Attachment 317734 Details for Bug 175386 – Patch

[patch] Patch

bug-175386-20170809134114.patch (text/plain), 25.46 KB, created by Chris Dumez on 2017-08-09 13:41:14 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2017-08-09 13:41:14 PDT

Size: 25.46 KB

patch

obsolete

>Subversion Revision: 220455
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 9b54ce1716f206c400702c2eeb0c7d55ebcd48b4..87edf8f4636590fbd0a3dbbcc086d3860fb35a4b 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,20 @@
>+2017-08-09  Chris Dumez  <cdumez@apple.com>
>+
>+        [Beacon][NetworkSession] Support CORS-preflighting on redirects
>+        https://bugs.webkit.org/show_bug.cgi?id=175386
>+        <rdar://problem/33801370>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Export a couple of WebCore symbols so I can use them in WebKit2.
>+
>+        Tests: http/wpt/beacon/cors/cors-preflight-redirect-failure.html
>+               http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin.html
>+               http/wpt/beacon/cors/cors-preflight-redirect-success.html
>+
>+        * loader/CrossOriginAccessControl.h:
>+        * page/SecurityOrigin.h:
>+
> 2017-08-09  Ms2ger  <Ms2ger@igalia.com>
> 
>         Remove unnecessary copies of PlatformMediaSessionManager::m_sessions
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 6a7ac634d3057f39a15dc01d97e2e7471957dd25..c73e7ef1e9cc8e86804fa32290cdb15028627078 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,26 @@
>+2017-08-09  Chris Dumez  <cdumez@apple.com>
>+
>+        [Beacon][NetworkSession] Support CORS-preflighting on redirects
>+        https://bugs.webkit.org/show_bug.cgi?id=175386
>+        <rdar://problem/33801370>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add support to Beacon for doing CORS-preflighting upon redirect to a different
>+        domain.
>+
>+        * NetworkProcess/NetworkCORSPreflightChecker.h:
>+        * NetworkProcess/PingLoad.cpp:
>+        (WebKit::PingLoad::PingLoad):
>+        (WebKit::PingLoad::~PingLoad):
>+        (WebKit::PingLoad::loadRequest):
>+        (WebKit::PingLoad::securityOrigin const):
>+        (WebKit::PingLoad::willPerformHTTPRedirection):
>+        (WebKit::PingLoad::didReceiveResponseNetworkSession):
>+        (WebKit::PingLoad::needsCORSPreflight const):
>+        (WebKit::PingLoad::doCORSPreflight):
>+        * NetworkProcess/PingLoad.h:
>+
> 2017-08-08  Wenson Hsieh  <wenson_hsieh@apple.com>
> 
>         Unreviewed, rolling out r220393.
>diff --git a/Source/WebCore/loader/CrossOriginAccessControl.h b/Source/WebCore/loader/CrossOriginAccessControl.h
>index 5e87b1fe910a53141e1d112704ef64df0086797a..94f223043b4131bb557086b07e6c61f6b73e9e31 100644
>--- a/Source/WebCore/loader/CrossOriginAccessControl.h
>+++ b/Source/WebCore/loader/CrossOriginAccessControl.h
>@@ -40,7 +40,7 @@ class URL;
> bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap&);
> bool isOnAccessControlSimpleRequestMethodWhitelist(const String&);
> 
>-void updateRequestForAccessControl(ResourceRequest&, SecurityOrigin&, StoredCredentials);
>+WEBCORE_EXPORT void updateRequestForAccessControl(ResourceRequest&, SecurityOrigin&, StoredCredentials);
> WEBCORE_EXPORT ResourceRequest createAccessControlPreflightRequest(const ResourceRequest&, SecurityOrigin&, const String&);
> 
> bool isValidCrossOriginRedirectionURL(const URL&);
>diff --git a/Source/WebCore/page/SecurityOrigin.h b/Source/WebCore/page/SecurityOrigin.h
>index 0ead4bc8b88c7ad207e7df8c8e0c25c8f8dfe13c..63bef48d434305296c5e84d6cd94554ada88ccc0 100644
>--- a/Source/WebCore/page/SecurityOrigin.h
>+++ b/Source/WebCore/page/SecurityOrigin.h
>@@ -50,7 +50,7 @@ public:
>     };
> 
