<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[205265] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205265">205265</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2016-08-31 13:18:44 -0700 (Wed, 31 Aug 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[Fetch API] Fetch API should be able to load data URL in Same Origin mode
https://bugs.webkit.org/show_bug.cgi?id=161434
Patch by Youenn Fablet <youenn@apple.com> on 2016-08-31
Reviewed by Sam Weinig.
LayoutTests/imported/w3c:
* web-platform-tests/fetch/api/basic/scheme-data-expected.txt:
* web-platform-tests/fetch/api/basic/scheme-data-worker-expected.txt:
* web-platform-tests/fetch/api/basic/scheme-data.js:
(checkFetchResponse):
* web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt: Added.
* web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt: Added.
* web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html: Added.
* web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html: Added.
* web-platform-tests/fetch/api/redirect/redirect-to-dataurl.js: Added.
(redirectDataURL):
Source/WebCore:
Tests: imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html
imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html
Covered also by added sub-test.
Moving SameDataURLOrigin option from ThreadableLoaderOptions to ResourceLoaderOptions.
This allows doing some of the checks in CachedResourceLoader/CachedResource.
This also allows setting this options in CachedResourceLoader clients, ImageLoader in that case.
* Modules/fetch/FetchLoader.cpp:
(WebCore::FetchLoader::start): Setting sameOriginDataURL as ResourceLoader option.
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::updateFromElement): Setting sameOriginDataURL as specificied in
https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element.
* loader/ResourceLoaderOptions.h: Adding sameOriginDataURL as ResourceLoader option.
* loader/ThreadableLoader.cpp:
(WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Removing sameOriginDataURL option.
* loader/ThreadableLoader.h:
* loader/WorkerThreadableLoader.cpp: Setting sameOriginDataURL as ResourceLoader option.
(WebCore::LoaderTaskOptions::LoaderTaskOptions):
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::load): If resource URL is a data url, we previously marked the resource as same origin.
We only do that now if the sameOriginDataURL flag is set as per fetch specification.
See https://fetch.spec.whatwg.org/#main-fetch.
* loader/cache/CachedResourceLoader.cpp:
(WebCore::isSameOriginDataURL): Helper function.
(WebCore::CachedResourceLoader::canRequest): Allowing same origin loads of data URLs if flag is set and no redirection happens.
See https://fetch.spec.whatwg.org/#http-redirect-fetch for why we check redirection.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapibasicschemedataexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapibasicschemedataworkerexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-worker-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapibasicschemedatajs">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data.js</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreModulesfetchFetchLoadercpp">trunk/Source/WebCore/Modules/fetch/FetchLoader.cpp</a></li>
<li><a href="#trunkSourceWebCoreloaderImageLoadercpp">trunk/Source/WebCore/loader/ImageLoader.cpp</a></li>
<li><a href="#trunkSourceWebCoreloaderResourceLoaderOptionsh">trunk/Source/WebCore/loader/ResourceLoaderOptions.h</a></li>
<li><a href="#trunkSourceWebCoreloaderThreadableLoadercpp">trunk/Source/WebCore/loader/ThreadableLoader.cpp</a></li>
<li><a href="#trunkSourceWebCoreloaderThreadableLoaderh">trunk/Source/WebCore/loader/ThreadableLoader.h</a></li>
<li><a href="#trunkSourceWebCoreloaderWorkerThreadableLoadercpp">trunk/Source/WebCore/loader/WorkerThreadableLoader.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedResourcecpp">trunk/Source/WebCore/loader/cache/CachedResource.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedResourceLoadercpp">trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlworkerexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlworkerhtml">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlhtml">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurljs">trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/ChangeLog (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/ChangeLog 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -1,5 +1,23 @@
</span><span class="cx"> 2016-08-31 Youenn Fablet <youenn@apple.com>
</span><span class="cx">
</span><ins>+ [Fetch API] Fetch API should be able to load data URL in Same Origin mode
+ https://bugs.webkit.org/show_bug.cgi?id=161434
+
+ Reviewed by Sam Weinig.
+
+ * web-platform-tests/fetch/api/basic/scheme-data-expected.txt:
+ * web-platform-tests/fetch/api/basic/scheme-data-worker-expected.txt:
+ * web-platform-tests/fetch/api/basic/scheme-data.js:
+ (checkFetchResponse):
+ * web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt: Added.
