Changeset 220208 in webkit


Ignore:
Timestamp:
Aug 3, 2017 10:19:44 AM (7 years ago)
Author:
Chris Dumez
Message:

Improve our support for referrer policies
​https://bugs.webkit.org/show_bug.cgi?id=175069
<rdar://problem/33677313>

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline several WPT tests now that more checks are passing.

  • web-platform-tests/beacon/headers/header-referrer-origin-when-cross-origin-expected.txt:
  • web-platform-tests/beacon/headers/header-referrer-same-origin-expected.txt:
  • web-platform-tests/beacon/headers/header-referrer-strict-origin-when-cross-origin.https-expected.txt:
  • web-platform-tests/beacon/headers/header-referrer-strict-origin.https-expected.txt:
  • web-platform-tests/beacon/headers/header-referrer-unsafe-url.https-expected.txt:
  • web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt:
  • web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt:
  • web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt:

Source/WebCore:

Improve our support for referrer policies. In particular, we now support the
additional following ones: "same-origin", "origin-when-cross-origin" and
"strict-origin-when-cross-origin".

This is as per the following specification:

Also refactor the code a bit for clarity: I merged the ReferrerPolicy enum and the
FetchOptions::ReferrerPolicy one.

Tests: http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http-http.html

http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http.https.html
http/tests/referrer-policy/origin-when-cross-origin/same-origin.html
http/tests/referrer-policy/same-origin/cross-origin-http-http.html
http/tests/referrer-policy/same-origin/cross-origin-http.https.html
http/tests/referrer-policy/same-origin/same-origin.html
http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http-http.html
http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http.https.html
http/tests/referrer-policy/strict-origin-when-cross-origin/same-origin.html
http/tests/referrer-policy/strict-origin/cross-origin-http-http.html
http/tests/referrer-policy/strict-origin/cross-origin-http.https.html
http/tests/referrer-policy/strict-origin/same-origin.html

  • Modules/fetch/FetchLoader.cpp:

(WebCore::FetchLoader::start):

  • Modules/fetch/FetchReferrerPolicy.h:
  • Modules/fetch/FetchReferrerPolicy.idl:
  • Modules/fetch/FetchRequest.h:
  • Modules/fetch/FetchRequestInit.h:
  • dom/Document.cpp:

(WebCore::Document::processReferrerPolicy):
(WebCore::Document::applyQuickLookSandbox):
(WebCore::Document::applyContentDispositionAttachmentSandbox):

  • dom/Document.h:
  • loader/FetchOptions.h:
  • loader/FrameNetworkingContext.h:
  • loader/PingLoader.cpp:

(WebCore::PingLoader::sendBeacon):
Drop explicit call to SecurityPolicy::shouldHideReferrer(). This is already called inside
SecurityPolicy::generateReferrerHeader() and used only when needed, depending on the
actual referrer policy.

  • loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::updateHTTPRequestHeaders):

  • loader/cache/CachedResourceRequest.cpp:

(WebCore::CachedResourceRequest::updateReferrerOriginAndUserAgentHeaders):

  • page/SecurityPolicy.cpp:

(WebCore::referrerToOriginString):
(WebCore::SecurityPolicy::generateReferrerHeader):

  • page/SecurityPolicy.h:
  • platform/ReferrerPolicy.h:

Source/WebKit:

  • WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::loadResource):
(WebKit::WebLoaderStrategy::schedulePluginStreamLoad):

LayoutTests:

  • http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http-http-expected.txt: Added.
  • http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http-http.html: Added.
  • http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http.https-expected.txt: Added.
  • http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http.https.html: Added.
  • http/tests/referrer-policy/origin-when-cross-origin/same-origin-expected.txt: Added.
  • http/tests/referrer-policy/origin-when-cross-origin/same-origin.html: Added.
  • http/tests/referrer-policy/resources/document.html: Added.
  • http/tests/referrer-policy/same-origin/cross-origin-http-http-expected.txt: Added.
  • http/tests/referrer-policy/same-origin/cross-origin-http-http.html: Added.
  • http/tests/referrer-policy/same-origin/cross-origin-http.https-expected.txt: Added.
  • http/tests/referrer-policy/same-origin/cross-origin-http.https.html: Added.
  • http/tests/referrer-policy/same-origin/same-origin-expected.txt: Added.
  • http/tests/referrer-policy/same-origin/same-origin.html: Added.
  • http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http-http-expected.txt: Added.
  • http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http-http.html: Added.
  • http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http.https-expected.txt: Added.
  • http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http.https.html: Added.
  • http/tests/referrer-policy/strict-origin-when-cross-origin/same-origin-expected.txt: Added.
  • http/tests/referrer-policy/strict-origin-when-cross-origin/same-origin.html: Added.
  • http/tests/referrer-policy/strict-origin/cross-origin-http-http-expected.txt: Added.
  • http/tests/referrer-policy/strict-origin/cross-origin-http-http.html: Added.
  • http/tests/referrer-policy/strict-origin/cross-origin-http.https-expected.txt: Added.
  • http/tests/referrer-policy/strict-origin/cross-origin-http.https.html: Added.
  • http/tests/referrer-policy/strict-origin/same-origin-expected.txt: Added.
  • http/tests/referrer-policy/strict-origin/same-origin.html: Added.

Add layout test coverage.

  • http/tests/security/referrer-policy-invalid-expected.txt:

Rebaseline test now that console message has changed.

Location:
trunk
Files:
31 added
29 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r220207 r220208  
     12017-08-03  Chris Dumez  <cdumez@apple.com>
     2
     3        Improve our support for referrer policies
     4        https://bugs.webkit.org/show_bug.cgi?id=175069
     5        <rdar://problem/33677313>
     6
     7        Reviewed by Darin Adler.
     8
     9        * http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http-http-expected.txt: Added.
     10        * http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http-http.html: Added.
     11        * http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http.https-expected.txt: Added.
     12        * http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http.https.html: Added.
     13        * http/tests/referrer-policy/origin-when-cross-origin/same-origin-expected.txt: Added.
     14        * http/tests/referrer-policy/origin-when-cross-origin/same-origin.html: Added.
     15        * http/tests/referrer-policy/resources/document.html: Added.
     16        * http/tests/referrer-policy/same-origin/cross-origin-http-http-expected.txt: Added.
     17        * http/tests/referrer-policy/same-origin/cross-origin-http-http.html: Added.
     18        * http/tests/referrer-policy/same-origin/cross-origin-http.https-expected.txt: Added.
     19        * http/tests/referrer-policy/same-origin/cross-origin-http.https.html: Added.
     20        * http/tests/referrer-policy/same-origin/same-origin-expected.txt: Added.
     21        * http/tests/referrer-policy/same-origin/same-origin.html: Added.
     22        * http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http-http-expected.txt: Added.
     23        * http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http-http.html: Added.
     24        * http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http.https-expected.txt: Added.
     25        * http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http.https.html: Added.
     26        * http/tests/referrer-policy/strict-origin-when-cross-origin/same-origin-expected.txt: Added.
     27        * http/tests/referrer-policy/strict-origin-when-cross-origin/same-origin.html: Added.
     28        * http/tests/referrer-policy/strict-origin/cross-origin-http-http-expected.txt: Added.
     29        * http/tests/referrer-policy/strict-origin/cross-origin-http-http.html: Added.
     30        * http/tests/referrer-policy/strict-origin/cross-origin-http.https-expected.txt: Added.
     31        * http/tests/referrer-policy/strict-origin/cross-origin-http.https.html: Added.
     32        * http/tests/referrer-policy/strict-origin/same-origin-expected.txt: Added.
     33        * http/tests/referrer-policy/strict-origin/same-origin.html: Added.
     34        Add layout test coverage.
     35
     36        * http/tests/security/referrer-policy-invalid-expected.txt:
     37        Rebaseline test now that console message has changed.
     38
    1392017-08-03  Daniel Bates  <dabates@apple.com>
    240

  • trunk/LayoutTests/http/tests/security/referrer-policy-invalid-expected.txt

    r178527 r220208  
    1 CONSOLE MESSAGE: line 8: Failed to set referrer policy: The value 'invalid' is not one of 'no-referrer', 'origin', 'no-referrer-when-downgrade', or 'unsafe-url'. Defaulting to 'no-referrer'.
     1CONSOLE MESSAGE: line 8: Failed to set referrer policy: The value 'invalid' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'same-origin', 'origin', 'strict-origin', 'origin-when-cross-origin', 'strict-origin-when-cross-origin' or 'unsafe-url'. Defaulting to 'no-referrer'.
    22This test checks an invalid referrer policy when navigating from an insecure URL to another insecure URL. The test passes if the printed referrer is empty.
    33

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r220121 r220208  
     12017-08-03  Chris Dumez  <cdumez@apple.com>
     2
     3        Improve our support for referrer policies
     4        https://bugs.webkit.org/show_bug.cgi?id=175069
     5        <rdar://problem/33677313>
     6
     7        Reviewed by Darin Adler.
     8
     9        Rebaseline several WPT tests now that more checks are passing.
     10
     11        * web-platform-tests/beacon/headers/header-referrer-origin-when-cross-origin-expected.txt:
     12        * web-platform-tests/beacon/headers/header-referrer-same-origin-expected.txt:
     13        * web-platform-tests/beacon/headers/header-referrer-strict-origin-when-cross-origin.https-expected.txt:
     14        * web-platform-tests/beacon/headers/header-referrer-strict-origin.https-expected.txt:
     15        * web-platform-tests/beacon/headers/header-referrer-unsafe-url.https-expected.txt:
     16        * web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt:
     17        * web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt:
     18        * web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt:
     19
    1202017-08-01  Chris Dumez  <cdumez@apple.com>
    221