>     WEBCORE_EXPORT static Ref<SecurityOrigin> create(const URL&);
>-    static Ref<SecurityOrigin> createUnique();
>+    WEBCORE_EXPORT static Ref<SecurityOrigin> createUnique();
> 
>     WEBCORE_EXPORT static Ref<SecurityOrigin> createFromString(const String&);
>     WEBCORE_EXPORT static Ref<SecurityOrigin> create(const String& protocol, const String& host, std::optional<uint16_t> port);
>diff --git a/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h b/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h
>index 446b67dcac1ef44b596cb8605562cc10648d262b..6522d9826840cbe8413dc37c3dbfb3d831af256a 100644
>--- a/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h
>+++ b/Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h
>@@ -54,6 +54,7 @@ public:
> 
>     NetworkCORSPreflightChecker(Parameters&&, CompletionCallback&&);
>     ~NetworkCORSPreflightChecker();
>+    const WebCore::ResourceRequest& originalRequest() const { return m_parameters.originalRequest; }
> 
>     void startPreflight();
> 
>diff --git a/Source/WebKit/NetworkProcess/PingLoad.cpp b/Source/WebKit/NetworkProcess/PingLoad.cpp
>index 2df014ce54cf23da996ebd91a1162e1e4373aca7..5baebfb0d48020dd09ae8f8f9b75aff148f55a4a 100644
>--- a/Source/WebKit/NetworkProcess/PingLoad.cpp
>+++ b/Source/WebKit/NetworkProcess/PingLoad.cpp
>@@ -32,6 +32,7 @@
> #include "Logging.h"
> #include "NetworkCORSPreflightChecker.h"
> #include "SessionTracker.h"
>+#include <WebCore/CrossOriginAccessControl.h>
> 
> #define RELEASE_LOG_IF_ALLOWED(fmt, ...) RELEASE_LOG_IF(m_parameters.sessionID.isAlwaysOnLoggingAllowed(), Network, "%p - PingLoad::" fmt, this, ##__VA_ARGS__)
> 
>@@ -42,6 +43,7 @@ using namespace WebCore;
> PingLoad::PingLoad(NetworkResourceLoadParameters&& parameters)
>     : m_parameters(WTFMove(parameters))
>     , m_timeoutTimer(*this, &PingLoad::timeoutTimerFired)
>+    , m_sameOriginRequest(securityOrigin().canRequest(m_parameters.request.url()))
> {
>     // If the server never responds, this object will hang around forever.
>     // Set a very generous timeout, just in case.
>@@ -50,11 +52,14 @@ PingLoad::PingLoad(NetworkResourceLoadParameters&& parameters)
>     if (needsCORSPreflight(m_parameters.request))
>         doCORSPreflight(m_parameters.request);
>     else
>-        startNetworkLoad();
>+        loadRequest(m_parameters.request);
> }
> 
> PingLoad::~PingLoad()
> {
>+    if (m_redirectHandler)
>+        m_redirectHandler({ });
>+
>     if (m_task) {
>         ASSERT(m_task->client() == this);
>         m_task->clearClient();
>@@ -62,22 +67,51 @@ PingLoad::~PingLoad()
>     }
> }
> 
>-void PingLoad::startNetworkLoad()
>+void PingLoad::loadRequest(const ResourceRequest& request)
> {
>     RELEASE_LOG_IF_ALLOWED("startNetworkLoad");
>     if (auto* networkSession = SessionTracker::networkSession(m_parameters.sessionID)) {
>-        m_task = NetworkDataTask::create(*networkSession, *this, m_parameters);
>+        auto loadParameters = m_parameters;
>+        loadParameters.request = request;
>+        m_task = NetworkDataTask::create(*networkSession, *this, loadParameters);
>         m_task->resume();
>     } else
>         ASSERT_NOT_REACHED();
> }
> 
>-void PingLoad::willPerformHTTPRedirection(ResourceResponse&&, ResourceRequest&& request, RedirectCompletionHandler&& completionHandler)
>+SecurityOrigin& PingLoad::securityOrigin() const
>+{
>+    return m_origin ? *m_origin : *m_parameters.sourceOrigin;
>+}
>+
>+void PingLoad::willPerformHTTPRedirection(ResourceResponse&& redirectResponse, ResourceRequest&& request, RedirectCompletionHandler&& completionHandler)
> {
>-    RELEASE_LOG_IF_ALLOWED("willPerformHTTPRedirection");
>-    // FIXME: Do a CORS preflight if necessary.
