Changeset 195010 in webkit


Ignore:
Timestamp:
Jan 14, 2016 12:39:13 AM (8 years ago)
Author:
youenn.fablet@crf.canon.fr
Message:

Fix problems with cross-origin redirects
​https://bugs.webkit.org/show_bug.cgi?id=116075

Reviewed by Daniel Bates.

LayoutTests/imported/w3c:

Rebasing test expectations.
These tests cannot work as expected as WTR/DRT block access to www2.localhost and example.not.

  • web-platform-tests/XMLHttpRequest/send-redirect-bogus-expected.txt:
  • web-platform-tests/XMLHttpRequest/send-redirect-to-cors-expected.txt:
  • web-platform-tests/XMLHttpRequest/send-redirect-to-non-cors-expected.txt:

Source/WebCore:

Merging ​https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
Same origin redirect responses leading to cross-origin requests were checked as cross-origin redirect responses.
Introduced ClientRequestedCredentials to manage whether credentials are needed or not in the cross-origin request.

In addition to Blink patch, it was needed to update some loaders with the newly introduced ClientRequestedCredentials parameter.
Added the clearing of "Accept-Encoding" header from cross-origin requests as Mac HTTP network layer is adding it for same-origin requests.

Test: http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html

  • loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::startLoadingMainResource): Added new security parameter (from Blink patch).

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::redirectReceived): Updated checks so that same origin redirections are not treated as cross origin redirections (from Blink patch).

  • loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::start):

  • loader/NetscapePlugInStreamLoader.cpp:

(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Added new security parameter.

  • loader/ResourceLoaderOptions.h:

(WebCore::ResourceLoaderOptions::ResourceLoaderOptions): Added new security parameter (from Blink patch).
(WebCore::ResourceLoaderOptions::credentialRequest):
(WebCore::ResourceLoaderOptions::setCredentialRequest):

  • loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Ditto.
(WebCore::CachedResourceLoader::defaultCachedResourceOptions): Ditto.

  • loader/icon/IconLoader.cpp:

(WebCore::IconLoader::startLoading): Added new security parameter.

  • page/EventSource.cpp:

(WebCore::EventSource::connect): Added new security parameter (from Blink patch).

  • platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:

(WebCore::WebCoreAVCFResourceLoader::startLoading): Added new security parameter.

  • platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:

(WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.

  • platform/network/ResourceHandleTypes.h: Added new security parameter constants (from Blink patch).
  • platform/network/ResourceRequestBase.cpp:

(WebCore::ResourceRequestBase::clearHTTPAcceptEncoding): Function to remove "Accept-Encoding" header.

  • platform/network/ResourceRequestBase.h: Ditto.
  • xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::createRequest): Added new security parameter.

LayoutTests:

Merging ​https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
This merge adds tests for cross origin requests triggered from same origin redirection responses with and without credentials).
Rebaseline of some tests due to console error messages generated from newly hit CORS checks.

  • TestExpectations: Disabled WPT tests that require access to non localhost URLs which are currently blocked by DTR/WTR.
  • http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
  • http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin-expected.txt: Added.
  • http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html: Added.
  • http/tests/xmlhttprequest/access-control-and-redirects-async.html:
  • http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
  • http/tests/xmlhttprequest/access-control-and-redirects.html:
  • http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt:
  • http/tests/xmlhttprequest/redirect-cross-origin-expected.txt:
  • http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt:
  • http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt:
  • http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi: Added.
  • http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt:
Location:
trunk
Files:
3 added
28 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r195003 r195010  
     12016-01-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>
     2
     3        Fix problems with cross-origin redirects
     4        https://bugs.webkit.org/show_bug.cgi?id=116075
     5
     6        Reviewed by Daniel Bates.
     7
     8        Merging https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
     9        This merge adds tests for cross origin requests triggered from same origin redirection responses with and without credentials).
     10        Rebaseline of some tests due to console error messages generated from newly hit CORS checks.
     11
     12        * TestExpectations: Disabled WPT tests that require access to non localhost URLs which are currently blocked by DTR/WTR.
     13        * http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
     14        * http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin-expected.txt: Added.
     15        * http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html: Added.
     16        * http/tests/xmlhttprequest/access-control-and-redirects-async.html:
     17        * http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
     18        * http/tests/xmlhttprequest/access-control-and-redirects.html:
     19        * http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt:
     20        * http/tests/xmlhttprequest/redirect-cross-origin-expected.txt:
     21        * http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt:
     22        * http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt:
     23        * http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi: Added.
     24        * http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt:
     25
    1262016-01-13  Ryan Haddad  <ryanhaddad@apple.com>
    227

