Title: [225702] trunk
Revision
225702
Author
commit-qu...@webkit.org
Date
2017-12-08 14:41:48 -0800 (Fri, 08 Dec 2017)

Log Message

FetchResponse should keep unfiltered ResourceResponse so that it can be used in Service Worker
https://bugs.webkit.org/show_bug.cgi?id=179641
<rdar://problem/35923570>

Patch by Youenn Fablet <you...@apple.com> on 2017-12-08
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

* web-platform-tests/service-workers/service-worker/fetch-request-css-cross-origin-mime-check.https-expected.txt:
* web-platform-tests/service-workers/service-worker/fetch-response-taint.https-expected.txt:

Source/WebCore:

Covered by existing rebased tests.

FetchResponse will now store an unfiltered response.
If it needs to expose it to _javascript_, it will create a filtered response lazily.
This allows service worker to send back to web pages, opaque responses containing every information.

Updating Document::initSecurityContext so that any document loaded with a response whose tainting is Opaque gets a unique origin.
This ensures cross-origin checks to work if service worker returns such a response on a same origin URL.

Updated SubresourceLoader to check cross origin service worker responses based on their tainting.

* Modules/fetch/FetchResponse.cpp:
(WebCore::FetchResponse::create):
(WebCore::FetchResponse::error):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::FetchResponse):
(WebCore::FetchResponse::clone):
(WebCore::FetchResponse::url const):
(WebCore::FetchResponse::filteredResponse const):
(WebCore::FetchResponse::BodyLoader::didReceiveResponse):
(WebCore::FetchResponse::resourceResponse const):
* Modules/fetch/FetchResponse.h:
(WebCore::FetchResponse::create): Deleted.
* dom/Document.cpp:
(WebCore::Document::initSecurityContext):
* loader/SubresourceLoader.cpp:
(WebCore::SubresourceLoader::willSendRequestInternal):
(WebCore::SubresourceLoader::checkResponseCrossOriginAccessControl):

Source/WebKit:

* WebProcess/Storage/ServiceWorkerClientFetch.cpp:
(WebKit::ServiceWorkerClientFetch::didReceiveResponse): In case of opaque redirected response, handle it as a regular response.

LayoutTests:

* TestExpectations:

Modified Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (225701 => 225702)


--- trunk/LayoutTests/ChangeLog	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/LayoutTests/ChangeLog	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,3 +1,13 @@
+2017-12-08  Youenn Fablet  <you...@apple.com>
+
+        FetchResponse should keep unfiltered ResourceResponse so that it can be used in Service Worker
+        https://bugs.webkit.org/show_bug.cgi?id=179641
+        <rdar://problem/35923570>
+
+        Reviewed by Alex Christensen.
+
+        * TestExpectations:
+
 2017-12-08  Konstantin Tokarev  <annu...@yandex.ru>
 
         [python] Replace print operator with print() function for python3 compatibility

Modified: trunk/LayoutTests/TestExpectations (225701 => 225702)


--- trunk/LayoutTests/TestExpectations	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/LayoutTests/TestExpectations	2017-12-08 22:41:48 UTC (rev 225702)
@@ -191,6 +191,8 @@
 imported/w3c/web-platform-tests/service-workers/service-worker/fetch-cors-xhr.https.html [ DumpJSConsoleLogInStdErr Pass Failure ]
 imported/w3c/web-platform-tests/service-workers/service-worker/update.https.html [ Pass Failure Timeout ]
 
+imported/w3c/web-platform-tests/service-workers/service-worker/fetch-response-taint.https.html [ DumpJSConsoleLogInStdErr ]
+
 # Skip workers tests that are timing out or are SharedWorker related only
 imported/w3c/web-platform-tests/workers/constructors/Worker/same-origin.html [ Skip ]
 imported/w3c/web-platform-tests/workers/data-url-shared.html [ Skip ]

Modified: trunk/LayoutTests/imported/w3c/ChangeLog (225701 => 225702)