+ * web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt: Added.
+ * web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html: Added.
+ * web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html: Added.
+ * web-platform-tests/fetch/api/redirect/redirect-to-dataurl.js: Added.
+ (redirectDataURL):
+
+2016-08-31 Youenn Fablet <youenn@apple.com>
+
</ins><span class="cx"> [Fetch API] Request construction failure should not set "bodyUsed"
</span><span class="cx"> https://bugs.webkit.org/show_bug.cgi?id=161432
</span><span class="cx">
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapibasicschemedataexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-expected.txt (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-expected.txt 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-expected.txt 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -1,5 +1,7 @@
</span><span class="cx">
</span><span class="cx"> PASS Fetching data:,response%27s%20body is OK
</span><ins>+PASS Fetching data:,response%27s%20body is OK (same-origin)
+PASS Fetching data:,response%27s%20body is OK (cors)
</ins><span class="cx"> PASS Fetching data:text/plain;base64,cmVzcG9uc2UncyBib[...] is OK
</span><span class="cx"> PASS Fetching data:image/png;base64,cmVzcG9uc2UncyBib2[...] is OK
</span><span class="cx"> FAIL Fetching [GET] data:notAdataUrl.com is KO assert_unreached: Should have rejected. Reached unreachable code
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapibasicschemedataworkerexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-worker-expected.txt (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-worker-expected.txt 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-worker-expected.txt 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -1,5 +1,7 @@
</span><span class="cx">
</span><span class="cx"> PASS Fetching data:,response%27s%20body is OK
</span><ins>+PASS Fetching data:,response%27s%20body is OK (same-origin)
+PASS Fetching data:,response%27s%20body is OK (cors)
</ins><span class="cx"> PASS Fetching data:text/plain;base64,cmVzcG9uc2UncyBib[...] is OK
</span><span class="cx"> PASS Fetching data:image/png;base64,cmVzcG9uc2UncyBib2[...] is OK
</span><span class="cx"> FAIL Fetching [GET] data:notAdataUrl.com is KO assert_unreached: Should have rejected. Reached unreachable code
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapibasicschemedatajs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data.js (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data.js 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/scheme-data.js 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -3,11 +3,16 @@
</span><span class="cx"> importScripts("../resources/utils.js");
</span><span class="cx"> }
</span><span class="cx">
</span><del>-function checkFetchResponse(url, data, mime) {
</del><ins>+function checkFetchResponse(url, data, mime, fetchMode) {
</ins><span class="cx"> var cut = (url.length >= 40) ? "[...]" : "";
</span><del>- desc = "Fetching " + url.substring(0, 40) + cut + " is OK"
</del><ins>+ desc = "Fetching " + url.substring(0, 40) + cut + " is OK";
+ var init = { };
+ if (fetchMode) {
+ init.mode = fetchMode;
+ desc += " (" + fetchMode + ")";
+ }
</ins><span class="cx"> promise_test(function(test) {
</span><del>- return fetch(url).then(function(resp) {
</del><ins>+ return fetch(url, init).then(function(resp) {
</ins><span class="cx"> assert_equals(resp.status, 200, "HTTP status is 200");
</span><span class="cx"> assert_equals(resp.statusText, "OK", "HTTP statusText is OK");
</span><span class="cx"> assert_equals(resp.type, "basic", "response type is basic");
</span><span class="lines">@@ -20,6 +25,8 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> checkFetchResponse("data:,response%27s%20body", "response's body", "text/plain;charset=US-ASCII");
</span><ins>+checkFetchResponse("data:,response%27s%20body", "response's body", "text/plain;charset=US-ASCII", "same-origin");
+checkFetchResponse("data:,response%27s%20body", "response's body", "text/plain;charset=US-ASCII", "cors");
</ins><span class="cx"> checkFetchResponse("data:text/plain;base64,cmVzcG9uc2UncyBib2R5", "response's body", "text/plain");
</span><span class="cx"> checkFetchResponse("data:image/png;base64,cmVzcG9uc2UncyBib2R5",
</span><span class="cx"> "response's body",
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt (0 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+CONSOLE MESSAGE: Cross-origin redirection to data:text/plain;base64,cmVzcG9uc2UncyBib2R5 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
+CONSOLE MESSAGE: Unsafe attempt to load URL data:text/plain;base64,cmVzcG9uc2UncyBib2R5 from frame with URL http://localhost:8800/fetch/api/redirect/redirect-to-dataurl.html. Domains, protocols and ports must match.