  • trunk/LayoutTests/TestExpectations

    r194867 r195010  
    300300imported/w3c/web-platform-tests/XMLHttpRequest/xmlhttprequest-timeout-worker-synconworker.html [ Slow ]
    301301imported/w3c/web-platform-tests/XMLHttpRequest/xmlhttprequest-timeout-worker-twice.html [ Slow ]
     302# XMLHttpRequest tests requiring DTR/WTR to allow other URLs than localhost to not be blocked and be reachable (www2.localhost)
     303imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-bogus.htm [ Skip ]
     304imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-to-cors.htm [ Skip ]
     305imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-to-non-cors.htm [ Skip ]
     306
    302307
    303308# New W3C ref tests that are failing.

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt

    r112997 r195010  
    11Tests that asynchronous XMLHttpRequests handle redirects according to the CORS standard.
    22
    3 Testing resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi
     3Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi without credentials
    44Expecting success: false
    55PASS: 0
    6 Testing resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000&  access-control-allow-credentials=true
     6Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000 without credentials
     7Expecting success: true
     8FAIL: 0
     9Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000 without credentials
    710Expecting success: false
    811PASS: 0
    9 Testing resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi&  access-control-allow-origin=http://localhost:8000&  access-control-allow-credentials=true
     12Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&  access-control-allow-origin=http://localhost:8000 without credentials
    1013Expecting success: false
    1114PASS: 0
    12 Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi
     15Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&  url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=* without credentials
    1316Expecting success: false
    1417PASS: 0
    15 Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000
    16 Expecting success: true
    17 FAIL: 0
    18 Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=http://localhost:8000
     18Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false&  url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=*&  access-control-allow-headers=x-webkit without credentials
    1919Expecting success: false
    2020PASS: 0
    21 Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&  access-control-allow-origin=http://localhost:8000
    22 Expecting success: false
    23 PASS: 0
    24 Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&  url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=*
    25 Expecting success: false
    26 PASS: 0
    27 Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false&  url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&  access-control-allow-origin=*&  access-control-allow-headers=x-webkit
    28 Expecting success: false
    29 PASS: 0
    30 Testing resources/redirect-cors.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/get.txt
     21Testing resources/redirect-cors.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/get.txt without credentials
    3122Expecting success: true
    3223PASS: PASS

