Attachment 282769 Details for Bug 159413 – Patch

[patch] Patch

bug-159413-20160705135257.patch (text/plain), 38.02 KB, created by youenn fablet on 2016-07-05 04:53:28 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: youenn fablet

Created: 2016-07-05 04:53:28 PDT

Size: 38.02 KB

patch

obsolete

>Subversion Revision: 202815
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 28dc34fd31c8742570536407d0c87a9bf43d2eda..dd4c007575adce77fc6dbbf5e845538b2feeb96c 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,5 +1,65 @@
> 2016-07-05  Youenn Fablet  <youenn@apple.com>
> 
>+        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
>+        https://bugs.webkit.org/show_bug.cgi?id=159413
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        ClientCredentialPolicy had three values (not ask, ask, ask only for same origin).
>+        The distinction between allowing cross-origin or same-origin credentials is misleading as it is not supported
>+        for synchronous loads and not supported by Network process.
>+        It is best replaced by a boolean option (ask or not ask).
>+
>+        Same-origin ClientCredentialPolicy option was only used by DocumentThreadableLoader for asynchronous loads.
>+        Since DocumentThreadableLoader is already computing whether the request is cross-origin, it can also computes
>+        whther credentials may be requested or not. In case of cross-origin redirections, credentials are omitted, thus
>+        disabling any possibility for requesting credentials for cross-origin resources after redirections.
>+
>+        Moving ClientCredentialPolicy to ResourceLoaderOptions since it is not used by platform code except for some
>+        mac-specific code that is already using ResourceLoaderOptions.
>+
>+        Covered by existing tests.
>+
>+        * loader/CrossOriginPreflightChecker.cpp:
>+        (WebCore::CrossOriginPreflightChecker::startPreflight): Setting clearly credential mode to Omit credentials.
>+        (WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
>+        * loader/DocumentLoader.cpp:
>+        (WebCore::DocumentLoader::startLoadingMainResource): AskClientForAllCredentials ->
>+        ClientCredentialPolicy::MayAskClientForCredentials.
>+        * loader/DocumentThreadableLoader.cpp:
>+        (WebCore::DocumentThreadableLoader::loadRequest): Disabling requesting credentials for any cross-origin request.
>+        * loader/FrameLoader.h:
>+        * loader/MediaResourceLoader.cpp:
>+        (WebCore::MediaResourceLoader::requestResource): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
>+        * loader/NetscapePlugInStreamLoader.cpp:
>+        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.
>+        * loader/ResourceLoader.cpp:
>+        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Disabling client credential request if ClientCredentialPolicy is CannotAskClientForCredentials.
>+        Otherwise, returns true if fetch credentials mode allows it.
>+        * loader/ResourceLoaderOptions.h:
>+        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
>+        (WebCore::ResourceLoaderOptions::clientCredentialPolicy): Deleted.
>+        (WebCore::ResourceLoaderOptions::setClientCredentialPolicy): Deleted.
>+        * loader/cache/CachedResourceLoader.cpp:
>+        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
>+        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
>+        * loader/icon/IconLoader.cpp:
>+        (WebCore::IconLoader::startLoading): DoNotAskClientForAnyCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
>+        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
>+        (WebCore::WebCoreAVCFResourceLoader::startLoading): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
>+        This is ok as credentials mode is omit and stored credentials are not allowed.
>+        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
>+        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
>+        * platform/network/ResourceHandleTypes.h:
>+        * xml/XSLTProcessorLibxslt.cpp: DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
>+        This is ok as this is a synchronous load.
>+        (WebCore::docLoaderFunc):
>+        * xml/parser/XMLDocumentParserLibxml2.cpp:
>+        (WebCore::openFunc): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
>+        This is ok as this is a synchronous load.
>+
>+2016-07-05  Youenn Fablet  <youenn@apple.com>
>+
>         Remove CredentialRequest ResourceLoaderOptions
>         https://bugs.webkit.org/show_bug.cgi?id=159404
> 
>diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
>index 0dff5183c304cad983379d68f75ea713f9e7c8c8..85ff22c79f6ccc20bdbbab6075522e6ed5e8eb90 100644
>--- a/Source/WebKit2/ChangeLog
>+++ b/Source/WebKit2/ChangeLog
>@@ -1,3 +1,27 @@
>+2016-07-05  Youenn Fablet  <youenn@apple.com>
>+
>+        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
>+        https://bugs.webkit.org/show_bug.cgi?id=159413
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Renaming of ClientCredentialPolicy values.
>+
>+        * NetworkProcess/Downloads/DownloadManager.cpp:
>+        (WebKit::DownloadManager::startDownload):
>+        * NetworkProcess/NetworkLoad.cpp:
>+        (WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):
>+        (WebKit::NetworkLoad::didReceiveAuthenticationChallenge):
>+        * NetworkProcess/NetworkLoadParameters.h:
>+        * NetworkProcess/NetworkResourceLoadParameters.cpp:
>+        (WebKit::NetworkResourceLoadParameters::NetworkResourceLoadParameters):
>+        * NetworkProcess/NetworkResourceLoader.cpp:
>+        (WebKit::NetworkResourceLoader::NetworkResourceLoader):
>+        * WebProcess/Network/WebLoaderStrategy.cpp:
>+        (WebKit::WebLoaderStrategy::scheduleLoad):
>+        * WebProcess/Network/WebResourceLoader.cpp:
>+        (WebKit::WebResourceLoader::willSendRequest):
>+
> 2016-07-04  Carlos Garcia Campos  <cgarcia@igalia.com>
> 
>         [Coordinated Graphics] Modernize and cleanup CompositingCoordinator
>diff --git a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp b/Source/WebCore/loader/CrossOriginPreflightChecker.cpp
>index 43309f425568fd5f56e5ce5d33ec2da7c666f0db..42cebab0f7cf858490f63dc718368351c60bde5a 100644
>--- a/Source/WebCore/loader/CrossOriginPreflightChecker.cpp
>+++ b/Source/WebCore/loader/CrossOriginPreflightChecker.cpp
>@@ -101,7 +101,7 @@ void CrossOriginPreflightChecker::notifyFinished(CachedResource* resource)
> void CrossOriginPreflightChecker::startPreflight()
> {
>     auto options = m_loader.options();
>-    options.setClientCredentialPolicy(DoNotAskClientForCrossOriginCredentials);
>+    options.credentials = FetchOptions::Credentials::Omit;
>     options.setSecurityCheck(DoSecurityCheck);
>     // Don't sniff content or send load callbacks for the preflight request.
>     options.setSendLoadCallbacks(DoNotSendCallbacks);
>@@ -130,7 +130,7 @@ void CrossOriginPreflightChecker::doPreflight(DocumentThreadableLoader& loader,
>     ResourceError error;
>     ResourceResponse response;
>     RefPtr<SharedBuffer> data;
>-    unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);
>+    unsigned identifier = loader.document().frame()->loader().loadResourceSynchronously(preflightRequest, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, error, response, data);
> 
>     if (!error.isNull() && response.httpStatusCode() <= 0) {
>         error.setType(ResourceError::Type::AccessControl);
>diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
>index a5359181b12ec1b54679b115fdb0c87dc42e0fb1..805de57efa27434ab9e1d4f49f3609c3f057d724 100644
>--- a/Source/WebCore/loader/DocumentLoader.cpp
>+++ b/Source/WebCore/loader/DocumentLoader.cpp
>@@ -1510,7 +1510,7 @@ void DocumentLoader::startLoadingMainResource()
>     // If this is a reload the cache layer might have made the previous request conditional. DocumentLoader can't handle 304 responses itself.
>     request.makeUnconditional();
> 
>-    static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
>+    static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
>     CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);
>     cachedResourceRequest.setInitiator(*this);
>     m_mainResource = m_cachedResourceLoader->requestMainResource(cachedResourceRequest);
>diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
>index bb736d1a445ced322b22b3c5c7813c23a245dc79..7a92aba98a110711610f66bd8854bc72ae564af8 100644
>--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
>+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
>@@ -354,7 +354,7 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur
> 
>     if (m_async) {
>         ThreadableLoaderOptions options = m_options;
>-        options.setClientCredentialPolicy(DoNotAskClientForCrossOriginCredentials);
>+        options.clientCredentialPolicy = m_sameOriginRequest ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
> 
>         CachedResourceRequest newRequest(request, options);
>         if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
>@@ -373,7 +373,7 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur
>     ResourceResponse response;
>     unsigned long identifier = std::numeric_limits<unsigned long>::max();
>     if (m_document.frame())
>-        identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy(), error, response, data);
>+        identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy, error, response, data);
> 
>     if (!error.isNull() && response.httpStatusCode() <= 0) {
>         if (requestURL.isLocalFile()) {
>diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
>index 0f08e776a22d67f2432426f21e0ff7cd21b39410..0d5b98135ece3e8d4d4110c9374058f09394dbf2 100644
>--- a/Source/WebCore/loader/FrameLoader.h
>+++ b/Source/WebCore/loader/FrameLoader.h
>@@ -39,6 +39,7 @@
> #include "PageThrottler.h"
> #include "ResourceHandleTypes.h"
> #include "ResourceLoadNotifier.h"
>+#include "ResourceLoaderOptions.h"
> #include "ResourceRequestBase.h"
> #include "SecurityContext.h"
> #include "Timer.h"
>diff --git a/Source/WebCore/loader/MediaResourceLoader.cpp b/Source/WebCore/loader/MediaResourceLoader.cpp
>index dc53016e050c325874d63ff8fe657af0d228bf91..9c5722db0c5ab6633d250df74bb78a19e4577d8b 100644
>--- a/Source/WebCore/loader/MediaResourceLoader.cpp
>+++ b/Source/WebCore/loader/MediaResourceLoader.cpp
>@@ -66,7 +66,7 @@ RefPtr<PlatformMediaResource> MediaResourceLoader::requestResource(const Resourc
>     auto cachingPolicy = options & LoadOption::DisallowCaching ? CachingPolicy::DisallowCaching : CachingPolicy::AllowCaching;
> 
>     // FIXME: Skip Content Security Policy check if the element that inititated this request is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.
>-    CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, cachingPolicy));
>+    CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, cachingPolicy));
> 
>     cacheRequest.setAsPotentiallyCrossOrigin(m_crossOriginMode, *m_document);
> 
>diff --git a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp b/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
>index da4084e260bd7c7b8d90378b8384e9e701a52e9c..6b9a344ea286a8ed0137ef49633a4923863517de 100644
>--- a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
>+++ b/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
>@@ -43,7 +43,7 @@ namespace WebCore {
> // FIXME: Skip Content Security Policy check when associated plugin element is in a user agent shadow tree.
> // See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
> NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame& frame, NetscapePlugInStreamLoaderClient& client)
>-    : ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching))
>+    : ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching))
>     , m_client(&client)
> {
> #if ENABLE(CONTENT_EXTENSIONS)
>diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
>index 3609acfd90b6ca90688730265c1cd56c86dad211..006182e61d7c2d9ed473af20deee25a7a7c6567c 100644
>--- a/Source/WebCore/loader/ResourceLoader.cpp
>+++ b/Source/WebCore/loader/ResourceLoader.cpp
>@@ -687,7 +687,9 @@ bool ResourceLoader::shouldUseCredentialStorage()
> 
> bool ResourceLoader::isAllowedToAskUserForCredentials() const
> {
>-    return m_options.clientCredentialPolicy() == AskClientForAllCredentials || (m_options.clientCredentialPolicy() == DoNotAskClientForCrossOriginCredentials && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));
>+    if (m_options.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials)
>+        return false;
>+    return m_options.credentials == FetchOptions::Credentials::Include || (m_options.credentials == FetchOptions::Credentials::SameOrigin && m_frame->document()->securityOrigin()->canRequest(originalRequest().url()));
> }
> 
> void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
>diff --git a/Source/WebCore/loader/ResourceLoaderOptions.h b/Source/WebCore/loader/ResourceLoaderOptions.h
>index 74a047cf0749b1db96aa8d8d07974c53aee24b09..e7d5c27f134f9ef179f3fb538e3cbdf00d71e4e7 100644
>--- a/Source/WebCore/loader/ResourceLoaderOptions.h
>+++ b/Source/WebCore/loader/ResourceLoaderOptions.h
>@@ -75,13 +75,17 @@ enum class CachingPolicy : uint8_t {
>     DisallowCaching
> };
> 
>+enum class ClientCredentialPolicy : uint8_t {
>+    CannotAskClientForCredentials,
>+    MayAskClientForCredentials
>+};
>+
> struct ResourceLoaderOptions : public FetchOptions {
>     ResourceLoaderOptions()
>         : m_sendLoadCallbacks(DoNotSendCallbacks)
>         , m_sniffContent(DoNotSniffContent)
>         , m_dataBufferingPolicy(BufferData)
>         , m_allowCredentials(DoNotAllowStoredCredentials)
>-        , m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
>         , m_securityCheck(DoSecurityCheck)
>         , m_certificateInfoPolicy(DoNotIncludeCertificateInfo)
>     {
>@@ -92,12 +96,12 @@ struct ResourceLoaderOptions : public FetchOptions {
>         , m_sniffContent(sniffContent)
>         , m_dataBufferingPolicy(dataBufferingPolicy)
>         , m_allowCredentials(allowCredentials)
>-        , m_clientCredentialPolicy(credentialPolicy)
>         , m_securityCheck(securityCheck)
>         , m_certificateInfoPolicy(certificateInfoPolicy)
>         , m_contentSecurityPolicyImposition(contentSecurityPolicyImposition)
>         , m_defersLoadingPolicy(defersLoadingPolicy)
>         , m_cachingPolicy(cachingPolicy)
>+        , clientCredentialPolicy(credentialPolicy)
>     {
>         this->credentials = credentials;
>         this->mode = mode;
>@@ -111,8 +115,6 @@ struct ResourceLoaderOptions : public FetchOptions {
>     void setDataBufferingPolicy(DataBufferingPolicy policy) { m_dataBufferingPolicy = policy; }
>     StoredCredentials allowCredentials() const { return static_cast<StoredCredentials>(m_allowCredentials); }
>     void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }
>-    ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
>-    void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
>     SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
>     void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
>     CertificateInfoPolicy certificateInfoPolicy() const { return static_cast<CertificateInfoPolicy>(m_certificateInfoPolicy); }
>@@ -128,12 +130,13 @@ struct ResourceLoaderOptions : public FetchOptions {
>     unsigned m_sniffContent : 1;
>     unsigned m_dataBufferingPolicy : 1;
>     unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
>-    unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
>     unsigned m_securityCheck : 1;
>     unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.
>     ContentSecurityPolicyImposition m_contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };
>     DefersLoadingPolicy m_defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };
>     CachingPolicy m_cachingPolicy { CachingPolicy::AllowCaching };
>+
>+    ClientCredentialPolicy clientCredentialPolicy { ClientCredentialPolicy::CannotAskClientForCredentials };
> };
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
>index 4733bf2fdfe4b694c5c984e92ac7ae3bb7685638..1fd08507be8820052d3229e124abb4f06d38afff 100644
>--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
>+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
>@@ -241,7 +241,7 @@ CachedResourceHandle<CachedCSSStyleSheet> CachedResourceLoader::requestUserCSSSt
>         memoryCache.add(*userSheet);
>     // FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?
> 
>-    userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
>+    userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, SkipSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
>     
>     return userSheet;
> }
>@@ -1190,7 +1190,7 @@ void CachedResourceLoader::printPreloadStats()
> 
> const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
> {
>-    static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
>+    static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
>     return options;
> }
> 
>diff --git a/Source/WebCore/loader/icon/IconLoader.cpp b/Source/WebCore/loader/icon/IconLoader.cpp
>index a2b1d87cba7fda850b26e559d25835a2daca6d92..0be6347e8573bfb18860e594509dfdd5212aa54c 100644
>--- a/Source/WebCore/loader/icon/IconLoader.cpp
>+++ b/Source/WebCore/loader/icon/IconLoader.cpp
>@@ -59,7 +59,7 @@ void IconLoader::startLoading()
>         return;
> 
>     // ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
>-    CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
>+    CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching));
> 
>     request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
>     request.setInitiator(cachedResourceRequestInitiators().icon);
>diff --git a/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp b/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp
>index 7a97adab351a221508342e238327eb23f6f92a23..033642761238a1f76be538488a6f434fc050c360 100644
>--- a/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp
>+++ b/Source/WebCore/platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp
>@@ -71,7 +71,7 @@ void WebCoreAVCFResourceLoader::startLoading()
>     RetainPtr<CFURLRequestRef> urlRequest = AVCFAssetResourceLoadingRequestGetURLRequest(m_avRequest.get());
> 
>     // ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
>-    CachedResourceRequest request(ResourceRequest(urlRequest.get()), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
>+    CachedResourceRequest request(ResourceRequest(urlRequest.get()), ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
> 
>     request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
>     CachedResourceLoader* loader = m_parent->player()->cachedResourceLoader();
>diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm b/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm
>index 9f075ec6e709f06cebef9f45de59e14d935367e0..0794ae3b3f9e74d2ad7e20432227dd0bbcb57462 100644
>--- a/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm
>+++ b/Source/WebCore/platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm
>@@ -69,7 +69,7 @@ void WebCoreAVFResourceLoader::startLoading()
> 
>     // FIXME: Skip Content Security Policy check if the element that inititated this request
>     // is in a user-agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505>.
>-    CachedResourceRequest request(nsRequest, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
>+    CachedResourceRequest request(nsRequest, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, BufferData, DoNotAllowStoredCredentials, ClientCredentialPolicy::CannotAskClientForCredentials, FetchOptions::Credentials::Omit, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::DisallowCaching));
>     request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
>     if (auto* loader = m_parent->player()->cachedResourceLoader())
>         m_resource = loader->requestMedia(request);
>diff --git a/Source/WebCore/platform/network/ResourceHandleTypes.h b/Source/WebCore/platform/network/ResourceHandleTypes.h
>index 0c31f92e6d6b47d1739662ba07217d9583c32508..870e7957d48fc53b3ab588022b4dcee00cff7873 100644
>--- a/Source/WebCore/platform/network/ResourceHandleTypes.h
>+++ b/Source/WebCore/platform/network/ResourceHandleTypes.h
>@@ -33,12 +33,6 @@ enum StoredCredentials {
>     DoNotAllowStoredCredentials
> };
> 
>-enum ClientCredentialPolicy {
>-    AskClientForAllCredentials,
>-    DoNotAskClientForCrossOriginCredentials,
>-    DoNotAskClientForAnyCredentials
>-};
>-
> } // namespace WebCore
> 
> #endif // ResourceHandleTypes_h
>diff --git a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp b/Source/WebCore/xml/XSLTProcessorLibxslt.cpp
>index e4a33d0e595c7c4cd9b7791915ed78b35992c887..b726b4d7c4739b17e10b7bd2de52b85131fc2d35 100644
>--- a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp
>+++ b/Source/WebCore/xml/XSLTProcessorLibxslt.cpp
>@@ -127,7 +127,7 @@ static xmlDocPtr docLoaderFunc(const xmlChar* uri,
> 
>         bool requestAllowed = globalCachedResourceLoader->frame() && globalCachedResourceLoader->document()->securityOrigin()->canRequest(url);
>         if (requestAllowed) {
>-            globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);
>+            globalCachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
>             if (error.isNull())
>                 requestAllowed = globalCachedResourceLoader->document()->securityOrigin()->canRequest(response.url());
>             else if (data)
>diff --git a/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp b/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
>index 5c2eb6e10bd15ff6158cd39fd799be096cd229fd..5d6bd67114e219087106c4d9fe24ccc1381b6f2c 100644
>--- a/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
>+++ b/Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
>@@ -463,7 +463,7 @@ static void* openFunc(const char* uri)
>         // FIXME: We should restore the original global error handler as well.
> 
>         if (cachedResourceLoader->frame())
>-            cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, DoNotAskClientForCrossOriginCredentials, error, response, data);
>+            cachedResourceLoader->frame()->loader().loadResourceSynchronously(url, AllowStoredCredentials, ClientCredentialPolicy::MayAskClientForCredentials, error, response, data);
>     }
> 
>     // We have to check the URL again after the load to catch redirects.
>diff --git a/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp b/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp
>index dedf11059df985ea8d58d367d870310ec501c215..6f355e9650ee2d96cca6a1d49b7bdf809e65effc 100644
>--- a/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp
>+++ b/Source/WebKit2/NetworkProcess/Downloads/DownloadManager.cpp
>@@ -53,7 +53,7 @@ void DownloadManager::startDownload(SessionID sessionID, DownloadID downloadID,
>     NetworkLoadParameters parameters;
>     parameters.sessionID = sessionID;
>     parameters.request = request;
>-    parameters.clientCredentialPolicy = AskClientForAllCredentials;
>+    parameters.clientCredentialPolicy = ClientCredentialPolicy::MayAskClientForCredentials;
>     m_pendingDownloads.add(downloadID, std::make_unique<PendingDownload>(WTFMove(parameters), downloadID));
> #else
>     auto download = std::make_unique<Download>(*this, downloadID, request, suggestedName);
>diff --git a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp b/Source/WebKit2/NetworkProcess/NetworkLoad.cpp
>index dbf186917cdf290b8199e717d08ec0799cfea4a8..087099633dd49a7a1b505463958bc04b50ce99dd 100644
>--- a/Source/WebKit2/NetworkProcess/NetworkLoad.cpp
>+++ b/Source/WebKit2/NetworkProcess/NetworkLoad.cpp
>@@ -214,9 +214,6 @@ void NetworkLoad::willPerformHTTPRedirection(ResourceResponse&& response, Resour
> 
> void NetworkLoad::didReceiveChallenge(const AuthenticationChallenge& challenge, ChallengeCompletionHandler&& completionHandler)
> {
>-    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
>-    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
>-
>     // Handle server trust evaluation at platform-level if requested, for performance reasons.
>     if (challenge.protectionSpace().authenticationScheme() == ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested
>         && !NetworkProcess::singleton().canHandleHTTPSServerTrustEvaluation()) {
>@@ -353,7 +350,7 @@ void NetworkLoad::continueCanAuthenticateAgainstProtectionSpace(bool result)
>         return;
>     }
> 
>-    if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {
>+    if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
>         completionHandler(AuthenticationChallengeDisposition::UseCredential, { });
>         return;
>     }
>@@ -420,10 +417,8 @@ bool NetworkLoad::shouldUseCredentialStorage(ResourceHandle* handle)
> void NetworkLoad::didReceiveAuthenticationChallenge(ResourceHandle* handle, const AuthenticationChallenge& challenge)
> {
>     ASSERT_UNUSED(handle, handle == m_handle);
>-    // NetworkResourceLoader does not know whether the request is cross origin, so Web process computes an applicable credential policy for it.
>-    ASSERT(m_parameters.clientCredentialPolicy != DoNotAskClientForCrossOriginCredentials);
> 
>-    if (m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials) {
>+    if (m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials) {
>         challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
>         return;
>     }
>diff --git a/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h b/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h
>index 130aaa348540c131ece0c8a11a493a0d32c88f5e..d8f891f65194fe254ed698d86a9adf140206b9ba 100644
>--- a/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h
>+++ b/Source/WebKit2/NetworkProcess/NetworkLoadParameters.h
>@@ -45,7 +45,7 @@ public:
>     WebCore::ResourceRequest request;
>     WebCore::ContentSniffingPolicy contentSniffingPolicy { WebCore::SniffContent };
>     WebCore::StoredCredentials allowStoredCredentials { WebCore::DoNotAllowStoredCredentials };
>-    WebCore::ClientCredentialPolicy clientCredentialPolicy { WebCore::DoNotAskClientForAnyCredentials };
>+    WebCore::ClientCredentialPolicy clientCredentialPolicy { WebCore::ClientCredentialPolicy::CannotAskClientForCredentials };
>     bool shouldClearReferrerOnHTTPSToHTTPRedirect { true };
>     bool defersLoading { false };
>     bool needsCertificateInfo { false };
>diff --git a/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp b/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp
>index 0f16df49678f851bec15c31424d119bc628ec823..fbf4750feb03311d13a916a116c1e62c9451f244 100644
>--- a/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp
>+++ b/Source/WebKit2/NetworkProcess/NetworkResourceLoadParameters.cpp
>@@ -41,7 +41,7 @@ NetworkResourceLoadParameters::NetworkResourceLoadParameters()
>     , sessionID(SessionID::emptySessionID())
>     , contentSniffingPolicy(SniffContent)
>     , allowStoredCredentials(DoNotAllowStoredCredentials)
>-    , clientCredentialPolicy(DoNotAskClientForAnyCredentials)
>+    , clientCredentialPolicy(ClientCredentialPolicy::CannotAskClientForCredentials)
>     , shouldClearReferrerOnHTTPSToHTTPRedirect(true)
>     , defersLoading(false)
>     , needsCertificateInfo(false)
>diff --git a/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp b/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp
>index 68946614d412797d59ed2d887f317d9e4945c72f..1dcae3c42d00d0134c9456483797759e423dc740 100644
>--- a/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp
>+++ b/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp
>@@ -86,7 +86,7 @@ NetworkResourceLoader::NetworkResourceLoader(const NetworkResourceLoadParameters
>     ASSERT(RunLoop::isMain());
>     // FIXME: This is necessary because of the existence of EmptyFrameLoaderClient in WebCore.