  • trunk/LayoutTests/imported/w3c/web-platform-tests/beacon/headers/header-referrer-origin-when-cross-origin-expected.txt

    r220121 r220208  
    1 CONSOLE MESSAGE: line 8: Failed to set referrer policy: The value 'origin-when-cross-origin' is not one of 'no-referrer', 'origin', 'no-referrer-when-downgrade', or 'unsafe-url'. Defaulting to 'no-referrer'.
    21
    3 FAIL Test referer header http://localhost:8800/beacon/resources/ assert_equals: Correct referrer header result expected "http://localhost:8800/beacon/headers/header-referrer-origin-when-cross-origin.html" but got ""
    4 FAIL Test referer header http://127.0.0.1:8800/beacon/resources/ assert_equals: Correct referrer header result expected "http://localhost:8800/" but got ""
     2PASS Test referer header http://localhost:8800/beacon/resources/
     3PASS Test referer header http://127.0.0.1:8800/beacon/resources/
    54

  • trunk/LayoutTests/imported/w3c/web-platform-tests/beacon/headers/header-referrer-same-origin-expected.txt

    r220121 r220208  
    1 CONSOLE MESSAGE: line 8: Failed to set referrer policy: The value 'same-origin' is not one of 'no-referrer', 'origin', 'no-referrer-when-downgrade', or 'unsafe-url'. Defaulting to 'no-referrer'.
    21
    3 FAIL Test referer header /beacon/resources/ assert_equals: Correct referrer header result expected "http://localhost:8800/beacon/headers/header-referrer-same-origin.html" but got ""
     2PASS Test referer header /beacon/resources/
    43PASS Test referer header http://127.0.0.1:8800/beacon/resources/
    54

  • trunk/LayoutTests/imported/w3c/web-platform-tests/beacon/headers/header-referrer-strict-origin-when-cross-origin.https-expected.txt

    r220121 r220208  
    1 CONSOLE MESSAGE: line 8: Failed to set referrer policy: The value 'strict-origin' is not one of 'no-referrer', 'origin', 'no-referrer-when-downgrade', or 'unsafe-url'. Defaulting to 'no-referrer'.
    21
    3 FAIL Test referer header https://localhost:9443/beacon/resources/ assert_equals: Correct referrer header result expected "https://localhost:9443/" but got ""
     2PASS Test referer header https://localhost:9443/beacon/resources/
    43PASS Test referer header http://localhost:8800/beacon/resources/
    54

  • trunk/LayoutTests/imported/w3c/web-platform-tests/beacon/headers/header-referrer-strict-origin.https-expected.txt

    r220121 r220208  
    1 CONSOLE MESSAGE: line 8: Failed to set referrer policy: The value 'strict-origin' is not one of 'no-referrer', 'origin', 'no-referrer-when-downgrade', or 'unsafe-url'. Defaulting to 'no-referrer'.
    21
    3 FAIL Test referer header https://localhost:9443/beacon/resources/ assert_equals: Correct referrer header result expected "https://localhost:9443/" but got ""
     2PASS Test referer header https://localhost:9443/beacon/resources/
    43PASS Test referer header http://localhost:8800/beacon/resources/
    54

  • trunk/LayoutTests/imported/w3c/web-platform-tests/beacon/headers/header-referrer-unsafe-url.https-expected.txt

    r220121 r220208  
    11
    2 FAIL Test referer header http://localhost:8800/beacon/resources/ assert_equals: Correct referrer header result expected "https://localhost:9443/beacon/headers/header-referrer-unsafe-url.https.html" but got ""
     2PASS Test referer header http://localhost:8800/beacon/resources/
    33

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt

    r210823 r220208  
    1010PASS Same origin redirection, empty redirect header, unsafe-url init 
    1111PASS Same origin redirection, empty redirect header, no-referrer-when-downgrade init 
    12 FAIL Same origin redirection, empty redirect header, same-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     12PASS Same origin redirection, empty redirect header, same-origin init 
    1313PASS Same origin redirection, empty redirect header, origin init 
    1414PASS Same origin redirection, empty redirect header, origin-when-cross-origin init 
    1515PASS Same origin redirection, empty redirect header, no-referrer init 
    16 FAIL Same origin redirection, empty redirect header, strict-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
    17 FAIL Same origin redirection, empty redirect header, strict-origin-when-cross-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     16PASS Same origin redirection, empty redirect header, strict-origin init 
     17PASS Same origin redirection, empty redirect header, strict-origin-when-cross-origin init 
    1818FAIL Cross origin redirection, empty init, unsafe-url redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
    1919FAIL Cross origin redirection, empty init, no-referrer-when-downgrade redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
    … …  
    2626FAIL Cross origin redirection, empty redirect header, unsafe-url init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
    2727FAIL Cross origin redirection, empty redirect header, no-referrer-when-downgrade init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.html" but got (object) null
    28 FAIL Cross origin redirection, empty redirect header, same-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     28PASS Cross origin redirection, empty redirect header, same-origin init 
    2929FAIL Cross origin redirection, empty redirect header, origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    3030FAIL Cross origin redirection, empty redirect header, origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    3131PASS Cross origin redirection, empty redirect header, no-referrer init 
    32 FAIL Cross origin redirection, empty redirect header, strict-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
    33 FAIL Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     32FAIL Cross origin redirection, empty redirect header, strict-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     33FAIL Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    3434

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt

    r210823 r220208  
    1010PASS Same origin redirection, empty redirect header, unsafe-url init 
    1111PASS Same origin redirection, empty redirect header, no-referrer-when-downgrade init 
    12 FAIL Same origin redirection, empty redirect header, same-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     12PASS Same origin redirection, empty redirect header, same-origin init 
    1313PASS Same origin redirection, empty redirect header, origin init 
    1414PASS Same origin redirection, empty redirect header, origin-when-cross-origin init 
    1515PASS Same origin redirection, empty redirect header, no-referrer init 
    16 FAIL Same origin redirection, empty redirect header, strict-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
    17 FAIL Same origin redirection, empty redirect header, strict-origin-when-cross-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     16PASS Same origin redirection, empty redirect header, strict-origin init 
     17PASS Same origin redirection, empty redirect header, strict-origin-when-cross-origin init 
    1818FAIL Cross origin redirection, empty init, unsafe-url redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
    1919FAIL Cross origin redirection, empty init, no-referrer-when-downgrade redirect header  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
    … …  
    2626FAIL Cross origin redirection, empty redirect header, unsafe-url init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
    2727FAIL Cross origin redirection, empty redirect header, no-referrer-when-downgrade init  assert_equals: Check referrer header expected (string) "http://localhost:8800/fetch/api/redirect/redirect-referrer.js" but got (object) null
    28 FAIL Cross origin redirection, empty redirect header, same-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     28PASS Cross origin redirection, empty redirect header, same-origin init 
    2929FAIL Cross origin redirection, empty redirect header, origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    3030FAIL Cross origin redirection, empty redirect header, origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    3131PASS Cross origin redirection, empty redirect header, no-referrer init 
    32 FAIL Cross origin redirection, empty redirect header, strict-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
    33 FAIL Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init  promise_test: Unhandled rejection with value: object "TypeError: Type error"
     32FAIL Cross origin redirection, empty redirect header, strict-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
     33FAIL Cross origin redirection, empty redirect header, strict-origin-when-cross-origin init  assert_equals: Check referrer header expected (string) "http://localhost:8800/" but got (object) null
    3434

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt

    r217225 r220208  
    1919PASS Check referrerPolicy init value of origin-when-cross-origin and associated getter
    2020PASS Check referrerPolicy init value of unsafe-url and associated getter
    21 FAIL Check referrerPolicy init value of same-origin and associated getter Type error
    22 FAIL Check referrerPolicy init value of strict-origin and associated getter Type error
    23 FAIL Check referrerPolicy init value of strict-origin-when-cross-origin and associated getter Type error
     21PASS Check referrerPolicy init value of same-origin and associated getter
     22PASS Check referrerPolicy init value of strict-origin and associated getter
     23PASS Check referrerPolicy init value of strict-origin-when-cross-origin and associated getter
    2424PASS Check mode init value of same-origin and associated getter
    2525PASS Check mode init value of no-cors and associated getter

  • trunk/Source/WebCore/ChangeLog

    r220207 r220208  
     12017-08-03  Chris Dumez  <cdumez@apple.com>
     2
     3        Improve our support for referrer policies
     4        https://bugs.webkit.org/show_bug.cgi?id=175069
     5        <rdar://problem/33677313>
     6
     7        Reviewed by Darin Adler.
     8
     9        Improve our support for referrer policies. In particular, we now support the
     10        additional following ones: "same-origin", "origin-when-cross-origin" and
     11        "strict-origin-when-cross-origin".
     12
     13        This is as per the following specification:
     14        - https://www.w3.org/TR/referrer-policy/#referrer-policies
     15
     16        Also refactor the code a bit for clarity: I merged the ReferrerPolicy enum and the
     17        FetchOptions::ReferrerPolicy one.
     18
     19        Tests: http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http-http.html
     20               http/tests/referrer-policy/origin-when-cross-origin/cross-origin-http.https.html
     21               http/tests/referrer-policy/origin-when-cross-origin/same-origin.html
     22               http/tests/referrer-policy/same-origin/cross-origin-http-http.html
     23               http/tests/referrer-policy/same-origin/cross-origin-http.https.html
     24               http/tests/referrer-policy/same-origin/same-origin.html
     25               http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http-http.html
     26               http/tests/referrer-policy/strict-origin-when-cross-origin/cross-origin-http.https.html
     27               http/tests/referrer-policy/strict-origin-when-cross-origin/same-origin.html
     28               http/tests/referrer-policy/strict-origin/cross-origin-http-http.html
     29               http/tests/referrer-policy/strict-origin/cross-origin-http.https.html
     30               http/tests/referrer-policy/strict-origin/same-origin.html
     31
     32        * Modules/fetch/FetchLoader.cpp:
     33        (WebCore::FetchLoader::start):
     34        * Modules/fetch/FetchReferrerPolicy.h:
     35        * Modules/fetch/FetchReferrerPolicy.idl:
     36        * Modules/fetch/FetchRequest.h:
     37        * Modules/fetch/FetchRequestInit.h:
     38        * dom/Document.cpp:
     39        (WebCore::Document::processReferrerPolicy):
     40        (WebCore::Document::applyQuickLookSandbox):
     41        (WebCore::Document::applyContentDispositionAttachmentSandbox):
     42        * dom/Document.h:
     43        * loader/FetchOptions.h:
     44        * loader/FrameNetworkingContext.h:
     45        * loader/PingLoader.cpp:
     46        (WebCore::PingLoader::sendBeacon):
     47        Drop explicit call to SecurityPolicy::shouldHideReferrer(). This is already called inside
     48        SecurityPolicy::generateReferrerHeader() and used only when needed, depending on the
     49        actual referrer policy.
     50
     51        * loader/cache/CachedResourceLoader.cpp:
     52        (WebCore::CachedResourceLoader::updateHTTPRequestHeaders):
     53        * loader/cache/CachedResourceRequest.cpp:
     54        (WebCore::CachedResourceRequest::updateReferrerOriginAndUserAgentHeaders):
     55        * page/SecurityPolicy.cpp:
     56        (WebCore::referrerToOriginString):
     57        (WebCore::SecurityPolicy::generateReferrerHeader):
     58        * page/SecurityPolicy.h:
     59        * platform/ReferrerPolicy.h:
     60
    1612017-08-03  Daniel Bates  <dabates@apple.com>
    262

  • trunk/Source/WebCore/Modules/fetch/FetchLoader.cpp

    r212993 r220208  
    9797    String referrer = request.internalRequestReferrer();
    9898    if (referrer == "no-referrer") {
    99         options.referrerPolicy = FetchOptions::ReferrerPolicy::NoReferrer;
     99        options.referrerPolicy = ReferrerPolicy::NoReferrer;
    100100        referrer = String();
    101101    } else

  • trunk/Source/WebCore/Modules/fetch/FetchReferrerPolicy.h

    r220006 r220208  
    2626#pragma once
    2727
    28 #include "FetchOptions.h"
     28#include "ReferrerPolicy.h"
    2929
    3030namespace WebCore {
    3131
    32 using FetchReferrerPolicy = FetchOptions::ReferrerPolicy;
     32using FetchReferrerPolicy = ReferrerPolicy;
    3333
    3434}

  • trunk/Source/WebCore/Modules/fetch/FetchReferrerPolicy.idl

    r220006 r220208  
    2424 */
    2525
    26 enum FetchReferrerPolicy { "", "no-referrer",  "no-referrer-when-downgrade", "origin", "origin-when-cross-origin", "unsafe-url" };
     26// https://w3c.github.io/webappsec-referrer-policy/#referrer-policy
     27enum FetchReferrerPolicy {
     28  "",
     29  "no-referrer",
     30  "no-referrer-when-downgrade",
     31  "same-origin",
     32  "origin",
     33  "strict-origin",
     34  "origin-when-cross-origin",
     35  "strict-origin-when-cross-origin",
     36  "unsafe-url"
     37};

  • trunk/Source/WebCore/Modules/fetch/FetchRequest.h

    r220050 r220208  
    5454    using Mode = FetchOptions::Mode;
    5555    using Redirect = FetchOptions::Redirect;
    56     using ReferrerPolicy = FetchOptions::ReferrerPolicy;
    5756    using Type = FetchOptions::Type;
    5857

  • trunk/Source/WebCore/Modules/fetch/FetchRequestInit.h

    r220050 r220208  
    4040    std::optional<FetchBody::Init> body;
    4141    String referrer;
    42     std::optional<FetchOptions::ReferrerPolicy> referrerPolicy;
     42    std::optional<ReferrerPolicy> referrerPolicy;
    4343    std::optional<FetchOptions::Mode> mode;
    4444    std::optional<FetchOptions::Credentials> credentials;