>+    RELEASE_LOG_IF_ALLOWED("willPerformHTTPRedirection - shouldFollowRedirects? %d", m_parameters.shouldFollowRedirects);
>+    if (!m_parameters.shouldFollowRedirects) {
>+        completionHandler({ });
>+        return;
>+    }
>+    // FIXME: Do CSP check.
>     // FIXME: We should ensure the number of redirects does not exceed 20.
>-    completionHandler(m_parameters.shouldFollowRedirects ? request : ResourceRequest());
>+    if (!needsCORSPreflight(request)) {
>+        completionHandler(request);
>+        return;
>+    }
>+    RELEASE_LOG_IF_ALLOWED("willPerformHTTPRedirection - Redirect requires a CORS preflight");
>+
>+    // Use a unique for subsequent loads if needed.
>+    // https://fetch.spec.whatwg.org/#concept-http-redirect-fetch (Step 10).
>+    ASSERT(m_parameters.mode == FetchOptions::Mode::Cors);
>+    if (!securityOrigin().canRequest(redirectResponse.url()) && !protocolHostAndPortAreEqual(redirectResponse.url(), request.url()))
>+        m_origin = SecurityOrigin::createUnique();
>+
>+    m_sameOriginRequest = false;
>+    m_redirectHandler = WTFMove(completionHandler);
>+
>+    // Let's fetch the request with the original headers (equivalent to request cloning specified by fetch algorithm).
>+    request.setHTTPHeaderFields(m_parameters.request.httpHeaderFields());
>+
>+    doCORSPreflight(request);
> }
> 
> void PingLoad::didReceiveChallenge(const AuthenticationChallenge&, ChallengeCompletionHandler&& completionHandler)
>@@ -87,9 +121,9 @@ void PingLoad::didReceiveChallenge(const AuthenticationChallenge&, ChallengeComp
>     delete this;
> }
> 
>-void PingLoad::didReceiveResponseNetworkSession(ResourceResponse&&, ResponseCompletionHandler&& completionHandler)
>+void PingLoad::didReceiveResponseNetworkSession(ResourceResponse&& response, ResponseCompletionHandler&& completionHandler)
> {
>-    RELEASE_LOG_IF_ALLOWED("didReceiveResponseNetworkSession");
>+    RELEASE_LOG_IF_ALLOWED("didReceiveResponseNetworkSession - httpStatusCode: %d", response.httpStatusCode());
>     completionHandler(PolicyAction::PolicyIgnore);
>     delete this;
> }
>@@ -133,30 +167,33 @@ void PingLoad::timeoutTimerFired()
> 
> bool PingLoad::needsCORSPreflight(const ResourceRequest& request) const
> {
>-    if (m_parameters.mode == FetchOptions::Mode::Cors) {
>-        ASSERT(m_parameters.sourceOrigin);
>-        return !m_parameters.sourceOrigin->canRequest(request.url());
>-    }
>-    return false;
>+    if (m_parameters.mode == FetchOptions::Mode::NoCors)
>+        return false;
>+
>+    return !m_sameOriginRequest || !securityOrigin().canRequest(request.url());
> }
> 
> void PingLoad::doCORSPreflight(const ResourceRequest& request)
> {
>     RELEASE_LOG_IF_ALLOWED("doCORSPreflight");
>     ASSERT(!m_corsPreflightChecker);
>-    ASSERT(m_parameters.sourceOrigin);
> 
>     NetworkCORSPreflightChecker::Parameters parameters = {
>         request,
>-        *m_parameters.sourceOrigin,
>+        securityOrigin(),
>         m_parameters.sessionID,
>         m_parameters.allowStoredCredentials
>     };
>     m_corsPreflightChecker = std::make_unique<NetworkCORSPreflightChecker>(WTFMove(parameters), [this](NetworkCORSPreflightChecker::Result result) {
