[Webkit-unassigned] [Bug 185807] REGRESSION (r231107): Test http/tests/quicklook/same-origin-xmlhttprequest-allowed.html logs CSP failure

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=185807

--- Comment #2 from youenn fablet <youennf at gmail.com> ---
The test is trying to load a quick look URL using XHR.
In that particular case, ResourceLoader::willSendRequestInternal will call previewConverter->safeRequest. The request URL is then updated and becomes "about:".

Before moving the checks to NetworkProcess, DocumentThreadableLoader was not doing any further check since the request URL was the quick look URL and not "about:", thus the request is considered same-origin.

Now that checks are done in NetworkProcess, "about:" is used for the checks.
For this particular quick look + "about:" URL, it is easy to fix it in WebLoaderStrategy by disabling network checks in that particular case.

The same issue might arise if an injected bundle decides to change the request URL on the fly.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180530/571ba777/attachment.html>