Attachment 357247 Details for Bug 191924 – Patch

[patch] Patch

bug-191924-20181213221041.patch (text/plain), 8.37 KB, created by Rob Buis on 2018-12-13 13:10:42 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Buis

Created: 2018-12-13 13:10:42 PST

Size: 8.37 KB

patch

obsolete

>Subversion Revision: 239173
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index c9a427397c1ffd3b1433759088f3084c7e825ba3..2df4d113def4d1afc666281582ce73002001c1be 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,22 @@
>+2018-12-13  Rob Buis  <rbuis@igalia.com>
>+
>+        Move URL scheme check to NetworkLoadChecker
>+        https://bugs.webkit.org/show_bug.cgi?id=191924
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        As the FIXME says do this check when receiving the redirection [1].
>+        Furthermore the old check got overridden by similar checking code
>+        in the WebProcess, so it was basically a no-op. With this move the
>+        check is actually being done before the WebProcess checks.
>+
>+        [1] https://fetch.spec.whatwg.org/#concept-http-redirect-fetch step 4
>+
>+        * NetworkProcess/NetworkLoadChecker.cpp:
>+        (WebKit::NetworkLoadChecker::checkRedirection):
>+        * NetworkProcess/NetworkResourceLoader.cpp:
>+        (WebKit::NetworkResourceLoader::continueWillSendRequest):
>+
> 2018-12-13  Per Arne Vollan  <pvollan@apple.com>
> 
>         [macOS] Remove with-report from 3 services that are currently needed on macOS
>diff --git a/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp b/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
>index 3511f759cc000a4fa292177ab4500aaa4d4d0f54..d9fbf5b1aeadb66fc32b41cb3e8afce5766b7216 100644
>--- a/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
>+++ b/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
>@@ -121,8 +121,10 @@ void NetworkLoadChecker::checkRedirection(ResourceRequest&& request, ResourceReq
>         return;
>     }
> 
>-    // FIXME: We should check that redirections are only HTTP(s) as per fetch spec.
>-    // See https://github.com/whatwg/fetch/issues/393
>+    if (!redirectRequest.url().protocolIsInHTTPFamily()) {
>+        handler(redirectionError(redirectResponse, "Redirection to URL with a scheme that is not HTTP(S)"_s));
>+        return;
>+    }
> 
>     if (++m_redirectCount > 20) {
>         handler(redirectionError(redirectResponse, "Load cannot follow more than 20 redirections"_s));
>diff --git a/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp b/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
>index e38927be3148ccbe255264ad4523def9ebb52350..6d74714fc4ea7300988aadc9f89821ade5888392 100644
>--- a/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
>+++ b/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
>@@ -707,14 +707,6 @@ void NetworkResourceLoader::continueWillSendRequest(ResourceRequest&& newRequest
>         return;
>     }
> 
>-    if (m_networkLoadChecker) {
>-        // FIXME: We should be doing this check when receiving the redirection and not allow about protocol as per fetch spec.
>-        if (!newRequest.url().protocolIsInHTTPFamily() && !newRequest.url().protocolIsAbout() && m_redirectCount) {
>-            didFailLoading(ResourceError { String { }, 0, newRequest.url(), "Redirection to URL with a scheme that is not HTTP(S)"_s, ResourceError::Type::AccessControl });
>-            return;
>-        }
>-    }
>-
>     RELEASE_LOG_IF_ALLOWED("continueWillSendRequest: (pageID = %" PRIu64 ", frameID = %" PRIu64 ", resourceID = %" PRIu64 ")", m_parameters.webPageID, m_parameters.webFrameID, m_parameters.identifier);
> 
>     if (m_networkLoadChecker)
