     25        (WebKit::NetworkLoadChecker::checkCORSRequestWithPreflight):
     26        * NetworkProcess/NetworkResourceLoader.cpp:
     27        (WebKit::NetworkResourceLoader::NetworkResourceLoader):
     28        (WebKit::NetworkResourceLoader::retrieveCacheEntry):
     29        (WebKit::NetworkResourceLoader::didReceiveResponse):
     30        (WebKit::NetworkResourceLoader::willSendRedirectedRequest):
     31        (WebKit::NetworkResourceLoader::continueWillSendRequest):
     32        (WebKit::NetworkResourceLoader::didRetrieveCacheEntry):
     33        (WebKit::NetworkResourceLoader::validateCacheEntry):
     34        * NetworkProcess/NetworkResourceLoader.h:
     35        * WebProcess/Network/WebLoaderStrategy.cpp:
     36        (WebKit::WebLoaderStrategy::loadResourceSynchronously):
     37        * WebProcess/Network/WebLoaderStrategy.h:
     38
    1392018-04-16  Brian Burg  <bburg@apple.com>
    240

  • trunk/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp

    r230014 r230681  
    5454    }
    5555    if (m_completionCallback)
    56         m_completionCallback(Result::Canceled);
     56        m_completionCallback(ResourceError { ResourceError::Type::Cancellation });
    5757}
    5858
    … …  
    6363    NetworkLoadParameters loadParameters;
    6464    loadParameters.sessionID = m_parameters.sessionID;
    65     loadParameters.request = createAccessControlPreflightRequest(m_parameters.originalRequest, m_parameters.sourceOrigin, m_parameters.originalRequest.httpReferrer());
     65    loadParameters.request = createAccessControlPreflightRequest(m_parameters.originalRequest, m_parameters.sourceOrigin, m_parameters.referrer);
    6666    loadParameters.shouldFollowRedirects = false;
    6767    if (auto* networkSession = SessionTracker::networkSession(loadParameters.sessionID)) {
    … …  
    7272}
    7373
    74 void NetworkCORSPreflightChecker::willPerformHTTPRedirection(WebCore::ResourceResponse&&, WebCore::ResourceRequest&&, RedirectCompletionHandler&& completionHandler)
     74void NetworkCORSPreflightChecker::willPerformHTTPRedirection(WebCore::ResourceResponse&& response, WebCore::ResourceRequest&&, RedirectCompletionHandler&& completionHandler)
    7575{
    7676    RELEASE_LOG_IF_ALLOWED("willPerformHTTPRedirection");
    7777    completionHandler({ });
    78     m_completionCallback(Result::Failure);
     78    m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), ASCIILiteral("Preflight response is not successful"), ResourceError::Type::AccessControl });
    7979}
    8080
    … …  
    8383    RELEASE_LOG_IF_ALLOWED("didReceiveChallenge");
    8484    completionHandler(AuthenticationChallengeDisposition::Cancel, { });
    85     m_completionCallback(Result::Failure);
     85    m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), ASCIILiteral("Preflight response is not successful"), ResourceError::Type::AccessControl });
    8686}
    8787
    … …  
    102102    if (!error.isNull()) {
    103103        RELEASE_LOG_IF_ALLOWED("didCompleteWithError");
    104         m_completionCallback(Result::Failure);
     104        m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), ASCIILiteral("Preflight response is not successful"), ResourceError::Type::AccessControl });
    105105        return;
    106106    }
    … …  
    111111    if (!validatePreflightResponse(m_parameters.originalRequest, m_response, m_parameters.storedCredentialsPolicy, m_parameters.sourceOrigin, errorDescription)) {
    112112        RELEASE_LOG_IF_ALLOWED("didComplete, AccessControl error: %s", errorDescription.utf8().data());
    113         m_completionCallback(Result::Failure);
     113        m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), errorDescription, ResourceError::Type::AccessControl });
    114114        return;
    115115    }
    116     m_completionCallback(Result::Success);
     116    m_completionCallback(ResourceError { });
    117117}
    118118
    … …  
    124124{
    125125    RELEASE_LOG_IF_ALLOWED("wasBlocked");
    126     m_completionCallback(Result::Failure);
     126    m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), ASCIILiteral("Preflight request was blocked"), ResourceError::Type::AccessControl });
    127127}
    128128
    … …  
    130130{
    131131    RELEASE_LOG_IF_ALLOWED("cannotShowURL");
    132     m_completionCallback(Result::Failure);
     132    m_completionCallback(ResourceError { errorDomainWebKitInternal, 0, m_parameters.originalRequest.url(), ASCIILiteral("Preflight response was blocked"), ResourceError::Type::AccessControl });
    133133}
    134134