>-        RELEASE_LOG_IF_ALLOWED("doCORSPreflight complete, success: %d", result == NetworkCORSPreflightChecker::Result::Success);
>+        RELEASE_LOG_IF_ALLOWED("doCORSPreflight complete, success: %d forRedirect? %d", result == NetworkCORSPreflightChecker::Result::Success, !!m_redirectHandler);
>+        auto corsPreflightChecker = WTFMove(m_corsPreflightChecker);
>         if (result == NetworkCORSPreflightChecker::Result::Success) {
>-            m_corsPreflightChecker = nullptr;
>-            startNetworkLoad();
>+            ResourceRequest actualRequest = corsPreflightChecker->originalRequest();
>+            updateRequestForAccessControl(actualRequest, securityOrigin(), m_parameters.allowStoredCredentials);
>+            if (auto redirectHandler = std::exchange(m_redirectHandler, nullptr))
>+                redirectHandler(actualRequest);
>+            else
>+                loadRequest(actualRequest);
>         } else
>             delete this;
>     });
>diff --git a/Source/WebKit/NetworkProcess/PingLoad.h b/Source/WebKit/NetworkProcess/PingLoad.h
>index 8872d2f4bc256ad0ccc852d0cb92f1b841b78bc4..eb1ce065d17a0e40c7602df32f892ec3f2db2a2d 100644
>--- a/Source/WebKit/NetworkProcess/PingLoad.h
>+++ b/Source/WebKit/NetworkProcess/PingLoad.h
>@@ -51,14 +51,19 @@ private:
>     void cannotShowURL() final;
>     void timeoutTimerFired();
> 
>-    void startNetworkLoad();
>+    void loadRequest(const WebCore::ResourceRequest&);
>     bool needsCORSPreflight(const WebCore::ResourceRequest&) const;
>     void doCORSPreflight(const WebCore::ResourceRequest&);
>+
>+    WebCore::SecurityOrigin& securityOrigin() const;
>     
>     NetworkResourceLoadParameters m_parameters;
>     RefPtr<NetworkDataTask> m_task;
>     WebCore::Timer m_timeoutTimer;
>     std::unique_ptr<NetworkCORSPreflightChecker> m_corsPreflightChecker;
>+    RefPtr<WebCore::SecurityOrigin> m_origin;
>+    bool m_sameOriginRequest;
>+    RedirectCompletionHandler m_redirectHandler;
> };
> 
> }
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 06b2b2b4a40fe378cc8f1b87c13df8dd5491ffce..5fd52f45e3a44ac23f2c80b0936ed3a6b8b63d78 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,24 @@
>+2017-08-09  Chris Dumez  <cdumez@apple.com>
>+
>+        [Beacon][NetworkSession] Support CORS-preflighting on redirects
>+        https://bugs.webkit.org/show_bug.cgi?id=175386
>+        <rdar://problem/33801370>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add layout test coverage.
>+
>+        * http/wpt/beacon/cors/cors-preflight-redirect-failure-expected.txt: Added.
>+        * http/wpt/beacon/cors/cors-preflight-redirect-failure.html: Added.
>+        * http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin-expected.txt: Added.
>+        * http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin.html: Added.
>+        * http/wpt/beacon/cors/cors-preflight-redirect-success-expected.txt: Added.
>+        * http/wpt/beacon/cors/cors-preflight-redirect-success.html: Added.
>+        * http/wpt/beacon/resources/beacon-preflight.py:
>+        (main):
>+        * http/wpt/beacon/resources/redirect.py: Added.
>+        (main):
>+
> 2017-08-09  Zan Dobersek  <zdobersek@igalia.com>
> 
>         Unreviewed WPE gardening.
