⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 267507 in webkit


Ignore:
Timestamp:
Sep 23, 2020, 4:25:31 PM (6 years ago)
Author:
Chris Dumez
Message:

web audio api outputs silence for 302 redirected resource in safari
​https://bugs.webkit.org/show_bug.cgi?id=214932
<rdar://problem/66300050>

Reviewed by Darin Adler.

Source/WebCore:

If the resource is redirected to another origin, treat it as tainted only if the crossorigin attribute
is not set. This is done for consistency with Blink:

The new behavior also seems to match Firefox.

Tests: http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html

http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html

  • Modules/webaudio/MediaElementAudioSourceNode.cpp:

(WebCore::MediaElementAudioSourceNode::wouldTaintOrigin):

LayoutTests:

Add layout test coverage. Update existing test to reflect the fact that the frequency returned by
the AnalyserNode is -Infinity when input is silent, not minDecibels (this has changed fairly
recently).

  • http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect-expected.txt: Added.
  • http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html: Copied from LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html.
  • http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html:
  • http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect-expected.txt: Added.
  • http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html: Copied from LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html.
Location:
trunk
Files:
2 added
4 edited
2 copied

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r267504 r267507  
     12020-09-23  Chris Dumez  <cdumez@apple.com>
     2
     3        web audio api outputs silence for 302 redirected resource in safari
     4        https://bugs.webkit.org/show_bug.cgi?id=214932
     5        <rdar://problem/66300050>
     6
     7        Reviewed by Darin Adler.
     8
     9        Add layout test coverage. Update existing test to reflect the fact that the frequency returned by
     10        the AnalyserNode is -Infinity when input is silent, not minDecibels (this has changed fairly
     11        recently).
     12
     13        * http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect-expected.txt: Added.
     14        * http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html: Copied from LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html.
     15        * http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html:
     16        * http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect-expected.txt: Added.
     17        * http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html: Copied from LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html.
     18
    1192020-09-23  Chris Dumez  <cdumez@apple.com>
    220

  • trunk/LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html

    r267505 r267507  
    1616        let mediaFile = findMediaFile("audio", "../../media/resources/1000Hz-sin");
    1717        let type = mimeTypeForExtension(mediaFile.split('.').pop());
    18         audio.src = "http://localhost:8080/security/resources/video-cross-origin-allow.php?name=" + mediaFile + "&type=" + type;
     18        audio.src = "http://localhost:8080/security/resources/redirect-allow-star.php?url=" + encodeURIComponent("http://127.0.0.1:8080/security/resources/video-cross-origin-allow.php?name=" + mediaFile + "&type=" + type);
    1919
    2020        context = new AudioContext();
    … …  
    3131        window.outputArray = new Float32Array(analyser.frequencyBinCount);
    3232        window.silentArray = new Float32Array(analyser.frequencyBinCount);
    33         silentArray.fill(analyser.minDecibels);
     33        silentArray.fill(-Infinity);
    3434
    3535        var intervalToken = setInterval(() => {

  • trunk/LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html

    r267504 r267507  
    3131        window.outputArray = new Float32Array(analyser.frequencyBinCount);
    3232        window.silentArray = new Float32Array(analyser.frequencyBinCount);
    33         silentArray.fill(analyser.minDecibels);
     33        silentArray.fill(-Infinity);
    3434
    3535        var intervalToken = setInterval(() => {

  • trunk/LayoutTests/http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html

    r267505 r267507  
    88<pre id="console"></pre>
    99<script>
    10     description("Ensure that audio is rendered when tainted by a remote audio resource when CORS is enabled.");
     10    description("Ensure that audio is not rendered when tainted by a remote audio resource when CORS is not enabled.");
    1111    window.jsTestIsAsync = true;
    1212
    1313    function go() {
    1414        let audio = new Audio();
    15         audio.crossOrigin = "anonymous";
    1615        let mediaFile = findMediaFile("audio", "../../media/resources/1000Hz-sin");
    1716        let type = mimeTypeForExtension(mediaFile.split('.').pop());
    18         audio.src = "http://localhost:8080/security/resources/video-cross-origin-allow.php?name=" + mediaFile + "&type=" + type;
     17        audio.src = "http://localhost:8080/security/resources/redirect-allow-star.php?url=" + encodeURIComponent("http://127.0.0.1:8080/security/resources/video-cross-origin-allow.php?name=" + mediaFile + "&type=" + type);
    1918
    2019        context = new AudioContext();
    … …  
    3130        window.outputArray = new Float32Array(analyser.frequencyBinCount);
    3231        window.silentArray = new Float32Array(analyser.frequencyBinCount);
    33         silentArray.fill(analyser.minDecibels);
     32        silentArray.fill(-Infinity);
    3433
    3534        var intervalToken = setInterval(() => {
    … …  
    4039            clearInterval(intervalToken);
    4140            context.suspend().then(() => {
    42                 shouldNotBe("outputArray", "silentArray");
     41                shouldBe("outputArray", "silentArray");
    4342                finishJSTest();
    4443            });

  • trunk/Source/WebCore/ChangeLog

    r267505 r267507  
     12020-09-23  Chris Dumez  <cdumez@apple.com>
     2
     3        web audio api outputs silence for 302 redirected resource in safari
     4        https://bugs.webkit.org/show_bug.cgi?id=214932
     5        <rdar://problem/66300050>
     6
     7        Reviewed by Darin Adler.
     8
     9        If the resource is redirected to another origin, treat it as tainted only if the crossorigin attribute
     10        is not set. This is done for consistency with Blink:
     11        - https://github.com/chromium/chromium/blob/master/media/blink/webmediaplayer_impl.cc (see WouldTaintOrigin())
     12
     13        The new behavior also seems to match Firefox.
     14
     15        Tests: http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html
     16               http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html
     17
     18        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
     19        (WebCore::MediaElementAudioSourceNode::wouldTaintOrigin):
     20
    1212020-09-23  Chris Dumez  <cdumez@apple.com>
    222

  • trunk/Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp

    r267505 r267507  
    124124bool MediaElementAudioSourceNode::wouldTaintOrigin()
    125125{
    126     if (!m_mediaElement->hasSingleSecurityOrigin())
     126    // If the resource is redirected to another origin, treat it as tainted if the crossorigin attribute
     127    // is not set. This is done for consistency with Blink.
     128    if (!m_mediaElement->hasSingleSecurityOrigin() && m_mediaElement->crossOrigin().isNull())
    127129        return true;
    128130
Note: See TracChangeset for help on using the changeset viewer.