+
+CONSOLE MESSAGE: Cross-origin redirection to data:text/plain;base64,cmVzcG9uc2UncyBib2R5 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
+
+PASS Testing data URL loading after same-origin redirection (cors mode)
+PASS Testing data URL loading after same-origin redirection (no-cors mode)
+PASS Testing data URL loading after same-origin redirection (same-origin mode)
+PASS Testing data URL loading after cross-origin redirection (cors mode)
+PASS Testing data URL loading after cross-origin redirection (no-cors mode)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlworkerexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt (0 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker-expected.txt 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+CONSOLE MESSAGE: Cross-origin redirection to data:text/plain;base64,cmVzcG9uc2UncyBib2R5 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
+CONSOLE MESSAGE: Unsafe attempt to load URL data:text/plain;base64,cmVzcG9uc2UncyBib2R5 from frame with URL http://localhost:8800/fetch/api/redirect/redirect-to-dataurl-worker.html. Domains, protocols and ports must match.
+
+CONSOLE MESSAGE: Cross-origin redirection to data:text/plain;base64,cmVzcG9uc2UncyBib2R5 denied by Cross-Origin Resource Sharing policy: URL is either a non-HTTP URL or contains credentials.
+
+PASS Testing data URL loading after same-origin redirection (cors mode)
+PASS Testing data URL loading after same-origin redirection (no-cors mode)
+PASS Testing data URL loading after same-origin redirection (same-origin mode)
+PASS Testing data URL loading after cross-origin redirection (cors mode)
+PASS Testing data URL loading after cross-origin redirection (no-cors mode)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlworkerhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html (0 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+<!doctype html>
+<html>
+ <head>
+ <meta charset="utf-8">
+ <title>Fetch in worker: data URL loading after redirections</title>
+ <script src="/resources/testharness.js"></script>
+ <script src="/resources/testharnessreport.js"></script>
+ </head>
+ <body>
+ <script>
+ fetch_tests_from_worker(new Worker("redirect-to-dataurl.js"));
+ </script>
+ </body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurlhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html (0 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+<!doctype html>
+<html>
+ <head>
+ <meta charset="utf-8">
+ <title>Fetch: data URL loading after redirections</title>
+ <script src="/resources/testharness.js"></script>
+ <script src="/resources/testharnessreport.js"></script>
+ </head>
+ <body>
+ <script src="/common/get-host-info.sub.js"></script>
+ <script src="redirect-to-dataurl.js"></script>
+ </body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsfetchapiredirectredirecttodataurljs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.js (0 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.js (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.js 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -0,0 +1,35 @@
</span><ins>+if (this.document === undefined) {
+ importScripts("/common/get-host-info.sub.js")
+ importScripts("/resources/testharness.js");
+}
+
+var dataURL = "data:text/plain;base64,cmVzcG9uc2UncyBib2R5";
+var body = "response's body";
+var contentType = "text/plain";
+
+function redirectDataURL(desc, redirectUrl, mode, isOK) {
+ var url = redirectUrl + "?cors&location=" + encodeURIComponent(dataURL);
+
+ var requestInit = {"mode": mode};
+
+ promise_test(function(test) {
+ var promise = fetch(url, requestInit).then(function(response) {
+ assert_equals(response.type, "opaque", "Response's type should be opaque");
+ assert_equals(response.url, "", "Response URL is empty");
+ assert_equals(response.status, 0, "Response's status should be 0");
+ });
+ return isOK ? promise : promise_rejects(test, new TypeError(), promise);
+ }, desc);
+}
+
+var redirUrl = get_host_info().HTTP_ORIGIN + "/fetch/api/resources/redirect.py";
+var corsRedirUrl = get_host_info().HTTP_REMOTE_ORIGIN + "/fetch/api/resources/redirect.py";
+
+redirectDataURL("Testing data URL loading after same-origin redirection (cors mode)", redirUrl, "cors", false);
+redirectDataURL("Testing data URL loading after same-origin redirection (no-cors mode)", redirUrl, "no-cors", true);
+redirectDataURL("Testing data URL loading after same-origin redirection (same-origin mode)", redirUrl, "same-origin", false);
+
+redirectDataURL("Testing data URL loading after cross-origin redirection (cors mode)", corsRedirUrl, "cors", false);
+redirectDataURL("Testing data URL loading after cross-origin redirection (no-cors mode)", corsRedirUrl, "no-cors", true);
+
+done();
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/ChangeLog 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -1,3 +1,38 @@
</span><ins>+2016-08-31 Youenn Fablet <youenn@apple.com>
+
+ [Fetch API] Fetch API should be able to load data URL in Same Origin mode
+ https://bugs.webkit.org/show_bug.cgi?id=161434
+
+ Reviewed by Sam Weinig.