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html

    r120167 r195010  
    1313}
    1414
    15 function runTestAsync(url, addCustomHeader, expectSuccess) {
    16     log("Testing " + url);
     15function runTestAsync(url, credentials, addCustomHeader, expectSuccess) {
     16    log("Testing " + url + (credentials ? " with " : " without ") + "credentials");
    1717    log("Expecting success: " + expectSuccess);
    1818
    1919    xhr = new XMLHttpRequest();
     20    xhr.withCredentials = credentials;
    2021    xhr.open("GET", url, true);
    2122    if (addCustomHeader)
    … …  
    3334}
    3435
     36var withoutCredentials = false;
     37var withCredentials = true;
    3538var noCustomHeader = false;
    3639var addCustomHeader = true;
    … …  
    3942
    4043var tests = [
    41 // 1) Test simple same origin requests that receive cross origin redirects.
    42 
    43 // Request receives a cross-origin redirect response without CORS headers. The redirect response fails the access check.
    44 ["resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi",
    45   noCustomHeader, fails],
    46 
    47 // Request receives a cross-origin redirect response with CORS headers. The redirect response passes the access check,
    48 // but  the resource response fails its access check because the security origin is a globally unique identifier after
    49 // the redirect and the same origin XHR has 'allowCredentials' true.
    50 ["resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
    51   access-control-allow-origin=http://localhost:8000&\
    52   access-control-allow-credentials=true",
    53   noCustomHeader, fails],
    54 
    55 // Same as above, but to a less permissive resource that only allows the requesting origin.
    56 ["resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi&\
    57   access-control-allow-origin=http://localhost:8000&\
    58   access-control-allow-credentials=true",
    59   noCustomHeader, fails],
    60 
    61 // 2) Test simple cross origin requests that receive redirects.
     44// 1) Test simple cross origin requests that receive redirects.
    6245
    6346// Receives a redirect response without CORS headers. The redirect response fails the access check.
    6447["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi",
    65   noCustomHeader, fails],
     48  withoutCredentials, noCustomHeader, fails],
    6649
    6750// Receives a redirect response with CORS headers. The redirect response passes the access check and the resource response
    6851// passes the access check.
     52// FIXME: this test fails because the redirect is vetoed. There are continued bugs with redirects when the original
     53// request was cross-origin.
    6954["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
    7055  access-control-allow-origin=http://localhost:8000",
    71   noCustomHeader, succeeds],
     56  withoutCredentials, noCustomHeader, succeeds],
    7257
    7358// Receives a redirect response with a URL containing the userinfo production.
    7459["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=http://username:password@localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
    7560  access-control-allow-origin=http://localhost:8000",
    76   noCustomHeader, fails],
     61  withoutCredentials, noCustomHeader, fails],
    7762
    7863// Receives a redirect response with a URL with an unsupported scheme.
    7964["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=foo://bar.cgi&\
    8065  access-control-allow-origin=http://localhost:8000",
    81   noCustomHeader, fails],
     66  withoutCredentials, noCustomHeader, fails],
    8267
    83 // 3) Test preflighted cross origin requests that receive redirects.
     68// 2) Test preflighted cross origin requests that receive redirects.
    8469
    8570// Receives a redirect response to the preflight request and fails.
    … …  
    8772  url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi&\
    8873  access-control-allow-origin=*",
    89   addCustomHeader, fails],
     74  withoutCredentials, addCustomHeader, fails],
    9075
    9176// Successful preflight and receives a redirect response to the actual request and fails.
    … …  
    9479  access-control-allow-origin=*&\
    9580  access-control-allow-headers=x-webkit",
    96   addCustomHeader, fails],
     81  withoutCredentials, addCustomHeader, fails],
    9782
    98 // 4) Test same origin requests with a custom header that receive a same origin redirect.
     83// 3) Test same origin requests with a custom header that receive a same origin redirect.
    9984["resources/redirect-cors.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/get.txt",
    100   addCustomHeader, succeeds],
     85  withoutCredentials, addCustomHeader, succeeds],
     86
    10187]
    10288

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt

    r47388 r195010  
    77PASS: Error: NETWORK_ERR: XMLHttpRequest Exception 101
    88Testing /resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi(async)
    9 Expecting success: false
    10 PASS: 0
     9Expecting success: true
     10PASS: PASS: Cross-domain access allowed.
     11
    1112Testing http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi (sync)
    1213Expecting success: false

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects.html

    r120167 r195010  
    4646
    4747var tests = [
    48     ["/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi", false, false],
     48    ["/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi", false, true],
    4949    ["http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow.cgi", false, false],
    5050    ["http://localhost:8000/resources/redirect.php?url=http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow.cgi", false, false]

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt

    r41810 r195010  
     1CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    12Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
    23

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-expected.txt

    r41810 r195010  
     1CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    12Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
    23

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt

    r41810 r195010  
     1CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    12Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
    23

  • trunk/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt

    r42078 r195010  
     1CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     2CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     3CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     4CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     5CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     6CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     7CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     8CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     9CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     10CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    111Test that a cross-origin redirect does not result in a non-simple request being sent to the target.
    212

  • trunk/LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt

    r42164 r195010  
     1CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8080/xmlhttprequest/resources/forbidden.txt. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    12This tests that unsafe redirects won't be allowed when making an XMLHttpRequest.
    23Sync XHR started.

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r194999 r195010  
     12016-01-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>
     2
     3        Fix problems with cross-origin redirects
     4        https://bugs.webkit.org/show_bug.cgi?id=116075
     5
     6        Reviewed by Daniel Bates.
     7
     8        Rebasing test expectations.
     9        These tests cannot work as expected as WTR/DRT block access to www2.localhost and example.not.
     10
     11        * web-platform-tests/XMLHttpRequest/send-redirect-bogus-expected.txt:
     12        * web-platform-tests/XMLHttpRequest/send-redirect-to-cors-expected.txt:
     13        * web-platform-tests/XMLHttpRequest/send-redirect-to-non-cors-expected.txt:
     14
    1152016-01-12  Ryosuke Niwa  <rniwa@webkit.org>
    216

