Changeset 283382 in webkit

Timestamp:

Oct 1, 2021, 11:07:05 AM (5 years ago)

Author:

Alan Coon

Message:

Apply patch. rdar://problem/81175635

File:

• branches/safari-611.4.2.0-branch/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp (modified) (6 diffs)

branches/safari-611.4.2.0-branch/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp

@@ -99 +99 @@
 
     m_firstRequestHeaders = request.httpHeaderFields();
-    checkRequest(WTFMove(request), client, WTFMove(handler));
+    checkRequest(WTFMove(request), client, URL(), WTFMove(handler));
 }
 
@@ -149 +149 @@
     m_url = redirectRequest.url();
 
-    checkRequest(WTFMove(redirectRequest), client, [handler = WTFMove(handler), request = WTFMove(request), redirectResponse = WTFMove(redirectResponse)](auto&& result) mutable {
+    checkRequest(WTFMove(redirectRequest), client, redirectResponse.url(), [handler = WTFMove(handler), request = WTFMove(request), redirectResponse = WTFMove(redirectResponse)](auto&& result) mutable {
         WTF::switchOn(result,
             [&handler] (ResourceError& error) mutable {
@@ -248 +248 @@
 }
 
-void NetworkLoadChecker::checkRequest(ResourceRequest&& request, ContentSecurityPolicyClient* client, ValidationHandler&& handler)
+void NetworkLoadChecker::checkRequest(ResourceRequest&& request, ContentSecurityPolicyClient* client, const URL& preRedirectURL, ValidationHandler&& handler)
 {
     ResourceRequest originalRequest = request;
@@ -261 +261 @@
                 contentSecurityPolicy->upgradeInsecureRequestIfNeeded(request, type);
             }
-            if (!this->isAllowedByContentSecurityPolicy(request, client)) {
+            if (!this->isAllowedByContentSecurityPolicy(request, client, preRedirectURL)) {
                 handler(this->accessControlErrorForValidationHandler("Blocked by Content Security Policy."_s));
                 return;
@@ -300 +300 @@
 }
 
-bool NetworkLoadChecker::isAllowedByContentSecurityPolicy(const ResourceRequest& request, WebCore::ContentSecurityPolicyClient* client)
+bool NetworkLoadChecker::isAllowedByContentSecurityPolicy(const ResourceRequest& request, WebCore::ContentSecurityPolicyClient* client, const URL& preRedirectURL)
 {
     auto* contentSecurityPolicy = this->contentSecurityPolicy();
@@ -315 +315 @@
     case FetchOptions::Destination::Serviceworker:
     case FetchOptions::Destination::Sharedworker:
-        return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived);
+        return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived, preRedirectURL);
     case FetchOptions::Destination::Script:
         if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived))