Changeset 224369 in webkit

Timestamp:

Nov 2, 2017 6:36:37 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Do not check for CORS in case response is coming from a service worker
​https://bugs.webkit.org/show_bug.cgi?id=179177

Patch by Youenn Fablet <​youenn@apple.com> on 2017-11-02
Reviewed by Chris Dumez.

Source/WebCore:

Test: http/tests/workers/service/cors-image-fetch.html

As per fetch spec, CORS check (​https://fetch.spec.whatwg.org/#cors-check) is done
within HTTP fetch (​https://fetch.spec.whatwg.org/#http-fetch).
It does not apply to fetches handled by service workers.

• loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::checkResponseCrossOriginAccessControl):

LayoutTests:

• http/tests/workers/service/cors-image-fetch-expected.txt: Added.
• http/tests/workers/service/cors-image-fetch.html: Added.
• http/tests/workers/service/resources/cors-image-fetch-worker.js: Added.
• http/tests/workers/service/resources/cors-image-fetch.js: Added.
• http/tests/workers/service/resources/tainted-image-fetch.js: Added.
• http/tests/workers/service/tainted-image-fetch-expected.txt: Added.
• http/tests/workers/service/tainted-image-fetch.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/workers/service/cors-image-fetch-expected.txt (added)
• LayoutTests/http/tests/workers/service/cors-image-fetch.html (added)
• LayoutTests/http/tests/workers/service/resources/cors-image-fetch-worker.js (added)
• LayoutTests/http/tests/workers/service/resources/cors-image-fetch.js (added)
• LayoutTests/http/tests/workers/service/resources/tainted-image-fetch.js (added)
• LayoutTests/http/tests/workers/service/tainted-image-fetch-expected.txt (added)
• LayoutTests/http/tests/workers/service/tainted-image-fetch.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/SubresourceLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-11-02  Youenn Fablet  <youenn@apple.com>
+
+        Do not check for CORS in case response is coming from a service worker
+        https://bugs.webkit.org/show_bug.cgi?id=179177
+
+        Reviewed by Chris Dumez.
+
+        * http/tests/workers/service/cors-image-fetch-expected.txt: Added.
+        * http/tests/workers/service/cors-image-fetch.html: Added.
+        * http/tests/workers/service/resources/cors-image-fetch-worker.js: Added.
+        * http/tests/workers/service/resources/cors-image-fetch.js: Added.
+        * http/tests/workers/service/resources/tainted-image-fetch.js: Added.
+        * http/tests/workers/service/tainted-image-fetch-expected.txt: Added.
+        * http/tests/workers/service/tainted-image-fetch.html: Added.
+
 2017-11-02  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-11-02  Youenn Fablet  <youenn@apple.com>
+
+        Do not check for CORS in case response is coming from a service worker
+        https://bugs.webkit.org/show_bug.cgi?id=179177
+
+        Reviewed by Chris Dumez.
+
+        Test: http/tests/workers/service/cors-image-fetch.html
+
+        As per fetch spec, CORS check (https://fetch.spec.whatwg.org/#cors-check) is done
+        within HTTP fetch (https://fetch.spec.whatwg.org/#http-fetch).
+        It does not apply to fetches handled by service workers.
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::checkResponseCrossOriginAccessControl):
+
 2017-11-02  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/WebCore/loader/SubresourceLoader.cpp

@@ -479 +479 @@
         return true;
 
+#if ENABLE(SERVICE_WORKER)
+    if (response.source() == ResourceResponse::Source::ServiceWorker)
+        return true;
+#endif
+
     ASSERT(m_origin);
     return passesAccessControlCheck(response, options().storedCredentialsPolicy, *m_origin, errorDescription);