  • trunk/Source/WebCore/dom/Document.cpp

    r220163 r220208  
    33783378#endif
    33793379
    3380     // Note that we're supporting both the standard and legacy keywords for referrer
    3381     // policies, as defined by http://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-meta
     3380    // "never" / "default" / "always" are legacy keywords that we will support. They were defined in:
     3381    // https://www.w3.org/TR/2014/WD-referrer-policy-20140807/#referrer-policy-delivery-meta
    33823382    if (equalLettersIgnoringASCIICase(policy, "no-referrer") || equalLettersIgnoringASCIICase(policy, "never"))
    3383         setReferrerPolicy(ReferrerPolicy::Never);
     3383        setReferrerPolicy(ReferrerPolicy::NoReferrer);
    33843384    else if (equalLettersIgnoringASCIICase(policy, "unsafe-url") || equalLettersIgnoringASCIICase(policy, "always"))
    3385         setReferrerPolicy(ReferrerPolicy::Always);
     3385        setReferrerPolicy(ReferrerPolicy::UnsafeUrl);
    33863386    else if (equalLettersIgnoringASCIICase(policy, "origin"))
    33873387        setReferrerPolicy(ReferrerPolicy::Origin);
     3388    else if (equalLettersIgnoringASCIICase(policy, "origin-when-cross-origin"))
     3389        setReferrerPolicy(ReferrerPolicy::OriginWhenCrossOrigin);
     3390    else if (equalLettersIgnoringASCIICase(policy, "same-origin"))
     3391        setReferrerPolicy(ReferrerPolicy::SameOrigin);
     3392    else if (equalLettersIgnoringASCIICase(policy, "strict-origin"))
     3393        setReferrerPolicy(ReferrerPolicy::StrictOrigin);
     3394    else if (equalLettersIgnoringASCIICase(policy, "strict-origin-when-cross-origin"))
     3395        setReferrerPolicy(ReferrerPolicy::StrictOriginWhenCrossOrigin);
    33883396    else if (equalLettersIgnoringASCIICase(policy, "no-referrer-when-downgrade") || equalLettersIgnoringASCIICase(policy, "default"))
    3389         setReferrerPolicy(ReferrerPolicy::Default);
     3397        setReferrerPolicy(ReferrerPolicy::NoReferrerWhenDowngrade);
    33903398    else {
    3391         addConsoleMessage(MessageSource::Rendering, MessageLevel::Error, "Failed to set referrer policy: The value '" + policy + "' is not one of 'no-referrer', 'origin', 'no-referrer-when-downgrade', or 'unsafe-url'. Defaulting to 'no-referrer'.");
    3392         setReferrerPolicy(ReferrerPolicy::Never);
     3399        addConsoleMessage(MessageSource::Rendering, MessageLevel::Error, "Failed to set referrer policy: The value '" + policy + "' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'same-origin', 'origin', 'strict-origin', 'origin-when-cross-origin', 'strict-origin-when-cross-origin' or 'unsafe-url'. Defaulting to 'no-referrer'.");
     3400        setReferrerPolicy(ReferrerPolicy::NoReferrer);
    33933401    }
    33943402}
    … …  
    70427050    disableSandboxFlags(SandboxNavigation);
    70437051
    7044     setReferrerPolicy(ReferrerPolicy::Never);
     7052    setReferrerPolicy(ReferrerPolicy::NoReferrer);
    70457053}
    70467054#endif
    … …  
    70637071    ASSERT(shouldEnforceContentDispositionAttachmentSandbox());
    70647072
    7065     setReferrerPolicy(ReferrerPolicy::Never);
     7073    setReferrerPolicy(ReferrerPolicy::NoReferrer);
    70667074    if (!isMediaDocument())
    70677075        enforceSandboxFlags(SandboxAll);

  • trunk/Source/WebCore/dom/Document.h

    r220085 r220208  
    17401740    bool m_userHasInteractedWithMediaElement { false };
    17411741    PageCacheState m_pageCacheState { NotInPageCache };
    1742     ReferrerPolicy m_referrerPolicy { ReferrerPolicy::Default };
     1742    ReferrerPolicy m_referrerPolicy { ReferrerPolicy::NoReferrerWhenDowngrade };
    17431743    ReadyState m_readyState { Complete };
    17441744    SelectionRestorationMode m_updateFocusAppearanceRestoresSelection { SelectionRestorationMode::SetDefault };

  • trunk/Source/WebCore/loader/FetchOptions.h

    r216553 r220208  
    2929#pragma once
    3030
     31#include "ReferrerPolicy.h"
    3132#include <wtf/text/WTFString.h>
    3233
    … …  
    5253    Redirect redirect { Redirect::Follow };
    5354
    54     enum class ReferrerPolicy { EmptyString, NoReferrer, NoReferrerWhenDowngrade, Origin, OriginWhenCrossOrigin, UnsafeUrl };
    5555    ReferrerPolicy referrerPolicy { ReferrerPolicy::EmptyString };
    5656