--- trunk/LayoutTests/imported/w3c/ChangeLog	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/LayoutTests/imported/w3c/ChangeLog	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,3 +1,14 @@
+2017-12-08  Youenn Fablet  <you...@apple.com>
+
+        FetchResponse should keep unfiltered ResourceResponse so that it can be used in Service Worker
+        https://bugs.webkit.org/show_bug.cgi?id=179641
+        <rdar://problem/35923570>
+
+        Reviewed by Alex Christensen.
+
+        * web-platform-tests/service-workers/service-worker/fetch-request-css-cross-origin-mime-check.https-expected.txt:
+        * web-platform-tests/service-workers/service-worker/fetch-response-taint.https-expected.txt:
+
 2017-12-07  Youenn Fablet  <you...@apple.com>
 
         Activate IDB and WebSockets in service workers

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-frame-resource.https-expected.txt (225701 => 225702)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-frame-resource.https-expected.txt	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-frame-resource.https-expected.txt	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,4 +1,6 @@
+CONSOLE MESSAGE: line 51: Blocked a frame with origin "https://localhost:9443" from accessing a frame with origin "null".  The frame requesting access has a protocol of "https", the frame being accessed has a protocol of "https". Protocols must match.
 
+
 PASS Basic type response could be loaded in the iframe. 
 PASS CORS type response could be loaded in the iframe. 
 PASS Opaque type response could not be loaded in the iframe. 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-css-cross-origin-mime-check.https-expected.txt (225701 => 225702)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-css-cross-origin-mime-check.https-expected.txt	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-css-cross-origin-mime-check.https-expected.txt	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,4 +1,4 @@
+CONSOLE MESSAGE: Did not parse stylesheet at 'https://localhost:9443/service-workers/service-worker/resources/cross-origin-html.css' because non CSS MIME types are not allowed for cross-origin stylesheets.
 
+PASS Mime type checking of CSS files fetched via SW. 
 
-FAIL Mime type checking of CSS files fetched via SW. assert_equals: The color must not be overridden by cross origin non CSS file. expected "rgb(0, 0, 255)" but got "rgb(255, 0, 0)"
-

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-response-taint.https-expected.txt (225701 => 225702)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-response-taint.https-expected.txt	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-response-taint.https-expected.txt	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,24 +1,3 @@
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/service-workers/service-worker/resources/fetch-access-control.py?. Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/service-workers/service-worker/resources/fetch-access-control.py?. Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/service-workers/service-worker/resources/fetch-access-control.py?. Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
-CONSOLE MESSAGE: line 20: Fetch API cannot load https://127.0.0.1:9443/?url="" Cross origin requests are not allowed when using same-origin fetch mode.
 
 PASS initialize global state 
 PASS fetching url:"https://localhost:9443/service-workers/service-worker/resources/fetch-access-control.py?" mode:"same-origin" credentials:"omit" should succeed. 
@@ -112,9 +91,9 @@
 PASS fetching url:"https://127.0.0.1:9443/?url="" mode:"no-cors" credentials:"omit" should succeed. 
 PASS fetching url:"https://127.0.0.1:9443/?url="" mode:"no-cors" credentials:"same-origin" should succeed. 
 PASS fetching url:"https://127.0.0.1:9443/?url="" mode:"no-cors" credentials:"include" should succeed. 
-FAIL url:"https://127.0.0.1:9443/?url="" mode:"cors" credentials:"omit" should fail. assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL url:"https://127.0.0.1:9443/?url="" mode:"cors" credentials:"same-origin" should fail. assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL url:"https://127.0.0.1:9443/?url="" mode:"cors" credentials:"include" should fail. assert_unreached: Should have rejected: undefined Reached unreachable code
+PASS url:"https://127.0.0.1:9443/?url="" mode:"cors" credentials:"omit" should fail. 
+PASS url:"https://127.0.0.1:9443/?url="" mode:"cors" credentials:"same-origin" should fail. 
+PASS url:"https://127.0.0.1:9443/?url="" mode:"cors" credentials:"include" should fail. 
 FAIL fetching url:"https://localhost:9443/?url="" mode:"same-origin" credentials:"omit" should succeed. assert_equals: response type expected "cors" but got "basic"
 FAIL fetching url:"https://localhost:9443/?url="" mode:"same-origin" credentials:"same-origin" should succeed. assert_equals: response type expected "cors" but got "basic"
 FAIL fetching url:"https://localhost:9443/?url="" mode:"same-origin" credentials:"include" should succeed. assert_equals: response type expected "cors" but got "basic"