>diff --git a/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-failure-expected.txt b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-failure-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..11932f72f6b0699a54c9e7ed92f2b7a6c948cdd8
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-failure-expected.txt
>@@ -0,0 +1,3 @@
>+
>+PASS CORS preflight failure test 
>+
>diff --git a/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-failure.html b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-failure.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..409efa01b6706f0d09d888801d450b10c05b516b
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-failure.html
>@@ -0,0 +1,53 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>SendBeacon CORS preflight on redirect test</title>
>+    <script src=/resources/testharness.js></script>
>+    <script src=/resources/testharnessreport.js></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="/common/get-host-info.sub.js"></script>
>+    <script>
>+var RESOURCES_DIR = "/WebKit/beacon/resources/";
>+
>+function pollResult(test, id) {
>+  var checkUrl = RESOURCES_DIR + "beacon-preflight.py?cmd=get&id=" + id;
>+
>+  return new Promise(resolve => {
>+    step_timeout(test.step_func(() => {
>+      fetch(checkUrl).then(response => {
>+        response.text().then(body => {
>+          resolve(body);
>+        });
>+      });
>+    }), 1000);
>+  });
>+}
>+
>+function testCORSPreflightRedirectSuccess(what) {
>+  var testBase = get_host_info().HTTP_REMOTE_ORIGIN + RESOURCES_DIR;
>+  var id = self.token();
>+  var target = encodeURIComponent(testBase + "beacon-preflight.py?allowCors=0&cmd=put&id=" + id);
>+
>+  // 307 & 308 redirections are the only ones that maintain the POST method.
>+  var testUrl = RESOURCES_DIR + "redirect.py?redirect_status=307&location=" + target;
>+
>+  promise_test(function(test) {
>+    assert_true(navigator.sendBeacon(testUrl, what), "SendBeacon Succeeded");
>+    return pollResult(test, id) .then(json => {
>+      result = JSON.parse(json);
>+      assert_equals(result['preflight'], 1, "Received preflight")
>+      assert_equals(result['preflight_referer'], document.URL, "Preflight referer header")
>+      assert_equals(result['preflight_requested_method'], "POST", "Preflight requested method")
>+      assert_equals(result['beacon'], 0, "Did not receive beacon")
>+    });
>+  }, "CORS preflight failure test");
>+}
>+
>+let blob = new Blob(["123"], {type: "application/octet-stream"});
>+testCORSPreflightRedirectSuccess(blob);
>+    </script>
>+  </body>
>+</html>
>diff --git a/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin-expected.txt b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..154498269f5d4e0c9454f20e81158ed995fed593
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin-expected.txt
>@@ -0,0 +1,3 @@
>+
>+PASS CORS preflight success test 
>+
>diff --git a/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin.html b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..cac54dc1c3cd6cfa2710f241d9e0212253c9c4e3
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-from-crossorigin-to-sameorigin.html
>@@ -0,0 +1,55 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>SendBeacon CORS preflight on redirect test from cross origin to same origin</title>
>+    <script src=/resources/testharness.js></script>
>+    <script src=/resources/testharnessreport.js></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="/common/get-host-info.sub.js"></script>
>+    <script>
>+var RESOURCES_DIR = "/WebKit/beacon/resources/";
>+
>+function pollResult(test, id) {
>+  var checkUrl = RESOURCES_DIR + "beacon-preflight.py?cmd=get&id=" + id;
>+
>+  return new Promise(resolve => {
>+    step_timeout(test.step_func(() => {
>+      fetch(checkUrl).then(response => {
>+        response.text().then(body => {
>+          resolve(body);
>+        });
>+      });
>+    }), 1000);
>+  });
>+}
>+
>+function testCORSPreflightRedirectSuccess(what) {
>+  var testBase = get_host_info().HTTP_REMOTE_ORIGIN + RESOURCES_DIR;
>+  var id = self.token();
>+  var target = encodeURIComponent(get_host_info().HTTP_ORIGIN + RESOURCES_DIR + "beacon-preflight.py?allowCors=1&cmd=put&id=" + id);
>+
>+  // 307 & 308 redirections are the only ones that maintain the POST method.