  • trunk/Source/WebCore/loader/FrameNetworkingContext.h

    r200361 r220208  
    4040            return true;
    4141
    42         return m_frame->document()->referrerPolicy() == ReferrerPolicy::Default;
     42        return m_frame->document()->referrerPolicy() == ReferrerPolicy::NoReferrerWhenDowngrade;
    4343    }
    4444

  • trunk/Source/WebCore/loader/PingLoader.cpp

    r220121 r220208  
    263263
    264264    FrameLoader::addHTTPOriginIfNeeded(request, sourceOrigin.toString());
    265     if (!SecurityPolicy::shouldHideReferrer(url, frame.loader().outgoingReferrer())) {
    266         String referrer = SecurityPolicy::generateReferrerHeader(document.referrerPolicy(), url, frame.loader().outgoingReferrer());
    267         if (!referrer.isEmpty())
    268             request.setHTTPReferrer(referrer);
    269     }
     265    String referrer = SecurityPolicy::generateReferrerHeader(document.referrerPolicy(), url, frame.loader().outgoingReferrer());
     266    if (!referrer.isEmpty())
     267        request.setHTTPReferrer(referrer);
    270268
    271269    request.setAllowCookies(true); // Credentials mode: include.

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r219954 r220208  
    671671        // FIXME: We shouldn't need to do the check on frame.
    672672        if (auto* frame = this->frame())
    673             request.updateReferrerOriginAndUserAgentHeaders(frame->loader(), document() ? document()->referrerPolicy() : ReferrerPolicy::Default);
     673            request.updateReferrerOriginAndUserAgentHeaders(frame->loader(), document() ? document()->referrerPolicy() : ReferrerPolicy::NoReferrerWhenDowngrade);
    674674    }
    675675

  • trunk/Source/WebCore/loader/cache/CachedResourceRequest.cpp

    r213126 r220208  
    233233    }
    234234
    235     // FIXME: Refactor SecurityPolicy::generateReferrerHeader to align with new terminology used in https://w3c.github.io/webappsec-referrer-policy.
    236235    switch (m_options.referrerPolicy) {
    237     case FetchOptions::ReferrerPolicy::EmptyString: {
     236    case ReferrerPolicy::EmptyString:
    238237        outgoingReferrer = SecurityPolicy::generateReferrerHeader(defaultPolicy, m_resourceRequest.url(), outgoingReferrer);
    239         break; }
    240     case FetchOptions::ReferrerPolicy::NoReferrerWhenDowngrade:
    241         outgoingReferrer = SecurityPolicy::generateReferrerHeader(ReferrerPolicy::Default, m_resourceRequest.url(), outgoingReferrer);
    242         break;
    243     case FetchOptions::ReferrerPolicy::NoReferrer:
    244         outgoingReferrer = String();
    245         break;
    246     case FetchOptions::ReferrerPolicy::Origin:
    247         outgoingReferrer = SecurityPolicy::generateReferrerHeader(ReferrerPolicy::Origin, m_resourceRequest.url(), outgoingReferrer);
    248         break;
    249     case FetchOptions::ReferrerPolicy::OriginWhenCrossOrigin:
    250         if (isRequestCrossOrigin(m_origin.get(), m_resourceRequest.url(), m_options))
    251             outgoingReferrer = SecurityPolicy::generateReferrerHeader(ReferrerPolicy::Origin, m_resourceRequest.url(), outgoingReferrer);
    252         break;
    253     case FetchOptions::ReferrerPolicy::UnsafeUrl:
     238        break;
     239    default:
     240        outgoingReferrer = SecurityPolicy::generateReferrerHeader(m_options.referrerPolicy, m_resourceRequest.url(), outgoingReferrer);
    254241        break;
    255242    };

