Changeset 86980 in webkit

Timestamp:

May 20, 2011 1:58:34 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-05-20 Adam Barth <​abarth@webkit.org>

Reviewed by Alexey Proskuryakov.

Factor CORS request preparation out of DocumentThreadableLoader
​https://bugs.webkit.org/show_bug.cgi?id=61209

DocumentThreadableLoader has two jobs:

1) Proxy loads between threads.
2) Run the CORS state machine.

This patch begins the work of separating those concerns, allowing CORS
to be used elsewhere in the loading pipeline. In particular, this
patch moves knowledge of how to prepare CORS requests out of
DocumentThreadableLoder.

• loader/CrossOriginAccessControl.cpp: (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist): (WebCore::updateRequestForAccessControl): (WebCore::createAccessControlPreflightRequest):
• loader/CrossOriginAccessControl.h:
• loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/CrossOriginAccessControl.cpp (modified) (2 diffs)
• loader/CrossOriginAccessControl.h (modified) (1 diff)
• loader/DocumentThreadableLoader.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-05-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Factor CORS request preparation out of DocumentThreadableLoader
+        https://bugs.webkit.org/show_bug.cgi?id=61209
+
+        DocumentThreadableLoader has two jobs:
+
+        1) Proxy loads between threads.
+        2) Run the CORS state machine.
+
+        This patch begins the work of separating those concerns, allowing CORS
+        to be used elsewhere in the loading pipeline.  In particular, this
+        patch moves knowledge of how to prepare CORS requests out of
+        DocumentThreadableLoder.
+
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist):
+        (WebCore::updateRequestForAccessControl):
+        (WebCore::createAccessControlPreflightRequest):
+        * loader/CrossOriginAccessControl.h:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+
 2011-05-20  Rob Buis  <rbuis@rim.com>
 

trunk/Source/WebCore/loader/CrossOriginAccessControl.cpp

@@ -44 +44 @@
 bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value)
 {
-    if (equalIgnoringCase(name, "accept") || equalIgnoringCase(name, "accept-language") || equalIgnoringCase(name, "content-language"))
+    if (equalIgnoringCase(name, "accept")
+        || equalIgnoringCase(name, "accept-language")
+        || equalIgnoringCase(name, "content-language")
+        || equalIgnoringCase(name, "origin"))
         return true;
 
@@ -94 +97 @@
 }
 
+void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* securityOrigin, bool allowCredentials)
+{
+    request.removeCredentials();
+    request.setAllowCookies(allowCredentials);
+    request.setHTTPOrigin(securityOrigin->toString());
+}
+
+ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& request, SecurityOrigin* securityOrigin, bool allowCredentials)
+{
+    ResourceRequest preflightRequest(request.url());
+    updateRequestForAccessControl(preflightRequest, securityOrigin, allowCredentials);
+    preflightRequest.setHTTPMethod("OPTIONS");
+    preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", request.httpMethod());
+    preflightRequest.setPriority(request.priority());
+
+    const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
+
+    if (requestHeaderFields.size() > 0) {
+        Vector<UChar> headerBuffer;
+        HTTPHeaderMap::const_iterator it = requestHeaderFields.begin();
+        append(headerBuffer, it->first);
+        ++it;
+
+        HTTPHeaderMap::const_iterator end = requestHeaderFields.end();
+        for (; it != end; ++it) {
+            headerBuffer.append(',');
+            headerBuffer.append(' ');
+            append(headerBuffer, it->first);
+        }
+
+        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
+    }
+
+    return preflightRequest;
+}
+
 bool passesAccessControlCheck(const ResourceResponse& response, bool includeCredentials, SecurityOrigin* securityOrigin, String& errorDescription)
 {

trunk/Source/WebCore/loader/CrossOriginAccessControl.h

@@ -28 +28 @@
 #define CrossOriginAccessControl_h
 
+#include "ResourceRequest.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
-    class HTTPHeaderMap;
-    class ResourceResponse;
-    class SecurityOrigin;
+class HTTPHeaderMap;
+class ResourceResponse;
+class SecurityOrigin;
 
-    bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap&);
-    bool isOnAccessControlSimpleRequestMethodWhitelist(const String&);
-    bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value);
-    bool isOnAccessControlResponseHeaderWhitelist(const String&);
+bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap&);
+bool isOnAccessControlSimpleRequestMethodWhitelist(const String&);
+bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value);
+bool isOnAccessControlResponseHeaderWhitelist(const String&);
 
-    bool passesAccessControlCheck(const ResourceResponse&, bool includeCredentials, SecurityOrigin*, String& errorDescription);
+void updateRequestForAccessControl(ResourceRequest&, SecurityOrigin*, bool allowCredentials);
+ResourceRequest createAccessControlPreflightRequest(const ResourceRequest&, SecurityOrigin*, bool allowCredentials);
+
+bool passesAccessControlCheck(const ResourceResponse&, bool includeCredentials, SecurityOrigin*, String& errorDescription);
 
 } // namespace WebCore

trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

@@ -90 +90 @@
 
     OwnPtr<ResourceRequest> crossOriginRequest = adoptPtr(new ResourceRequest(request));
-    crossOriginRequest->removeCredentials();
-    crossOriginRequest->setAllowCookies(m_options.allowCredentials);
+    updateRequestForAccessControl(*crossOriginRequest, m_document->securityOrigin(), m_options.allowCredentials);
 
     if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(crossOriginRequest->httpMethod(), crossOriginRequest->httpHeaderFields()))
@@ -110 +109 @@
 
     // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
+    // FIXME: Consider allowing simple CORS requests to non-HTTP URLs.
     if (!request.url().protocolInHTTPFamily()) {
         m_client->didFail(ResourceError(errorDomainWebKitInternal, 0, request.url().string(), "Cross origin requests are only supported for HTTP."));
@@ -115 +115 @@
     }
 
-    // Make a copy of the passed request so that we can modify some details.
-    ResourceRequest crossOriginRequest(request);
-    crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
-
-    loadRequest(crossOriginRequest, DoSecurityCheck);
+    loadRequest(request, DoSecurityCheck);
 }
 
 void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request)
 {
-    ResourceRequest preflightRequest(request.url());
-    preflightRequest.removeCredentials();
-    preflightRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
-    preflightRequest.setAllowCookies(m_options.allowCredentials);
-    preflightRequest.setHTTPMethod("OPTIONS");
-    preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", request.httpMethod());
-
-    const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
-
-    if (requestHeaderFields.size() > 0) {
-        Vector<UChar> headerBuffer;
-        HTTPHeaderMap::const_iterator it = requestHeaderFields.begin();
-        append(headerBuffer, it->first);
-        ++it;
-
-        HTTPHeaderMap::const_iterator end = requestHeaderFields.end();
-        for (; it != end; ++it) {
-            headerBuffer.append(',');
-            headerBuffer.append(' ');
-            append(headerBuffer, it->first);
-        }
-
-        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
-    }
-
-    preflightRequest.setPriority(request.priority());
-
+    ResourceRequest preflightRequest = createAccessControlPreflightRequest(request, m_document->securityOrigin(), m_options.allowCredentials);
     loadRequest(preflightRequest, DoSecurityCheck);
 }