  • trunk/LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-to-cors-expected.txt

    r191546 r195010  
    11
    2 FAIL XMLHttpRequest: send() - Redirect to CORS-enabled resource (301) assert_equals: expected (string) "GET" but got (object) null
    3 FAIL XMLHttpRequest: send() - Redirect to CORS-enabled resource (302) assert_equals: expected (string) "GET" but got (object) null
    4 FAIL XMLHttpRequest: send() - Redirect to CORS-enabled resource (303) assert_equals: expected (string) "GET" but got (object) null
    5 FAIL XMLHttpRequest: send() - Redirect to CORS-enabled resource (307) assert_equals: expected (string) "GET" but got (object) null
     2PASS XMLHttpRequest: send() - Redirect to CORS-enabled resource (301)
     3PASS XMLHttpRequest: send() - Redirect to CORS-enabled resource (302)
     4PASS XMLHttpRequest: send() - Redirect to CORS-enabled resource (303)
     5PASS XMLHttpRequest: send() - Redirect to CORS-enabled resource (307)
    66

  • trunk/Source/WebCore/ChangeLog

    r195006 r195010  
     12016-01-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>
     2
     3        Fix problems with cross-origin redirects
     4        https://bugs.webkit.org/show_bug.cgi?id=116075
     5
     6        Reviewed by Daniel Bates.
     7
     8        Merging https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
     9        Same origin redirect responses leading to cross-origin requests were checked as cross-origin redirect responses.
     10        Introduced ClientRequestedCredentials to manage whether credentials are needed or not in the cross-origin request.
     11
     12        In addition to Blink patch, it was needed to update some loaders with the newly introduced ClientRequestedCredentials parameter.
     13        Added the clearing of "Accept-Encoding" header from cross-origin requests as Mac HTTP network layer is adding it for same-origin requests.
     14
     15        Test: http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html
     16
     17        * loader/DocumentLoader.cpp:
     18        (WebCore::DocumentLoader::startLoadingMainResource): Added new security parameter (from Blink patch).
     19        * loader/DocumentThreadableLoader.cpp:
     20        (WebCore::DocumentThreadableLoader::redirectReceived): Updated checks so that same origin redirections are not treated as cross origin redirections (from Blink patch).
     21        * loader/MediaResourceLoader.cpp:
     22        (WebCore::MediaResourceLoader::start):
     23        * loader/NetscapePlugInStreamLoader.cpp:
     24        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Added new security parameter.
     25        * loader/ResourceLoaderOptions.h:
     26        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions): Added new security parameter (from Blink patch).
     27        (WebCore::ResourceLoaderOptions::credentialRequest):
     28        (WebCore::ResourceLoaderOptions::setCredentialRequest):
     29        * loader/cache/CachedResourceLoader.cpp:
     30        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Ditto.
     31        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): Ditto.
     32        * loader/icon/IconLoader.cpp:
     33        (WebCore::IconLoader::startLoading): Added new security parameter.
     34        * page/EventSource.cpp:
     35        (WebCore::EventSource::connect): Added new security parameter (from Blink patch).
     36        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
     37        (WebCore::WebCoreAVCFResourceLoader::startLoading): Added new security parameter.
     38        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
     39        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
     40        * platform/network/ResourceHandleTypes.h: Added new security parameter constants (from Blink patch).
     41        * platform/network/ResourceRequestBase.cpp:
     42        (WebCore::ResourceRequestBase::clearHTTPAcceptEncoding): Function to remove "Accept-Encoding" header.
     43        * platform/network/ResourceRequestBase.h: Ditto.
     44        * xml/XMLHttpRequest.cpp:
     45        (WebCore::XMLHttpRequest::createRequest): Added new security parameter.
     46
    1472016-01-13  Myles C. Maxfield  <mmaxfield@apple.com>
    248

  • trunk/Source/WebCore/loader/DocumentLoader.cpp

    r195004 r195010  
    14721472    request.makeUnconditional();
    14731473
    1474     static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading);
     1474    static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading);
    14751475    CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);
    14761476    cachedResourceRequest.setInitiator(*this);

  • trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r194496 r195010  
    183183
    184184    // When using access control, only simple cross origin requests are allowed to redirect. The new request URL must have a supported
    185     // scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check.
     185    // scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check if the
     186    // original request was not same-origin.
    186187    if (m_options.crossOriginRequestPolicy == UseAccessControl) {
    187188        bool allowRedirect = false;
    … …  
    191192                            && request.url().user().isEmpty()
    192193                            && request.url().pass().isEmpty()
    193                             && passesAccessControlCheck(redirectResponse, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription);
     194                            && (m_sameOriginRequest || passesAccessControlCheck(redirectResponse, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription));
    194195        }
    195196
    … …  
    200201            RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::createFromString(redirectResponse.url());
    201202            RefPtr<SecurityOrigin> requestOrigin = SecurityOrigin::createFromString(request.url());
    202             // If the request URL origin is not same origin with the original URL origin, set source origin to a globally unique identifier.
    203             if (!originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
     203            // If the original request wasn't same-origin, then if the request URL origin is not same origin with the original URL origin,
     204            // set the source origin to a globally unique identifier. (If the original request was same-origin, the origin of the new request
     205            // should be the original URL origin.)
     206            if (!m_sameOriginRequest && !originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
    204207                m_options.securityOrigin = SecurityOrigin::createUnique();
    205             // Force any subsequent requests to use these checks.
     208            // Force any subsequent request to use these checks.
    206209            m_sameOriginRequest = false;
     210
     211            // Since the request is no longer same-origin, if the user didn't request credentials in
     212            // the first place, update our state so we neither request them nor expect they must be allowed.
     213            if (m_options.credentialRequest() == ClientDidNotRequestCredentials)
     214                m_options.setAllowCredentials(DoNotAllowStoredCredentials);
    207215
    208216            // Remove any headers that may have been added by the network layer that cause access control to fail.
    … …  
    212220            request.clearHTTPUserAgent();
    213221            request.clearHTTPAccept();
     222            request.clearHTTPAcceptEncoding();
    214223            makeCrossOriginAccessRequest(request);
    215224            return;

  • trunk/Source/WebCore/loader/MediaResourceLoader.cpp

    r194496 r195010  
    6262
    6363    // ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
    64     CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, allowCredentials, DoNotAskClientForCrossOriginCredentials, DoSecurityCheck, corsPolicy, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
     64    CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, allowCredentials, DoNotAskClientForCrossOriginCredentials, ClientDidNotRequestCredentials, DoSecurityCheck, corsPolicy, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
    6565
    6666    if (!m_crossOriginMode.isNull())

  • trunk/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp

    r194496 r195010  
    4444// See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
    4545NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame* frame, NetscapePlugInStreamLoaderClient* client)
    46     : ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading))
     46    : ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading))
    4747    , m_client(client)
    4848{

  • trunk/Source/WebCore/loader/ResourceLoaderOptions.h

    r189432 r195010  
    8484        , m_allowCredentials(DoNotAllowStoredCredentials)
    8585        , m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
     86        , m_credentialRequest(ClientDidNotRequestCredentials)
    8687        , m_securityCheck(DoSecurityCheck)
    8788        , m_requestOriginPolicy(UseDefaultOriginRestrictionsForType)
    … …  
    9091    }
    9192
    92     ResourceLoaderOptions(SendCallbackPolicy sendLoadCallbacks, ContentSniffingPolicy sniffContent, DataBufferingPolicy dataBufferingPolicy, StoredCredentials allowCredentials, ClientCredentialPolicy credentialPolicy, SecurityCheckPolicy securityCheck, RequestOriginPolicy requestOriginPolicy, CertificateInfoPolicy certificateInfoPolicy, ContentSecurityPolicyImposition contentSecurityPolicyImposition, DefersLoadingPolicy defersLoadingPolicy)
     93    ResourceLoaderOptions(SendCallbackPolicy sendLoadCallbacks, ContentSniffingPolicy sniffContent, DataBufferingPolicy dataBufferingPolicy, StoredCredentials allowCredentials, ClientCredentialPolicy credentialPolicy, CredentialRequest credentialRequest, SecurityCheckPolicy securityCheck, RequestOriginPolicy requestOriginPolicy, CertificateInfoPolicy certificateInfoPolicy, ContentSecurityPolicyImposition contentSecurityPolicyImposition, DefersLoadingPolicy defersLoadingPolicy)
    9394        : m_sendLoadCallbacks(sendLoadCallbacks)
    9495        , m_sniffContent(sniffContent)
    … …  
    9697        , m_allowCredentials(allowCredentials)
    9798        , m_clientCredentialPolicy(credentialPolicy)
     99        , m_credentialRequest(credentialRequest)
    98100        , m_securityCheck(securityCheck)
    99101        , m_requestOriginPolicy(requestOriginPolicy)
    … …  
    114116    ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
    115117    void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
     118    CredentialRequest credentialRequest() { return static_cast<CredentialRequest>(m_credentialRequest); }
     119    void setCredentialRequest(CredentialRequest credentialRequest) { m_credentialRequest = credentialRequest; }
    116120    SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
    117121    void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
    … …  
    130134    unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
    131135    unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
     136    unsigned m_credentialRequest: 1; // Whether the client (e.g. XHR) wanted credentials in the first place.
    132137    unsigned m_securityCheck : 1;
    133138    unsigned m_requestOriginPolicy : 2;