>diff --git a/LayoutTests/imported/w3c/ChangeLog b/LayoutTests/imported/w3c/ChangeLog
>index 7ff7fd9b4674abb2c0397a1af773535fe0a7219d..551fe28f7ecf89981e060a03d6cb28922a8abca8 100644
>--- a/LayoutTests/imported/w3c/ChangeLog
>+++ b/LayoutTests/imported/w3c/ChangeLog
>@@ -1,3 +1,15 @@
>+2018-12-13  Rob Buis  <rbuis@igalia.com>
>+
>+        Move URL scheme check to NetworkLoadChecker
>+        https://bugs.webkit.org/show_bug.cgi?id=191924
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Update improved test expectations.
>+
>+        * web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt:
>+        * web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt:
>+
> 2018-12-10  Rob Buis  <rbuis@igalia.com>
> 
>         XMLHttpRequest removes spaces from content-types before processing
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt
>index 1777cd63b928d58a78283455d463baf1d88b6e5f..4ffd03b19696e801721d9d8825d9b822a5035a9e 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-schemes-expected.txt
>@@ -1,14 +1,15 @@
>-CONSOLE MESSAGE: Cross-origin redirection to mailto:a@a.com denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
> CONSOLE MESSAGE: Fetch API cannot load http://localhost:8800/fetch/api/resources/redirect.py?location=mailto:a@a.com due to access control checks.
>-CONSOLE MESSAGE: Cross-origin redirection to data:,HI denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
> CONSOLE MESSAGE: Fetch API cannot load http://localhost:8800/fetch/api/resources/redirect.py?location=data:,HI due to access control checks.
>-CONSOLE MESSAGE: Cross-origin redirection to facetime:a@a.org denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
> CONSOLE MESSAGE: Fetch API cannot load http://localhost:8800/fetch/api/resources/redirect.py?location=facetime:a@a.org due to access control checks.
>-CONSOLE MESSAGE: Cross-origin redirection to about:blank denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
> CONSOLE MESSAGE: Fetch API cannot load http://localhost:8800/fetch/api/resources/redirect.py?location=about:blank due to access control checks.
>-CONSOLE MESSAGE: Cross-origin redirection to about:unicorn denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
> CONSOLE MESSAGE: Fetch API cannot load http://localhost:8800/fetch/api/resources/redirect.py?location=about:unicorn due to access control checks.
>-CONSOLE MESSAGE: Not allowed to load local resource: blob:djfksfjs
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
>+CONSOLE MESSAGE: Fetch API cannot load http://localhost:8800/fetch/api/resources/redirect.py?location=blob:djfksfjs due to access control checks.
> 
> PASS Fetch: handling different schemes in redirects 
> PASS Fetch: handling different schemes in redirects 1 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt
>index b16c54d9d509ae9d40cea6610b492e48cff284f1..6994e84f5671bf2ba2d62d4f4d342f82ca07adc4 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt
>@@ -1,7 +1,8 @@
>-CONSOLE MESSAGE: Cross-origin redirection to data:text/plain;base64,cmVzcG9uc2UncyBib2R5 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>-CONSOLE MESSAGE: Unsafe attempt to load URL data:text/plain;base64,cmVzcG9uc2UncyBib2R5 from origin http://localhost:8800. Domains, protocols and ports must match.
>-
>-CONSOLE MESSAGE: Cross-origin redirection to data:text/plain;base64,cmVzcG9uc2UncyBib2R5 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
>+CONSOLE MESSAGE: Redirection to URL with a scheme that is not HTTP(S)
> 
> PASS Testing data URL loading after same-origin redirection (cors mode) 
> PASS Testing data URL loading after same-origin redirection (no-cors mode)