+
+ Tests: imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl-worker.html
+ imported/w3c/web-platform-tests/fetch/api/redirect/redirect-to-dataurl.html
+ Covered also by added sub-test.
+
+ Moving SameDataURLOrigin option from ThreadableLoaderOptions to ResourceLoaderOptions.
+ This allows doing some of the checks in CachedResourceLoader/CachedResource.
+ This also allows setting this options in CachedResourceLoader clients, ImageLoader in that case.
+
+ * Modules/fetch/FetchLoader.cpp:
+ (WebCore::FetchLoader::start): Setting sameOriginDataURL as ResourceLoader option.
+ * loader/ImageLoader.cpp:
+ (WebCore::ImageLoader::updateFromElement): Setting sameOriginDataURL as specificied in
+ https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element.
+ * loader/ResourceLoaderOptions.h: Adding sameOriginDataURL as ResourceLoader option.
+ * loader/ThreadableLoader.cpp:
+ (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Removing sameOriginDataURL option.
+ * loader/ThreadableLoader.h:
+ * loader/WorkerThreadableLoader.cpp: Setting sameOriginDataURL as ResourceLoader option.
+ (WebCore::LoaderTaskOptions::LoaderTaskOptions):
+ * loader/cache/CachedResource.cpp:
+ (WebCore::CachedResource::load): If resource URL is a data url, we previously marked the resource as same origin.
+ We only do that now if the sameOriginDataURL flag is set as per fetch specification.
+ See https://fetch.spec.whatwg.org/#main-fetch.
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::isSameOriginDataURL): Helper function.
+ (WebCore::CachedResourceLoader::canRequest): Allowing same origin loads of data URLs if flag is set and no redirection happens.
+ See https://fetch.spec.whatwg.org/#http-redirect-fetch for why we check redirection.
+
</ins><span class="cx"> 2016-08-31 Ryosuke Niwa <rniwa@webkit.org>
</span><span class="cx">
</span><span class="cx"> HTML constructor must throw when newTarget is itself
</span></span></pre></div>
<a id="trunkSourceWebCoreModulesfetchFetchLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/fetch/FetchLoader.cpp (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/Modules/fetch/FetchLoader.cpp 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/Modules/fetch/FetchLoader.cpp 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -77,10 +77,10 @@
</span><span class="cx"> ThreadableLoaderOptions options(request.fetchOptions(), ConsiderPreflight,
</span><span class="cx"> context.shouldBypassMainWorldContentSecurityPolicy() ? ContentSecurityPolicyEnforcement::DoNotEnforce : ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective,
</span><span class="cx"> String(cachedResourceRequestInitiators().fetch),
</span><del>- OpaqueResponseBodyPolicy::DoNotReceive,
- SameOriginDataURLFlag::Set);
</del><ins>+ OpaqueResponseBodyPolicy::DoNotReceive);
</ins><span class="cx"> options.sendLoadCallbacks = SendCallbacks;
</span><span class="cx"> options.dataBufferingPolicy = DoNotBufferData;
</span><ins>+ options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
</ins><span class="cx">
</span><span class="cx"> ResourceRequest fetchRequest = request.internalRequest();
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderImageLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/ImageLoader.cpp (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/ImageLoader.cpp 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/ImageLoader.cpp 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -175,6 +175,7 @@
</span><span class="cx"> if (!attr.isNull() && !stripLeadingAndTrailingHTMLSpaces(attr).isEmpty()) {
</span><span class="cx"> ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
</span><span class="cx"> options.contentSecurityPolicyImposition = element().isInUserAgentShadowTree() ? ContentSecurityPolicyImposition::SkipPolicyCheck : ContentSecurityPolicyImposition::DoPolicyCheck;
</span><ins>+ options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
</ins><span class="cx">
</span><span class="cx"> CachedResourceRequest request(ResourceRequest(document.completeURL(sourceURI(attr))), options);
</span><span class="cx"> request.setInitiator(&element());