>+  var testUrl = testBase + "redirect.py?redirect_status=307&location=" + target;
>+
>+  promise_test(function(test) {
>+    assert_true(navigator.sendBeacon(testUrl, what), "SendBeacon Succeeded");
>+    return pollResult(test, id) .then(json => {
>+      result = JSON.parse(json);
>+      assert_equals(result['preflight'], 1, "Received preflight")
>+      assert_equals(result['preflight_referer'], document.URL, "Preflight referer header")
>+      assert_equals(result['preflight_requested_method'], "POST", "Preflight requested method")
>+      assert_equals(result['preflight_origin'], "null", "Received beacon")
>+      assert_equals(result['beacon'], 1, "Received beacon")
>+      assert_equals(result['beacon_origin'], "null", "Received beacon")
>+    });
>+  }, "CORS preflight success test");
>+}
>+
>+let blob = new Blob(["123"], {type: "application/octet-stream"});
>+testCORSPreflightRedirectSuccess(blob);
>+    </script>
>+  </body>
>+</html>
>diff --git a/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-success-expected.txt b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-success-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..154498269f5d4e0c9454f20e81158ed995fed593
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-success-expected.txt
>@@ -0,0 +1,3 @@
>+
>+PASS CORS preflight success test 
>+
>diff --git a/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-success.html b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-success.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..a29f6086f6ce64134fb0bcbcffa4abeffab61bcd
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/cors/cors-preflight-redirect-success.html
>@@ -0,0 +1,53 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>SendBeacon CORS preflight on redirect test</title>
>+    <script src=/resources/testharness.js></script>
>+    <script src=/resources/testharnessreport.js></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="/common/get-host-info.sub.js"></script>
>+    <script>
>+var RESOURCES_DIR = "/WebKit/beacon/resources/";
>+
>+function pollResult(test, id) {
>+  var checkUrl = RESOURCES_DIR + "beacon-preflight.py?cmd=get&id=" + id;
>+
>+  return new Promise(resolve => {
>+    step_timeout(test.step_func(() => {
>+      fetch(checkUrl).then(response => {
>+        response.text().then(body => {
>+          resolve(body);
>+        });
>+      });
>+    }), 1000);
>+  });
>+}
>+
>+function testCORSPreflightRedirectSuccess(what) {
>+  var testBase = get_host_info().HTTP_REMOTE_ORIGIN + RESOURCES_DIR;
>+  var id = self.token();
>+  var target = encodeURIComponent(testBase + "beacon-preflight.py?allowCors=1&cmd=put&id=" + id);
>+
>+  // 307 & 308 redirections are the only ones that maintain the POST method.
>+  var testUrl = RESOURCES_DIR + "redirect.py?redirect_status=307&location=" + target;
>+
>+  promise_test(function(test) {
>+    assert_true(navigator.sendBeacon(testUrl, what), "SendBeacon Succeeded");
>+    return pollResult(test, id) .then(json => {
>+      result = JSON.parse(json);
>+      assert_equals(result['preflight'], 1, "Received preflight")
>+      assert_equals(result['preflight_referer'], document.URL, "Preflight referer header")
>+      assert_equals(result['preflight_requested_method'], "POST", "Preflight requested method")
>+      assert_equals(result['beacon'], 1, "Received beacon")
>+    });
>+  }, "CORS preflight success test");
>+}
>+
>+let blob = new Blob(["123"], {type: "application/octet-stream"});
>+testCORSPreflightRedirectSuccess(blob);
>+    </script>
>+  </body>
>+</html>
>diff --git a/LayoutTests/http/wpt/beacon/resources/beacon-preflight.py b/LayoutTests/http/wpt/beacon/resources/beacon-preflight.py
>index cce4cd1143be098dfaf4b8e2e431587bf782714a..9e64e76ffd6e3b9ca9a1a5c032d62e565d5d5848 100644
>--- a/LayoutTests/http/wpt/beacon/resources/beacon-preflight.py
>+++ b/LayoutTests/http/wpt/beacon/resources/beacon-preflight.py