Actions: View | Formatted Diff | Diff

Attachments on bug 191924: 355515 | 355535 | 357247 | 357252 | 357254 | 357260 | 357261 | 357328 | 357331 | 357333 | 357334 | 357338 | 357341 | 377966 | 377967 | 377973 | 377977 | 385751 | 385951 | 386089 | 386239 | 386294 | 386566 | 386574 | 386575 | 386580 | 390169 | 390170 | 390171 | 390201 | 390202 | 390203 | 390206 | 390210 | 391035 | 391838 | 391840 | 391844 | 391845 | 392063 | 392067 | 392264 | 392287 | 392301 | 392567 | 392605 | 392617 | 392622 | 392666 | 392687 | 392692 | 392701 | 392705 | 392946 | 392947 | 392950 | 392953 | 393392 | 393581 | 393588 | 393594 | 393606 | 393607 | 393608 | 393609 | 393611 | 393615 | 393618 | 393619 | 393623 | 393680 | 393734 | 393784 | 394717 | 394811 | 394815 | 394816 | 394861 | 394862 | 394863 | 394864 | 394871 | 394920 | 394932 | 394950 | 395184 | 395255 | 395270 | 395291 | 395362 | 395384 | 395440 | 395445 | 395446 | 395447 | 395449 | 395494 | 395502 | 395504 | 395520 | 395521 | 395786 | 395798 | 395810 | 395818 | 395829 | 396104 | 396119 | 396156 | 396165 | 396170 | 396175 | 396188 | 396190 | 396216 | 396218 | 396221 | 396238 | 396303 | 396322 | 396387 | 396388 | 396393 | 396856 | 396901 | 396904 | 396962 | 397181 | 397184 | 397450 | 397460 | 397466 | 397482 | 397492 | 397550 | 397556 | 397559 | 397564 | 397567 | 397569 | 397615 | 397620 | 397621 | 397700 | 397706 | 397723 | 397987 | 397994 | 398043 | 398045 | 398074 | 398189 | 398207 | 398287 | 398289 | 398291 | 398312 | 398314 | 398318 | 398322 | 398351 | 398609 | 398621 | 398649 | 398728 | 398732 | 398743 | 398750 | 398763 | 398839 | 398927 | 399546 | 399550 | 399552 | 399553 | 399586 | 399596 | 399834 | 400114 | 400119 | 400124 | 400156 | 400160 | 400209 | 400265 | 400434 | 400463 | 400851 | 401125 | 401131 | 401175 | 401190 | 401240 | 401244 | 401245 | 401249 | 401254 | 401261 | 401268 | 401273 | 401278 | 401565 | 401707 | 401763 | 401831 | 401833 | 401835 | 401840 | 401848 | 401850 | 401856 | 401858 | 401859 | 401860 | 401861 | 401870 | 401906 | 401914 | 401989 | 401992 | 402100 | 402123 | 402191 | 402194 | 402195 | 402200 | 402585 | 402720 | 402723 | 402726 | 402731 | 402855 | 402859 | 402860 | 402864 | 402885 | 402949 | 402951 | 402952 | 402954 | 402989 | 402994 | 403548 | 403551 | 403553 | 403555 | 403560 | 403563 | 403566 | 403597 | 403601 | 403995 | 403996 | 404002 | 404052 | 404059 | 404061 | 404064 | 404066 | 404067 | 404070 | 404223 | 404230 | 404237 | 404247 | 404253 | 404262 | 404266 | 404638 | 404643 | 404918 | 404940 | 404945 | 405279 | 405441 | 405494 | 405547 | 405553 | 405715 | 405722 | 405782 | 405786 | 405788 | 405820 | 406258 | 406521 | 406588 | 406662 | 406663 | 406672 | 407006 | 407007 | 407009 | 407015 | 407047 | 407048 | 407052 | 407067 | 407073 | 409709 | 409773 | 409780 | 409783 | 409784 | 410213 | 410217 | 410232 | 410321 | 410328 | 410331 | 410335 | 410434 | 410466 | 410531 | 411659 | 412723 | 412739 | 414803 | 416115 | 416121 | 416158 | 416244 | 416255 | 416326 | 416348 | 416448 | 416463 | 416512 | 416518 | 416528 | 416706 | 416756 | 416778 | 416780 | 416781 | 416782 | 416801 | 416828 | 416829 | 416832 | 416839 | 416844 | 416846 | 416860 | 416861 | 416863 | 416872 | 416883 | 416896 | 416910 | 418147 | 418221 | 418236 | 418238 | 418240 | 418256 | 419019 | 419379 | 419386 | 419696 | 420242 | 420248 | 420931 | 420936 | 424279 | 424398 | 424446 | 424449 | 424453 | 424457 | 424462 | 424466 | 424484 | 424485 | 424489 | 424492 | 424495 | 424497 | 424501 | 424504 | 424506 | 424507 | 424532