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderResourceLoaderOptionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/ResourceLoaderOptions.h (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/ResourceLoaderOptions.h 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/ResourceLoaderOptions.h 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -80,6 +80,11 @@
</span><span class="cx"> MayAskClientForCredentials
</span><span class="cx"> };
</span><span class="cx">
</span><ins>+enum class SameOriginDataURLFlag {
+ Set,
+ Unset
+};
+
</ins><span class="cx"> struct ResourceLoaderOptions : public FetchOptions {
</span><span class="cx"> ResourceLoaderOptions() { }
</span><span class="cx">
</span><span class="lines">@@ -110,6 +115,7 @@
</span><span class="cx"> ContentSecurityPolicyImposition contentSecurityPolicyImposition { ContentSecurityPolicyImposition::DoPolicyCheck };
</span><span class="cx"> DefersLoadingPolicy defersLoadingPolicy { DefersLoadingPolicy::AllowDefersLoading };
</span><span class="cx"> CachingPolicy cachingPolicy { CachingPolicy::AllowCaching };
</span><ins>+ SameOriginDataURLFlag sameOriginDataURLFlag { SameOriginDataURLFlag::Unset };
</ins><span class="cx">
</span><span class="cx"> ClientCredentialPolicy clientCredentialPolicy { ClientCredentialPolicy::CannotAskClientForCredentials };
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderThreadableLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/ThreadableLoader.cpp (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/ThreadableLoader.cpp 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/ThreadableLoader.cpp 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -50,13 +50,12 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ThreadableLoaderOptions::ThreadableLoaderOptions(const ResourceLoaderOptions& baseOptions, PreflightPolicy preflightPolicy, ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement, String&& initiator, OpaqueResponseBodyPolicy opaqueResponse, SameOriginDataURLFlag sameOriginDataURLFlag)
</del><ins>+ThreadableLoaderOptions::ThreadableLoaderOptions(const ResourceLoaderOptions& baseOptions, PreflightPolicy preflightPolicy, ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement, String&& initiator, OpaqueResponseBodyPolicy opaqueResponse)
</ins><span class="cx"> : ResourceLoaderOptions(baseOptions)
</span><span class="cx"> , preflightPolicy(preflightPolicy)
</span><span class="cx"> , contentSecurityPolicyEnforcement(contentSecurityPolicyEnforcement)
</span><span class="cx"> , initiator(WTFMove(initiator))
</span><span class="cx"> , opaqueResponse(opaqueResponse)
</span><del>- , sameOriginDataURLFlag(sameOriginDataURLFlag)
</del><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderThreadableLoaderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/ThreadableLoader.h (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/ThreadableLoader.h 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/ThreadableLoader.h 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -63,14 +63,9 @@
</span><span class="cx"> DoNotReceive
</span><span class="cx"> };
</span><span class="cx">
</span><del>- enum class SameOriginDataURLFlag {
- Set,
- Unset
- };
-
</del><span class="cx"> struct ThreadableLoaderOptions : ResourceLoaderOptions {
</span><span class="cx"> ThreadableLoaderOptions();
</span><del>- ThreadableLoaderOptions(const ResourceLoaderOptions&, PreflightPolicy, ContentSecurityPolicyEnforcement, String&& initiator, OpaqueResponseBodyPolicy, SameOriginDataURLFlag);
</del><ins>+ ThreadableLoaderOptions(const ResourceLoaderOptions&, PreflightPolicy, ContentSecurityPolicyEnforcement, String&& initiator, OpaqueResponseBodyPolicy);
</ins><span class="cx"> ~ThreadableLoaderOptions();
</span><span class="cx">
</span><span class="cx"> PreflightPolicy preflightPolicy { ConsiderPreflight };
</span><span class="lines">@@ -77,7 +72,6 @@
</span><span class="cx"> ContentSecurityPolicyEnforcement contentSecurityPolicyEnforcement { ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective };
</span><span class="cx"> String initiator; // This cannot be an AtomicString, as isolatedCopy() wouldn't create an object that's safe for passing to another thread.