  • trunk/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h

    r230014 r230681  
    3434
    3535namespace WebCore {
     36class ResourceError;
    3637class SecurityOrigin;
    3738}
    … …  
    4546        WebCore::ResourceRequest originalRequest;
    4647        Ref<WebCore::SecurityOrigin> sourceOrigin;
     48        String referrer;
    4749        PAL::SessionID sessionID;
    4850        WebCore::StoredCredentialsPolicy storedCredentialsPolicy;
    4951    };
    50     enum class Result { Success, Failure, Canceled };
    51     using CompletionCallback = CompletionHandler<void(Result)>;
     52    using CompletionCallback = CompletionHandler<void(WebCore::ResourceError&&)>;
    5253
    5354    NetworkCORSPreflightChecker(Parameters&&, CompletionCallback&&);

  • trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp

    r230541 r230681  
    239239    }
    240240
     241    auto requestForPreflight = request;
     242    // We need to set header fields to m_originalRequestHeaders to correctly compute Access-Control-Request-Headers header value.
     243    requestForPreflight.setHTTPHeaderFields(m_originalRequestHeaders);
    241244    NetworkCORSPreflightChecker::Parameters parameters = {
    242         WTFMove(request),
     245        WTFMove(requestForPreflight),
    243246        *m_origin,
     247        request.httpReferrer(),
    244248        m_sessionID,
    245249        m_storedCredentialsPolicy
    246250    };
    247     m_corsPreflightChecker = std::make_unique<NetworkCORSPreflightChecker>(WTFMove(parameters), [this, handler = WTFMove(handler)](auto result) {
    248         if (result == NetworkCORSPreflightChecker::Result::Canceled) {
    249             handler(makeUnexpected(ResourceError { String { }, 0, m_url, String { }, ResourceError::Type::Cancellation }));
     251    m_corsPreflightChecker = std::make_unique<NetworkCORSPreflightChecker>(WTFMove(parameters), [this, request = WTFMove(request), handler = WTFMove(handler)](auto&& error) mutable {
     252        if (error.isCancellation())
     253            return;
     254
     255        RELEASE_LOG_IF_ALLOWED("checkCORSRequestWithPreflight - makeCrossOriginAccessRequestWithPreflight preflight complete, success: %d forRedirect? %d", error.isNull(), isRedirected());
     256
     257        if (!error.isNull()) {
     258            handler(makeUnexpected(WTFMove(error)));
    250259            return;
    251260        }
    252261
    253         RELEASE_LOG_IF_ALLOWED("checkCORSRequestWithPreflight - makeCrossOriginAccessRequestWithPreflight preflight complete, success: %d forRedirect? %d", result == NetworkCORSPreflightChecker::Result::Success, isRedirected());
    254 
    255262        auto corsPreflightChecker = WTFMove(m_corsPreflightChecker);
    256         if (result == NetworkCORSPreflightChecker::Result::Failure) {
    257             handler(this->returnError("Load cannot proceed due to preflight failure"));
    258             return;
    259         }
    260         auto request = corsPreflightChecker->originalRequest();
    261263        updateRequestForAccessControl(request, *m_origin, m_storedCredentialsPolicy);
    262264        handler(WTFMove(request));

  • trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp

    r230541 r230681  
    3333#include "NetworkConnectionToWebProcess.h"
    3434#include "NetworkLoad.h"
     35#include "NetworkLoadChecker.h"
    3536#include "NetworkProcess.h"
    3637#include "NetworkProcessConnectionMessages.h"
    … …  
    107108    }
    108109
    109     if (synchronousReply)
     110    if (synchronousReply) {
     111        m_networkLoadChecker = NetworkLoadChecker::create(FetchOptions { m_parameters.options }, m_parameters.sessionID, HTTPHeaderMap { m_parameters.originalRequestHeaders }, URL { m_parameters.request.url() }, m_parameters.sourceOrigin.copyRef());
    110112        m_synchronousLoadData = std::make_unique<SynchronousLoadData>(WTFMove(synchronousReply));
     113    }
    111114}
    112115
    … …  
    162165    m_wasStarted = true;
    163166
     167    if (m_networkLoadChecker) {
     168        m_networkLoadChecker->check(ResourceRequest { originalRequest() }, [this] (auto&& result) {
     169            if (!result.has_value()) {
     170                if (!result.error().isCancellation())
     171                    this->didFailLoading(result.error());
     172                return;
     173            }
     174            if (this->canUseCache(this->originalRequest())) {
     175                RELEASE_LOG_IF_ALLOWED("start: Checking cache for resource (pageID = %" PRIu64 ", frameID = %" PRIu64 ", resourceID = %" PRIu64 ", isMainResource = %d, isSynchronous = %d)", m_parameters.webPageID, m_parameters.webFrameID, m_parameters.identifier, this->isMainResource(), this->isSynchronous());
     176                this->retrieveCacheEntry(this->originalRequest());
     177                return;
     178            }
     179
     180            this->startNetworkLoad(WTFMove(result.value()));
     181        });
     182        return;
     183    }
     184    // FIXME: Remove that code path once m_networkLoadChecker is used for all network loads.
    164185    if (canUseCache(originalRequest())) {
    165186        RELEASE_LOG_IF_ALLOWED("start: Checking cache for resource (pageID = %" PRIu64 ", frameID = %" PRIu64 ", resourceID = %" PRIu64 ", isMainResource = %d, isSynchronous = %d)", m_parameters.webPageID, m_parameters.webFrameID, m_parameters.identifier, isMainResource(), isSynchronous());
    … …  
    223244    NetworkLoadParameters parameters = m_parameters;
    224245    parameters.defersLoading = m_defersLoading;
     246    if (m_networkLoadChecker)
     247        parameters.storedCredentialsPolicy = m_networkLoadChecker->storedCredentialsPolicy();
    225248
    226249    if (request.url().protocolIsBlob())
    … …  
    313336{
    314337    RELEASE_LOG_IF_ALLOWED("didReceiveResponse: (pageID = %" PRIu64 ", frameID = %" PRIu64 ", resourceID = %" PRIu64 ", httpStatusCode = %d, length = %" PRId64 ")", m_parameters.webPageID, m_parameters.webFrameID, m_parameters.identifier, receivedResponse.httpStatusCode(), receivedResponse.expectedContentLength());
     338
     339    if (isSynchronous()) {
     340        auto error = m_networkLoadChecker->validateResponse(receivedResponse);
     341        if (!error.isNull()) {
     342            m_synchronousLoadData->error = WTFMove(error);
     343            sendReplyToSynchronousRequest(*m_synchronousLoadData, nullptr);
     344            cleanup();
     345            return ShouldContinueDidReceiveResponse::No;
     346        }
     347    }
    315348
    316349    m_response = WTFMove(receivedResponse);
    … …  
    446479
    447480    if (isSynchronous()) {
    448         ResourceRequest overridenRequest = redirectRequest;
    449         // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
    450         // This includes at least updating host records, and comparing the current request instead of the original request here.
    451         if (!protocolHostAndPortAreEqual(originalRequest().url(), redirectRequest.url())) {
    452             ASSERT(m_synchronousLoadData->error.isNull());
    453             m_synchronousLoadData->error = SynchronousLoaderClient::platformBadResponseError();
    454             m_networkLoad->clearCurrentRequest();
    455             overridenRequest = ResourceRequest();
    456         }
    457         // We do not support prompting for credentials for synchronous loads. If we ever change this policy then
    458         // we need to take care to prompt if and only if request and redirectRequest are not mixed content.
    459         continueWillSendRequest(WTFMove(overridenRequest), false);
     481        m_networkLoadChecker->checkRedirection(redirectResponse, WTFMove(redirectRequest), [protectedThis = makeRef(*this), this, storedCredentialsPolicy = m_networkLoadChecker->storedCredentialsPolicy()](auto&& result) {
     482            if (!result.has_value()) {
     483                m_synchronousLoadData->error = SynchronousLoaderClient::platformBadResponseError();
     484                m_networkLoad->clearCurrentRequest();
     485                this->continueWillSendRequest(ResourceRequest { }, false);
     486                return;
     487            }
     488
     489            // FIXME: We need to handle SameOrigin credentials properly, for now we bail out.
     490            if (storedCredentialsPolicy != m_networkLoadChecker->storedCredentialsPolicy()) {
     491                m_synchronousLoadData->error = SynchronousLoaderClient::platformBadResponseError();
     492                m_networkLoad->clearCurrentRequest();
     493                this->continueWillSendRequest(ResourceRequest { }, false);
     494                return;
     495            }
     496
     497            // We do not support prompting for credentials for synchronous loads. If we ever change this policy then
     498            // we need to take care to prompt if and only if request and redirectRequest are not mixed content.
     499            this->continueWillSendRequest(WTFMove(result.value()), false);
     500        });
    460501        return;
    461502    }
    … …  
    580621void NetworkResourceLoader::didRetrieveCacheEntry(std::unique_ptr<NetworkCache::Entry> entry)
    581622{
    582     auto response = sanitizeResponseIfPossible(ResourceResponse { entry->response() }, ResourceResponse::SanitizationType::CrossOriginSafe);
    583623    if (isSynchronous()) {
    584         m_synchronousLoadData->response = WTFMove(response);
     624        auto response = entry->response();
     625        auto error = m_networkLoadChecker->validateResponse(response);
     626        if (!error.isNull()) {
     627            m_synchronousLoadData->error = WTFMove(error);
     628            m_synchronousLoadData->response = { };
     629            sendReplyToSynchronousRequest(*m_synchronousLoadData, nullptr);
     630            cleanup();
     631            return;
     632        }
     633
     634        m_synchronousLoadData->response = sanitizeResponseIfPossible(WTFMove(response), ResourceResponse::SanitizationType::CrossOriginSafe);
    585635        sendReplyToSynchronousRequest(*m_synchronousLoadData, entry->buffer());
    586636        cleanup();
    … …  
    588638    }
    589639
     640    auto response = sanitizeResponseIfPossible(ResourceResponse { entry->response() }, ResourceResponse::SanitizationType::CrossOriginSafe);
    590641    bool needsContinueDidReceiveResponseMessage = isMainResource();
    591642    send(Messages::WebResourceLoader::DidReceiveResponse { response, needsContinueDidReceiveResponseMessage });

  • trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.h

    r230528 r230681  
    4646class NetworkConnectionToWebProcess;
    4747class NetworkLoad;
     48class NetworkLoadChecker;
    4849class SandboxExtension;
    4950
    … …  
    180181    bool m_isWaitingContinueWillSendRequestForCachedRedirect { false };
    181182    std::unique_ptr<NetworkCache::Entry> m_cacheEntryWaitingForContinueDidReceiveResponse;
     183    RefPtr<NetworkLoadChecker> m_networkLoadChecker;
    182184};
    183185

  • trunk/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp

    r230541 r230681  
    416416}
    417417
    418 void WebLoaderStrategy::loadResourceSynchronously(FrameLoader& frameLoader, unsigned long resourceLoadIdentifier, const ResourceRequest& request, StoredCredentialsPolicy storedCredentialsPolicy, ClientCredentialPolicy clientCredentialPolicy, ResourceError& error, ResourceResponse& response, Vector<char>& data)
    419 {
     418void WebLoaderStrategy::loadResourceSynchronously(FrameLoader& frameLoader, unsigned long resourceLoadIdentifier, const ResourceRequest& request, ClientCredentialPolicy clientCredentialPolicy,  const FetchOptions& options, const HTTPHeaderMap& originalRequestHeaders, ResourceError& error, ResourceResponse& response, Vector<char>& data)
     419{
     420    auto* document = frameLoader.frame().document();
     421    if (!document) {
     422        error = internalError(request.url());
     423        return;
     424    }
     425
    420426    WebFrameLoaderClient* webFrameLoaderClient = toWebFrameLoaderClient(frameLoader.client());
    421427    WebFrame* webFrame = webFrameLoaderClient ? webFrameLoaderClient->webFrame() : nullptr;
    … …  
    430436    loadParameters.contentSniffingPolicy = SniffContent;
    431437    loadParameters.contentEncodingSniffingPolicy = ContentEncodingSniffingPolicy::Sniff;
    432     loadParameters.storedCredentialsPolicy = storedCredentialsPolicy;
     438    loadParameters.storedCredentialsPolicy = options.credentials == FetchOptions::Credentials::Omit ? StoredCredentialsPolicy::DoNotUse : StoredCredentialsPolicy::Use;
    433439    loadParameters.clientCredentialPolicy = clientCredentialPolicy;
    434440    loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect(webFrame ? webFrame->coreFrame() : nullptr);
    435441    loadParameters.shouldRestrictHTTPResponseAccess = RuntimeEnabledFeatures::sharedFeatures().restrictedHTTPResponseAccess();
    436     // FIXME: Use the proper destination once all fetch options are passed.
    437     loadParameters.options.destination = FetchOptions::Destination::EmptyString;
     442
     443    loadParameters.options = options;
     444    loadParameters.sourceOrigin = &document->securityOrigin();
     445    if (!document->shouldBypassMainWorldContentSecurityPolicy()) {
     446        if (auto* contentSecurityPolicy = document->contentSecurityPolicy())
     447            loadParameters.cspResponseHeaders = contentSecurityPolicy->responseHeaders();
     448    }
     449    loadParameters.originalRequestHeaders = originalRequestHeaders;
    438450
    439451    data.shrink(0);