>@@ -35,11 +35,13 @@ def main(request, response):
>       stashed_data['preflight_requested_headers'] = request.headers.get("Access-Control-Request-Headers", "")
>       stashed_data['preflight_cookie_header'] = request.headers.get("Cookie", "");
>       stashed_data['preflight_referer'] = request.headers.get("Referer", "")
>+      stashed_data['preflight_origin'] = request.headers.get("Origin", "")
>       request.server.stash.put(test_id, stashed_data)
>       return respondToCORSPreflight(request, response)
>     elif request.method == "POST":
>       stashed_data['beacon'] = 1;
>       stashed_data['beacon_cookie_header'] = request.headers.get("Cookie", "")
>+      stashed_data['beacon_origin'] = request.headers.get("Origin", "")
>       request.server.stash.put(test_id, stashed_data)
>     return [("Content-Type", "text/plain")], ""
>   
>diff --git a/LayoutTests/http/wpt/beacon/resources/redirect.py b/LayoutTests/http/wpt/beacon/resources/redirect.py
>new file mode 100644
>index 0000000000000000000000000000000000000000..39c574c402f02a9b5c98d9edfc464426e57aac59
>--- /dev/null
>+++ b/LayoutTests/http/wpt/beacon/resources/redirect.py
>@@ -0,0 +1,63 @@
>+from urllib import urlencode
>+from urlparse import urlparse
>+
>+def main(request, response):
>+    stashed_data = {'count': 0, 'preflight': "0"}
>+    status = 302
>+    headers = [("Content-Type", "text/plain"),
>+               ("Cache-Control", "no-cache"),
>+               ("Pragma", "no-cache"),
>+               ("Access-Control-Allow-Credentials", "true")]
>+    headers.append(("Access-Control-Allow-Origin", request.headers.get("Origin", "*")))
>+    token = None
>+
>+    if "token" in request.GET:
>+        token = request.GET.first("token")
>+        data = request.server.stash.take(token)
>+        if data:
>+            stashed_data = data
>+
>+    if request.method == "OPTIONS":
>+        requested_method = request.headers.get("Access-Control-Request-Method", None)
>+        headers.append(("Access-Control-Allow-Methods", requested_method))
>+        requested_headers = request.headers.get("Access-Control-Request-Headers", None)
>+        headers.append(("Access-Control-Allow-Headers", requested_headers))
>+        stashed_data['preflight'] = "1"
>+        #Preflight is not redirected: return 200
>+        if not "redirect_preflight" in request.GET:
>+            if token:
>+              request.server.stash.put(request.GET.first("token"), stashed_data)
>+            return 200, headers, ""
>+
>+    if "redirect_status" in request.GET:
>+        status = int(request.GET['redirect_status'])
>+
>+    stashed_data['count'] += 1
>+
>+    if "location" in request.GET:
>+        url = request.GET['location']
>+        scheme = urlparse(url).scheme
>+        if scheme == "" or scheme == "http" or scheme == "https":
>+            url += "&" if '?' in url else "?"
>+            #keep url parameters in location
>+            url_parameters = {}
>+            for item in request.GET.items():
>+                url_parameters[item[0]] = item[1][0]
>+            url += urlencode(url_parameters)
>+            #make sure location changes during redirection loop
>+            url += "&count=" + str(stashed_data['count'])
>+        headers.append(("Location", url))
>+
>+    if "redirect_referrerpolicy" in request.GET:
>+        headers.append(("Referrer-Policy", request.GET['redirect_referrerpolicy']))
>+
>+    if token:
>+        request.server.stash.put(request.GET.first("token"), stashed_data)
>+        if "max_count" in request.GET:
>+            max_count =  int(request.GET['max_count'])
>+            #stop redirecting and return count
>+            if stashed_data['count'] > max_count:
>+                # -1 because the last is not a redirection
>+                return str(stashed_data['count'] - 1)
>+
>+    return status, headers, ""

Actions: View | Formatted Diff | Diff

Attachments on bug 175386: 317714 | 317721 | 317733 | 317734 | 317743