  • trunk/Source/WebCore/page/SecurityPolicy.cpp

    r204466 r220208  
    6868}
    6969
     70static String referrerToOriginString(const String& referrer)
     71{
     72    String originString = SecurityOrigin::createFromString(referrer)->toString();
     73    if (originString == "null")
     74        return String();
     75    // A security origin is not a canonical URL as it lacks a path. Add /
     76    // to turn it into a canonical URL we can use as referrer.
     77    return originString + "/";
     78}
     79
    7080String SecurityPolicy::generateReferrerHeader(ReferrerPolicy referrerPolicy, const URL& url, const String& referrer)
    7181{
    … …  
    7989
    8090    switch (referrerPolicy) {
    81     case ReferrerPolicy::Never:
    82         return String();
    83     case ReferrerPolicy::Always:
     91    case ReferrerPolicy::EmptyString:
     92        ASSERT_NOT_REACHED();
     93        break;
     94    case ReferrerPolicy::NoReferrer:
     95        return String();
     96    case ReferrerPolicy::NoReferrerWhenDowngrade:
     97        break;
     98    case ReferrerPolicy::SameOrigin: {
     99        auto origin = SecurityOrigin::createFromString(referrer);
     100        if (!origin->canRequest(url))
     101            return String();
     102        break;
     103    }
     104    case ReferrerPolicy::Origin:
     105        return referrerToOriginString(referrer);
     106    case ReferrerPolicy::StrictOrigin:
     107        if (shouldHideReferrer(url, referrer))
     108            return String();
     109        return referrerToOriginString(referrer);
     110    case ReferrerPolicy::OriginWhenCrossOrigin: {
     111        auto origin = SecurityOrigin::createFromString(referrer);
     112        if (!origin->canRequest(url))
     113            return referrerToOriginString(referrer);
     114        break;
     115    }
     116    case ReferrerPolicy::StrictOriginWhenCrossOrigin: {
     117        auto origin = SecurityOrigin::createFromString(referrer);
     118        if (!origin->canRequest(url)) {
     119            if (shouldHideReferrer(url, referrer))
     120                return String();
     121            return referrerToOriginString(referrer);
     122        }
     123        break;
     124    }
     125    case ReferrerPolicy::UnsafeUrl:
    84126        return referrer;
    85     case ReferrerPolicy::Origin: {
    86         String origin = SecurityOrigin::createFromString(referrer)->toString();
    87         if (origin == "null")
    88             return String();
    89         // A security origin is not a canonical URL as it lacks a path. Add /
    90         // to turn it into a canonical URL we can use as referrer.
    91         return origin + "/";
    92     }
    93     case ReferrerPolicy::Default:
    94         break;
    95127    }
    96128

  • trunk/Source/WebCore/page/SecurityPolicy.h

    r200361 r220208  
    2929#pragma once
    3030
    31 #include "ReferrerPolicy.h"
     31#include "FetchOptions.h"
    3232#include <wtf/text/WTFString.h>
    3333

  • trunk/Source/WebCore/platform/ReferrerPolicy.h

    r200361 r220208  
    11/*
    22 * Copyright (C) 2012 Google Inc. All rights reserved.
     3 * Copyright (C) 2017 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    3435namespace WebCore {
    3536
    36 // The following is needed to compile on GTK because of a macro defined in X11.h.
    37 // FIXME: Move this workaround to a global location, perhaps config.h; maybe a GTK-specific location.
    38 #undef Always
    39 
    40 // FIXME: Merge this with FetchOptions::ReferrerPolicy, which is the one defined in the Fetch specification.
    4137enum class ReferrerPolicy {
    42     Always,
    43     Default,
    44     Never,
    45     // Same as Always, except that only the origin of the referring URL is sent.
     38    EmptyString,
     39    NoReferrer,
     40    NoReferrerWhenDowngrade,
     41    SameOrigin,
    4642    Origin,
     43    StrictOrigin,
     44    OriginWhenCrossOrigin,
     45    StrictOriginWhenCrossOrigin,
     46    UnsafeUrl
    4747};
    4848

  • trunk/Source/WebKit/ChangeLog

    r220185 r220208  
     12017-08-03  Chris Dumez  <cdumez@apple.com>
     2
     3        Improve our support for referrer policies
     4        https://bugs.webkit.org/show_bug.cgi?id=175069
     5        <rdar://problem/33677313>
     6
     7        Reviewed by Darin Adler.
     8
     9        * WebProcess/Network/WebLoaderStrategy.cpp:
     10        (WebKit::WebLoaderStrategy::loadResource):
     11        (WebKit::WebLoaderStrategy::schedulePluginStreamLoad):
     12
    1132017-08-02  Chris Dumez  <cdumez@apple.com>
    214

  • trunk/Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp

    r219702 r220208  
    8686    RefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, resource, request, options);
    8787    if (loader)
    88         scheduleLoad(*loader, &resource, frame.document()->referrerPolicy() == ReferrerPolicy::Default);
     88        scheduleLoad(*loader, &resource, frame.document()->referrerPolicy() == ReferrerPolicy::NoReferrerWhenDowngrade);
    8989    else
    9090        RELEASE_LOG_IF_ALLOWED(frame, "loadResource: Unable to create SubresourceLoader (frame = %p", &frame);
    … …  
    9696    RefPtr<NetscapePlugInStreamLoader> loader = NetscapePlugInStreamLoader::create(frame, client, request);
    9797    if (loader)
    98         scheduleLoad(*loader, 0, frame.document()->referrerPolicy() == ReferrerPolicy::Default);
     98        scheduleLoad(*loader, 0, frame.document()->referrerPolicy() == ReferrerPolicy::NoReferrerWhenDowngrade);
    9999    return loader;
    100100}
Note: See TracChangeset for help on using the changeset viewer.