  • trunk/Source/WebKit/WebProcess/Network/WebLoaderStrategy.h

    r230007 r230681  
    4949   
    5050    void loadResource(WebCore::Frame&, WebCore::CachedResource&, WebCore::ResourceRequest&&, const WebCore::ResourceLoaderOptions&, CompletionHandler<void(RefPtr<WebCore::SubresourceLoader>&&)>&&) final;
    51     void loadResourceSynchronously(WebCore::FrameLoader&, unsigned long resourceLoadIdentifier, const WebCore::ResourceRequest&, WebCore::StoredCredentialsPolicy, WebCore::ClientCredentialPolicy, WebCore::ResourceError&, WebCore::ResourceResponse&, Vector<char>& data) final;
     51    void loadResourceSynchronously(WebCore::FrameLoader&, unsigned long resourceLoadIdentifier, const WebCore::ResourceRequest&, WebCore::ClientCredentialPolicy, const WebCore::FetchOptions&, const WebCore::HTTPHeaderMap&, WebCore::ResourceError&, WebCore::ResourceResponse&, Vector<char>& data) final;
    5252
    5353    void remove(WebCore::ResourceLoader*) final;
    … …  
    8484    void setOnLineState(bool);
    8585
     86    bool isDoingLoadingSecurityChecks() const final { return true; }
     87
    8688private:
    8789    void scheduleLoad(WebCore::ResourceLoader&, WebCore::CachedResource*, bool shouldClearReferrerOnHTTPSToHTTPRedirect);

  • trunk/Source/WebKitLegacy/ChangeLog

    r230279 r230681  
     12018-04-16  Youenn Fablet  <youenn@apple.com>
     2
     3        Use NetworkLoadChecker to handle synchronous HTTP loads
     4        https://bugs.webkit.org/show_bug.cgi?id=184240
     5
     6        Reviewed by Chris Dumez.
     7
     8        * WebCoreSupport/WebResourceLoadScheduler.cpp:
     9        (WebResourceLoadScheduler::loadResourceSynchronously):
     10        * WebCoreSupport/WebResourceLoadScheduler.h:
     11
    1122018-04-04  Alex Christensen  <achristensen@webkit.org>
    213

  • trunk/Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.cpp

    r230279 r230681  
    107107}
    108108
    109 void WebResourceLoadScheduler::loadResourceSynchronously(FrameLoader& frameLoader, unsigned long, const ResourceRequest& request, StoredCredentialsPolicy storedCredentialsPolicy, ClientCredentialPolicy, ResourceError& error, ResourceResponse& response, Vector<char>& data)
    110 {
    111     ResourceHandle::loadResourceSynchronously(frameLoader.networkingContext(), request, storedCredentialsPolicy, error, response, data);
     109void WebResourceLoadScheduler::loadResourceSynchronously(FrameLoader& frameLoader, unsigned long, const ResourceRequest& request, ClientCredentialPolicy, const FetchOptions& options, const HTTPHeaderMap&, ResourceError& error, ResourceResponse& response, Vector<char>& data)
     110{
     111    ResourceHandle::loadResourceSynchronously(frameLoader.networkingContext(), request, options.credentials == FetchOptions::Credentials::Omit ? StoredCredentialsPolicy::DoNotUse : StoredCredentialsPolicy::Use, error, response, data);
    112112}
    113113

  • trunk/Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.h

    r230007 r230681  
    5151
    5252    void loadResource(WebCore::Frame&, WebCore::CachedResource&, WebCore::ResourceRequest&&, const WebCore::ResourceLoaderOptions&, CompletionHandler<void(RefPtr<WebCore::SubresourceLoader>&&)>&&) final;
    53     void loadResourceSynchronously(WebCore::FrameLoader&, unsigned long, const WebCore::ResourceRequest&, WebCore::StoredCredentialsPolicy, WebCore::ClientCredentialPolicy, WebCore::ResourceError&, WebCore::ResourceResponse&, Vector<char>&) final;
     53    void loadResourceSynchronously(WebCore::FrameLoader&, unsigned long, const WebCore::ResourceRequest&, WebCore::ClientCredentialPolicy, const WebCore::FetchOptions&, const WebCore::HTTPHeaderMap&, WebCore::ResourceError&, WebCore::ResourceResponse&, Vector<char>&) final;
    5454    void remove(WebCore::ResourceLoader*) final;
    5555    void setDefersLoading(WebCore::ResourceLoader*, bool) final;
Note: See TracChangeset for help on using the changeset viewer.