<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#006600" bgcolor="#ffffff">
Hi.<br>
<br>
I've been working with the Chromium Embedded Framework (in windows)
which gives webkit version 534.20. I am trying to get a custom scheme
to work with XHR. <br>
<br>
By way of background, I first updated the Cef code so that custom
schemes can be declared "non-standard", which avoids certain parsing
errors. Non-standard schemes include "data", "javascript", "file".
Webkit has a mechanism for registering standard schemes, so all I
needed to do was /not/ register custom schemes that were non-standard.<br>
<br>
My custom scheme works fine at the beginning of the request.
Chromium/Cef successfully calls my scheme handler and my response data
is read. But it fails when the
DocumentThreadableLoader::DocumentThreadableLoader constructor starts
checking for cross-origin security.<br>
<br>
I was able to get the code to "work" by bypassing the origin tests and
simply calling "loadRequest" in that constructor.<br>
<br>
As a fix, I'd like to propose that non-standard scheme URLs be
accessible from any security origin.<br>
<br>
A patch to SecurityOrigin::canRequest could set
DocumentThreadableLoader::m_sameOriginRequest to true if
url_util::DoIsStandard returns false. This would use Webkit's existing
whitelist mechanism for standard schemes. If necessary, exclusions
could be hardcoded if certain non-standard schemes are inappropriate
for this policy.<br>
<br>
Since this could have significant security implications, I wanted to
run it by here first.<br>
<br>
I realize that my use case is stretching XMLHttpRequest well past http,
but this would allow using custom schemes with libraries that support
AJAX requests, such as JSTree.<br>
<br>
Curiously enough, I ran into the "rdar" scheme in the code, referencing
Apple's internal bug database. Given the current webkit security
policy, it would be impossible to access rdar URLs via Ajax. My
proposed change would allow it (assuming an appropriate scheme handler
is available).<br>
<br>
FWIW, I'd be happy to figure out and provide a patch.<br>
<br>
-j<br>
<br>
<pre class="moz-signature" cols="72">--
Joe Andrieu
<a class="moz-txt-link-abbreviated" href="mailto:joe@andrieu.net">joe@andrieu.net</a>
+1 (805) 705-8651</pre>
</body>
</html>