</span><span class="cx"> OpaqueResponseBodyPolicy opaqueResponse { OpaqueResponseBodyPolicy::Receive };
</span><del>- SameOriginDataURLFlag sameOriginDataURLFlag { SameOriginDataURLFlag::Unset };
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> // Useful for doing loader operations from any thread (not threadsafe,
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderWorkerThreadableLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/WorkerThreadableLoader.cpp (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/WorkerThreadableLoader.cpp 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/WorkerThreadableLoader.cpp 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> LoaderTaskOptions::LoaderTaskOptions(const ThreadableLoaderOptions& options, const String& referrer, const SecurityOrigin& origin)
</span><del>- : options(options, options.preflightPolicy, options.contentSecurityPolicyEnforcement, options.initiator.isolatedCopy(), options.opaqueResponse, options.sameOriginDataURLFlag)
</del><ins>+ : options(options, options.preflightPolicy, options.contentSecurityPolicyEnforcement, options.initiator.isolatedCopy(), options.opaqueResponse)
</ins><span class="cx"> , referrer(referrer.isolatedCopy())
</span><span class="cx"> , origin(origin.isolatedCopy())
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedResourcecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedResource.cpp (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedResource.cpp 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/cache/CachedResource.cpp 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -309,7 +309,7 @@
</span><span class="cx"> m_origin = cachedResourceLoader.document()->securityOrigin();
</span><span class="cx"> ASSERT(m_origin);
</span><span class="cx">
</span><del>- if (!m_resourceRequest.url().protocolIsData() && m_origin && !m_origin->canRequest(m_resourceRequest.url()))
</del><ins>+ if (!(m_resourceRequest.url().protocolIsData() && options.sameOriginDataURLFlag == SameOriginDataURLFlag::Set) && m_origin && !m_origin->canRequest(m_resourceRequest.url()))
</ins><span class="cx"> setCrossOrigin();
</span><span class="cx">
</span><span class="cx"> addAdditionalRequestHeaders(cachedResourceLoader);
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedResourceLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (205264 => 205265)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2016-08-31 19:54:12 UTC (rev 205264)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2016-08-31 20:18:44 UTC (rev 205265)
</span><span class="lines">@@ -382,6 +382,11 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+static inline bool isSameOriginDataURL(const URL& url, const ResourceLoaderOptions& options, bool didReceiveRedirectResponse)
+{
+ return !didReceiveRedirectResponse && url.protocolIsData() && options.sameOriginDataURLFlag == SameOriginDataURLFlag::Set;
+}
+
</ins><span class="cx"> bool CachedResourceLoader::canRequest(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, bool forPreload, bool didReceiveRedirectResponse)
</span><span class="cx"> {
</span><span class="cx"> if (document() && !document()->securityOrigin()->canDisplay(url)) {
</span><span class="lines">@@ -394,9 +399,8 @@
</span><span class="cx"> bool skipContentSecurityPolicyCheck = options.contentSecurityPolicyImposition == ContentSecurityPolicyImposition::SkipPolicyCheck;
</span><span class="cx"> ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived = didReceiveRedirectResponse ? ContentSecurityPolicy::RedirectResponseReceived::Yes : ContentSecurityPolicy::RedirectResponseReceived::No;
</span><span class="cx">
</span><del>- // Some types of resources can be loaded only from the same origin. Other
- // types of resources, like Images, Scripts, and CSS, can be loaded from
- // any URL.
</del><ins>+ // Some types of resources can be loaded only from the same origin. Other types of resources, like Images, Scripts, and CSS, can be loaded from any URL.
+ // FIXME: We should remove that check and handle it by setting the correct ResourceLoaderOptions::mode.
</ins><span class="cx"> switch (type) {
</span><span class="cx"> case CachedResource::MainResource:
</span><span class="cx"> case CachedResource::ImageResource:
</span><span class="lines">@@ -416,7 +420,7 @@
</span><span class="cx"> #if ENABLE(VIDEO_TRACK)
</span><span class="cx"> case CachedResource::TextTrackResource:
</span><span class="cx"> #endif
</span><del>- if (options.mode == FetchOptions::Mode::SameOrigin && !m_document->securityOrigin()->canRequest(url)) {
</del><ins>+ if (options.mode == FetchOptions::Mode::SameOrigin && !isSameOriginDataURL(url, options, didReceiveRedirectResponse) &&!m_document->securityOrigin()->canRequest(url)) {
</ins><span class="cx"> printAccessDeniedMessage(url);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>