Changeset 258660 in webkit


Ignore:
Timestamp:
Mar 18, 2020 12:40:23 PM (4 years ago)
Author:
youenn@apple.com
Message:

CrossOriginPreflightResultCacheItem::allows methods should not use out parameters
​https://bugs.webkit.org/show_bug.cgi?id=209224

Reviewed by Alex Christensen.

Instead of having an out parameter for the error description, either return whether there is an error or not.
Covered by existing tests.

  • loader/CrossOriginPreflightResultCache.cpp:

(WebCore::CrossOriginPreflightResultCacheItem::validateMethodAndHeaders const):
(WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod const):
(WebCore::CrossOriginPreflightResultCacheItem::validateCrossOriginHeaders const):
(WebCore::CrossOriginPreflightResultCacheItem::allowsRequest const):
(WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders const): Deleted.

  • loader/CrossOriginPreflightResultCache.h:
Location:
trunk/Source/WebCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r258655 r258660  
     12020-03-18  Youenn Fablet  <youenn@apple.com>
     2
     3        CrossOriginPreflightResultCacheItem::allows methods should not use out parameters
     4        https://bugs.webkit.org/show_bug.cgi?id=209224
     5
     6        Reviewed by Alex Christensen.
     7
     8        Instead of having an out parameter for the error description, either return whether there is an error or not.
     9        Covered by existing tests.
     10
     11        * loader/CrossOriginPreflightResultCache.cpp:
     12        (WebCore::CrossOriginPreflightResultCacheItem::validateMethodAndHeaders const):
     13        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod const):
     14        (WebCore::CrossOriginPreflightResultCacheItem::validateCrossOriginHeaders const):
     15        (WebCore::CrossOriginPreflightResultCacheItem::allowsRequest const):
     16        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders const): Deleted.
     17        * loader/CrossOriginPreflightResultCache.h:
     18
    1192020-03-18  Peng Liu  <peng.liu6@apple.com>
    220

  • trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.cpp

    r258631 r258660  
    7575Optional<String> CrossOriginPreflightResultCacheItem::validateMethodAndHeaders(const String& method, const HTTPHeaderMap& requestHeaders) const
    7676{
    77     String errorDescription;
    78     if (!allowsCrossOriginMethod(method, m_storedCredentialsPolicy, errorDescription))
    79         return WTFMove(errorDescription);
    80     if (!allowsCrossOriginHeaders(requestHeaders, m_storedCredentialsPolicy, errorDescription))
    81         return WTFMove(errorDescription);
     77    if (!allowsCrossOriginMethod(method, m_storedCredentialsPolicy))
     78        return makeString("Method ", method, " is not allowed by Access-Control-Allow-Methods.");
     79
     80    if (auto badHeader = validateCrossOriginHeaders(requestHeaders, m_storedCredentialsPolicy))
     81        return makeString("Request header field ", *badHeader, " is not allowed by Access-Control-Allow-Headers.");
    8282    return { };
    8383}
    8484
    85 bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method, StoredCredentialsPolicy storedCredentialsPolicy, String& errorDescription) const
     85bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method, StoredCredentialsPolicy storedCredentialsPolicy) const
    8686{
    87     if (m_methods.contains(method) || (m_methods.contains("*") && storedCredentialsPolicy != StoredCredentialsPolicy::Use) || isOnAccessControlSimpleRequestMethodWhitelist(method))
    88         return true;
    89 
    90     errorDescription = "Method " + method + " is not allowed by Access-Control-Allow-Methods.";
    91     return false;
     87    return m_methods.contains(method) || (m_methods.contains("*") && storedCredentialsPolicy != StoredCredentialsPolicy::Use) || isOnAccessControlSimpleRequestMethodWhitelist(method);
    9288}
    9389
    94 bool CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders(const HTTPHeaderMap& requestHeaders, StoredCredentialsPolicy storedCredentialsPolicy, String& errorDescription) const
     90Optional<String> CrossOriginPreflightResultCacheItem::validateCrossOriginHeaders(const HTTPHeaderMap& requestHeaders, StoredCredentialsPolicy storedCredentialsPolicy) const
    9591{
    9692    bool validWildcard = m_headers.contains("*") && storedCredentialsPolicy != StoredCredentialsPolicy::Use;
    … …  
    9894        if (header.keyAsHTTPHeaderName && isCrossOriginSafeRequestHeader(header.keyAsHTTPHeaderName.value(), header.value))
    9995            continue;
    100         if (!m_headers.contains(header.key) && !validWildcard) {
    101             errorDescription = "Request header field " + header.key + " is not allowed by Access-Control-Allow-Headers.";
    102             return false;
    103         }
     96        if (!m_headers.contains(header.key) && !validWildcard)
     97            return header.key;
    10498    }
    105     return true;
     99    return { };
    106100}
    107101
    108102bool CrossOriginPreflightResultCacheItem::allowsRequest(StoredCredentialsPolicy storedCredentialsPolicy, const String& method, const HTTPHeaderMap& requestHeaders) const
    109103{
    110     String ignoredExplanation;
    111104    if (m_absoluteExpiryTime < MonotonicTime::now())
    112105        return false;
    113106    if (storedCredentialsPolicy == StoredCredentialsPolicy::Use && m_storedCredentialsPolicy == StoredCredentialsPolicy::DoNotUse)
    114107        return false;
    115     if (!allowsCrossOriginMethod(method, storedCredentialsPolicy, ignoredExplanation))
     108    if (!allowsCrossOriginMethod(method, storedCredentialsPolicy))
    116109        return false;
    117     if (!allowsCrossOriginHeaders(requestHeaders, storedCredentialsPolicy, ignoredExplanation))
     110    if (auto badHeader = validateCrossOriginHeaders(requestHeaders, storedCredentialsPolicy))
    118111        return false;
    119112    return true;

  • trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.h

    r258631 r258660  
    5151
    5252private:
    53     bool allowsCrossOriginMethod(const String&, StoredCredentialsPolicy, String& errorDescription) const;
    54     bool allowsCrossOriginHeaders(const HTTPHeaderMap&, StoredCredentialsPolicy, String& errorDescription) const;
     53    bool allowsCrossOriginMethod(const String&, StoredCredentialsPolicy) const;
     54    Optional<String> validateCrossOriginHeaders(const HTTPHeaderMap&, StoredCredentialsPolicy) const;
    5555
    5656    // FIXME: A better solution to holding onto the absolute expiration time might be
Note: See TracChangeset for help on using the changeset viewer.