Changeset 207754 in webkit

Timestamp:

Oct 24, 2016 1:04:20 AM (7 years ago)

Author:

commit-queue@webkit.org

Message:

ASSERTION FAILED: canvas()->securityOrigin()->toString() == cachedImage.origin()->toString()
​https://bugs.webkit.org/show_bug.cgi?id=163242

Patch by Youenn Fablet <​youenn@apple.com> on 2016-10-24
Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/security/cross-origin-cached-images-canvas.html

We were previously on Origin HTTP header to check whether requests were made from different origins.
This is fine for CORS enabled requests but not for GET no CORS requests since they will not have any Origin header.

Now that CachedResource and CachedResourceRequest own their origin, it is best to use these directly.

• loader/cache/CachedResourceLoader.cpp:

(WebCore::isRequestMatchingResourceOrigin):
(WebCore::CachedResourceLoader::shouldUpdateCachedResourceWithCurrentRequest):

LayoutTests:

• http/tests/security/cross-origin-cached-images-canvas-expected.txt: Added.
• http/tests/security/cross-origin-cached-images-canvas.html: Added.
• http/tests/security/resources/cross-origin-cached-image-canvas-iframe.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/cross-origin-cached-images-canvas-expected.txt (added)
• LayoutTests/http/tests/security/cross-origin-cached-images-canvas.html (added)
• LayoutTests/http/tests/security/resources/cross-origin-cached-image-canvas-iframe.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/cache/CachedResourceLoader.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-10-24  Youenn Fablet  <youenn@apple.com>
+
+        ASSERTION FAILED: canvas()->securityOrigin()->toString() == cachedImage.origin()->toString()
+        https://bugs.webkit.org/show_bug.cgi?id=163242
+
+        Reviewed by Darin Adler.
+
+        * http/tests/security/cross-origin-cached-images-canvas-expected.txt: Added.
+        * http/tests/security/cross-origin-cached-images-canvas.html: Added.
+        * http/tests/security/resources/cross-origin-cached-image-canvas-iframe.html: Added.
+
 2016-10-24  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-24  Youenn Fablet  <youenn@apple.com>
+
+        ASSERTION FAILED: canvas()->securityOrigin()->toString() == cachedImage.origin()->toString()
+        https://bugs.webkit.org/show_bug.cgi?id=163242
+
+        Reviewed by Darin Adler.
+
+        Test: http/tests/security/cross-origin-cached-images-canvas.html
+
+        We were previously on Origin HTTP header to check whether requests were made from different origins.
+        This is fine for CORS enabled requests but not for GET no CORS requests since they will not have any Origin header.
+
+        Now that CachedResource and CachedResourceRequest own their origin, it is best to use these directly.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::isRequestMatchingResourceOrigin):
+        (WebCore::CachedResourceLoader::shouldUpdateCachedResourceWithCurrentRequest):
+
 2016-10-24  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

@@ -551 +551 @@
 }
 
+static inline bool originsMatch(const CachedResourceRequest& request, const CachedResource& resource)
+{
+    if (request.origin() == resource.origin())
+        return true;
+    if (!request.origin() || !resource.origin())
+        return false;
+    // We use string comparison as this is how they are serialized as HTTP Origin header value.
+    // This is in particular useful for unique origins that are serialized as "null"
+    return request.origin()->toString() == resource.origin()->toString();
+}
+
 bool CachedResourceLoader::shouldUpdateCachedResourceWithCurrentRequest(const CachedResource& resource, const CachedResourceRequest& request)
 {
@@ -584 +595 @@
     }
 
-    if (resource.options().mode != request.options().mode || request.resourceRequest().httpOrigin() != resource.resourceRequest().httpOrigin())
+    if (resource.options().mode != request.options().mode || !originsMatch(request, resource))
         return true;