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r194898 r195010  
    235235    // FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?
    236236
    237     userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
     237    userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
    238238   
    239239    return userSheet;
    … …  
    11701170const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
    11711171{
    1172     static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading);
     1172    static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading);
    11731173    return options;
    11741174}

  • trunk/Source/WebCore/loader/icon/IconLoader.cpp

    r189432 r195010  
    6060
    6161    // ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
    62     CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
     62    CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, ClientDidNotRequestCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
    6363
    6464    request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);

  • trunk/Source/WebCore/page/EventSource.cpp

    r194419 r195010  
    126126    options.setSniffContent(DoNotSniffContent);
    127127    options.setAllowCredentials((origin->canRequest(m_url) || m_withCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials);
     128    options.setCredentialRequest(m_withCredentials ? ClientRequestedCredentials : ClientDidNotRequestCredentials);
    128129    options.preflightPolicy = PreventPreflight;
    129130    options.crossOriginRequestPolicy = UseAccessControl;

  • trunk/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp

    r189432 r195010  
    7373
    7474    // ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
    75     CachedResourceRequest request(ResourceRequest(requestURL), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
     75    CachedResourceRequest request(ResourceRequest(requestURL), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, ClientDidNotRequestCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
    7676
    7777    request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);

  • trunk/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm

    r189432 r195010  
    6969
    7070    // ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
    71     CachedResourceRequest request(ResourceRequest(requestURL), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
     71    CachedResourceRequest request(ResourceRequest(requestURL), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, ClientDidNotRequestCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading));
    7272
    7373    request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);

  • trunk/Source/WebCore/platform/network/ResourceHandleTypes.h

    r149303 r195010  
    4040};
    4141
     42// APIs like XMLHttpRequest and EventSource let the user decide
     43// whether to send credentials, but they're always sent for
     44// same-origin requests. Additional information is needed to handle
     45// cross-origin redirects correctly.
     46enum CredentialRequest {
     47    ClientRequestedCredentials,
     48    ClientDidNotRequestCredentials
     49};
     50
    4251} // namespace WebCore
    4352

  • trunk/Source/WebCore/platform/network/ResourceRequestBase.cpp

    r194496 r195010  
    380380}
    381381
     382void ResourceRequestBase::clearHTTPAcceptEncoding()
     383{
     384    updateResourceRequest();
     385
     386    m_httpHeaderFields.remove(HTTPHeaderName::AcceptEncoding);
     387
     388    if (url().protocolIsInHTTPFamily())
     389        m_platformRequestUpdated = false;
     390}
     391
    382392void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2, const String& encoding3)
    383393{

  • trunk/Source/WebCore/platform/network/ResourceRequestBase.h

    r194313 r195010  
    116116        void clearHTTPAccept();
    117117
     118        void clearHTTPAcceptEncoding();
     119
    118120        const Vector<String>& responseContentDispositionEncodingFallbackArray() const { return m_responseContentDispositionEncodingFallbackArray; }
    119121        WEBCORE_EXPORT void setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2 = String(), const String& encoding3 = String());

  • trunk/Source/WebCore/xml/XMLHttpRequest.cpp

    r194496 r195010  
    755755    options.preflightPolicy = uploadEvents ? ForcePreflight : ConsiderPreflight;
    756756    options.setAllowCredentials((m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials);
     757    options.setCredentialRequest(m_includeCredentials ? ClientRequestedCredentials : ClientDidNotRequestCredentials);
    757758    options.crossOriginRequestPolicy = UseAccessControl;
    758759    options.securityOrigin = securityOrigin();
Note: See TracChangeset for help on using the changeset viewer.