Changeset 193984 in webkit


Ignore:
Timestamp:
Dec 11, 2015 2:43:49 PM (8 years ago)
Author:
jiewen_tan@apple.com
Message:

Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
​https://bugs.webkit.org/show_bug.cgi?id=152102
<rdar://problem/22124230>

Reviewed by Andy Estes.

Source/WebCore:

Keep the ReferrerPolicy for a document as ReferrerPolicyNever if the document is loaded with
"Content-Disposition: attachment".

Test: http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html

  • dom/Document.cpp:

(WebCore::Document::processReferrerPolicy):
(WebCore::Document::applyContentDispositionAttachmentSandbox):

LayoutTests:

  • http/tests/contentdispositionattachmentsandbox/resources/echo-http-referer.php: Added.
  • http/tests/contentdispositionattachmentsandbox/resources/subresource-request-not-include-referer-header-frame.php: Added.
  • http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header-expected.txt: Added.
  • http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html: Added.
Location:
trunk
Files:
4 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r193982 r193984  
     12015-12-11  Jiewen Tan  <jiewen_tan@apple.com>
     2
     3        Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
     4        https://bugs.webkit.org/show_bug.cgi?id=152102
     5        <rdar://problem/22124230>
     6
     7        Reviewed by Andy Estes.
     8
     9        * http/tests/contentdispositionattachmentsandbox/resources/echo-http-referer.php: Added.
     10        * http/tests/contentdispositionattachmentsandbox/resources/subresource-request-not-include-referer-header-frame.php: Added.
     11        * http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header-expected.txt: Added.
     12        * http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html: Added.
     13
    1142015-12-11  Ryan Haddad  <ryanhaddad@apple.com>
    215

  • trunk/Source/WebCore/ChangeLog

    r193981 r193984  
     12015-12-11  Jiewen Tan  <jiewen_tan@apple.com>
     2
     3        Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
     4        https://bugs.webkit.org/show_bug.cgi?id=152102
     5        <rdar://problem/22124230>
     6
     7        Reviewed by Andy Estes.
     8
     9        Keep the ReferrerPolicy for a document as ReferrerPolicyNever if the document is loaded with
     10        "Content-Disposition: attachment".
     11
     12        Test: http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html
     13
     14        * dom/Document.cpp:
     15        (WebCore::Document::processReferrerPolicy):
     16        (WebCore::Document::applyContentDispositionAttachmentSandbox):
     17
    1182015-12-11  Brady Eidson  <beidson@apple.com>
    219

  • trunk/Source/WebCore/dom/Document.cpp

    r193957 r193984  
    33403340    ASSERT(!policy.isNull());
    33413341
     3342    // Documents in a Content-Disposition: attachment sandbox should never send a Referer header,
     3343    // even if the document has a meta tag saying otherwise.
     3344    if (shouldEnforceContentDispositionAttachmentSandbox())
     3345        return;
     3346
    33423347    // Note that we're supporting both the standard and legacy keywords for referrer
    33433348    // policies, as defined by http://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-meta
    … …  
    68726877    ASSERT(shouldEnforceContentDispositionAttachmentSandbox());
    68736878
     6879    setReferrerPolicy(ReferrerPolicyNever);
    68746880    if (!isMediaDocument())
    68756881        enforceSandboxFlags(SandboxAll);
Note: See TracChangeset for help on using the changeset viewer.