>     //        Once bug 116233 is resolved, this ASSERT can just be "m_webPageID && m_webFrameID"
>-    ASSERT((m_parameters.webPageID && m_parameters.webFrameID) || m_parameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials);
>+    ASSERT((m_parameters.webPageID && m_parameters.webFrameID) || m_parameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);
> 
>     if (originalRequest().httpBody()) {
>         for (const auto& element : originalRequest().httpBody()->elements()) {
>diff --git a/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp b/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp
>index fea2e75522df075f303f00121c03611e7da74fa4..fa98080fef785ceb15ad8332563c699d4aa6e0e9 100644
>--- a/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp
>+++ b/Source/WebKit2/WebProcess/Network/WebLoaderStrategy.cpp
>@@ -194,13 +194,13 @@ void WebLoaderStrategy::scheduleLoad(ResourceLoader& resourceLoader, CachedResou
>     loadParameters.contentSniffingPolicy = contentSniffingPolicy;
>     loadParameters.allowStoredCredentials = allowStoredCredentials;
>     // If there is no WebFrame then this resource cannot be authenticated with the client.
>-    loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? AskClientForAllCredentials : DoNotAskClientForAnyCredentials;
>+    loadParameters.clientCredentialPolicy = (webFrame && webPage && resourceLoader.isAllowedToAskUserForCredentials()) ? ClientCredentialPolicy::MayAskClientForCredentials : ClientCredentialPolicy::CannotAskClientForCredentials;
>     loadParameters.shouldClearReferrerOnHTTPSToHTTPRedirect = shouldClearReferrerOnHTTPSToHTTPRedirect;
>     loadParameters.defersLoading = resourceLoader.defersLoading();
>     loadParameters.needsCertificateInfo = resourceLoader.shouldIncludeCertificateInfo();
>     loadParameters.maximumBufferingTime = maximumBufferingTime(resource);
> 
>-    ASSERT((loadParameters.webPageID && loadParameters.webFrameID) || loadParameters.clientCredentialPolicy == DoNotAskClientForAnyCredentials);
>+    ASSERT((loadParameters.webPageID && loadParameters.webFrameID) || loadParameters.clientCredentialPolicy == ClientCredentialPolicy::CannotAskClientForCredentials);
> 
>     if (!WebProcess::singleton().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ScheduleResourceLoad(loadParameters), 0)) {
>         WEBLOADERSTRATEGY_LOG_ALWAYS_ERROR("WebLoaderStrategy::scheduleLoad: Unable to schedule resource with the NetworkProcess with priority = %d, pageID = %llu, frameID = %llu", static_cast<int>(resourceLoader.request().priority()), static_cast<unsigned long long>(loadParameters.webPageID), static_cast<unsigned long long>(loadParameters.webFrameID));
>diff --git a/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp b/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp
>index c2bfc2b150e4e4ab83292623729baf58e4468cb6..626da68c9c7e1f2e0f428634522b154a97ed6676 100644
>--- a/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp
>+++ b/Source/WebKit2/WebProcess/Network/WebResourceLoader.cpp
>@@ -84,7 +84,7 @@ void WebResourceLoader::willSendRequest(ResourceRequest&& proposedRequest, Resou
> 
>     if (m_coreLoader->documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(m_coreLoader.get(), proposedRequest, redirectResponse))
>         return;
>-    // FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is DoNotAskClientForCrossOriginCredentials?
>+    // FIXME: Do we need to update NetworkResourceLoader clientCredentialPolicy in case loader policy is FetchOptions::Credentials::SameOrigin?
>     m_coreLoader->willSendRequest(WTFMove(proposedRequest), redirectResponse, [protectedThis](ResourceRequest&& request) {
>         if (!protectedThis->m_coreLoader)
>             return;

Actions: View | Formatted Diff | Diff

Attachments on bug 159413: 282769 | 282773 | 282774 | 282775 | 282776 | 282782 | 282784 | 284196 | 284198 | 284199 | 284202 | 284594