Changeset 199900 in webkit

Timestamp:

Apr 22, 2016 1:57:26 PM (8 years ago)

Author:

Brent Fulgham

Message:

Anchor element 'ping' property should only apply to http/https destinations
​https://bugs.webkit.org/show_bug.cgi?id=156801
<rdar://problem/25834419>

Reviewed by Chris Dumez.

Take advantage of the hyperlink auditing language "UAs may either ignore the
ping attribute altogether, or selectively ignore URLs in the list (e.g. ignoring
any third-party URLs)" to restrict pings to http/https targets. For details, see
<​https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing>.

Tested by http/tests/navigation/ping-attribute tests.

• loader/PingLoader.cpp:

(WebCore::PingLoader::sendPing): Ignore requests to ping anything outside the
family of HTTP protocols (http/https).

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/PingLoader.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-04-22  Brent Fulgham  <bfulgham@apple.com>
+
+        Anchor element 'ping' property should only apply to http/https destinations
+        https://bugs.webkit.org/show_bug.cgi?id=156801
+        <rdar://problem/25834419>
+
+        Reviewed by Chris Dumez.
+
+        Take advantage of the hyperlink auditing language "UAs may either ignore the
+        ping attribute altogether, or selectively ignore URLs in the list (e.g. ignoring
+        any third-party URLs)" to restrict pings to http/https targets. For details, see
+        <https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing>.
+
+        Tested by http/tests/navigation/ping-attribute tests.
+
+        * loader/PingLoader.cpp:
+        (WebCore::PingLoader::sendPing): Ignore requests to ping anything outside the
+        family of HTTP protocols (http/https).
+
 2016-04-22  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/loader/PingLoader.cpp

@@ -93 +93 @@
 void PingLoader::sendPing(Frame& frame, const URL& pingURL, const URL& destinationURL)
 {
+    if (!pingURL.protocolIsInHTTPFamily())
+        return;
+
     ResourceRequest request(pingURL);