Modified: trunk/Source/WebCore/ChangeLog (225701 => 225702)


--- trunk/Source/WebCore/ChangeLog	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebCore/ChangeLog	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,3 +1,40 @@
+2017-12-08  Youenn Fablet  <you...@apple.com>
+
+        FetchResponse should keep unfiltered ResourceResponse so that it can be used in Service Worker
+        https://bugs.webkit.org/show_bug.cgi?id=179641
+        <rdar://problem/35923570>
+
+        Reviewed by Alex Christensen.
+
+        Covered by existing rebased tests.
+
+        FetchResponse will now store an unfiltered response.
+        If it needs to expose it to _javascript_, it will create a filtered response lazily.
+        This allows service worker to send back to web pages, opaque responses containing every information.
+
+        Updating Document::initSecurityContext so that any document loaded with a response whose tainting is Opaque gets a unique origin.
+        This ensures cross-origin checks to work if service worker returns such a response on a same origin URL.
+
+        Updated SubresourceLoader to check cross origin service worker responses based on their tainting.
+
+        * Modules/fetch/FetchResponse.cpp:
+        (WebCore::FetchResponse::create):
+        (WebCore::FetchResponse::error):
+        (WebCore::FetchResponse::redirect):
+        (WebCore::FetchResponse::FetchResponse):
+        (WebCore::FetchResponse::clone):
+        (WebCore::FetchResponse::url const):
+        (WebCore::FetchResponse::filteredResponse const):
+        (WebCore::FetchResponse::BodyLoader::didReceiveResponse):
+        (WebCore::FetchResponse::resourceResponse const):
+        * Modules/fetch/FetchResponse.h:
+        (WebCore::FetchResponse::create): Deleted.
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::willSendRequestInternal):
+        (WebCore::SubresourceLoader::checkResponseCrossOriginAccessControl):
+
 2017-12-08  David Quesada  <david_ques...@apple.com>
 
         ApplicationManifestParser should strip whitespace from the raw input

Modified: trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp (225701 => 225702)


--- trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp	2017-12-08 22:41:48 UTC (rev 225702)
@@ -44,6 +44,13 @@
     return status == 101 || status == 204 || status == 205 || status == 304;
 }
 
+Ref<FetchResponse> FetchResponse::create(ScriptExecutionContext& context, std::optional<FetchBody>&& body, Ref<FetchHeaders>&& headers, ResourceResponse&& response)
+{
+    auto fetchResponse = adoptRef(*new FetchResponse(context, WTFMove(body), WTFMove(headers), WTFMove(response)));
+    fetchResponse->m_filteredResponse = ResourceResponseBase::filter(fetchResponse->m_internalResponse);
+    return fetchResponse;
+}
+
 ExceptionOr<Ref<FetchResponse>> FetchResponse::create(ScriptExecutionContext& context, std::optional<FetchBody::Init>&& body, Init&& init)
 {
     // 1. If init’s status member is not in the range 200 to 599, inclusive, then throw a RangeError.
@@ -108,10 +115,10 @@
 
     r->m_contentType = contentType;
     auto mimeType = extractMIMETypeFromMediaType(contentType);
-    r->m_response.setMimeType(mimeType.isEmpty() ? defaultMIMEType() : mimeType);
+    r->m_internalResponse.setMimeType(mimeType.isEmpty() ? defaultMIMEType() : mimeType);
 
-    r->m_response.setHTTPStatusCode(status);
-    r->m_response.setHTTPStatusText(statusText);
+    r->m_internalResponse.setHTTPStatusCode(status);
+    r->m_internalResponse.setHTTPStatusText(statusText);
 
     return WTFMove(r);
 }
@@ -119,7 +126,7 @@
 Ref<FetchResponse> FetchResponse::error(ScriptExecutionContext& context)
 {
     auto response = adoptRef(*new FetchResponse(context, { }, FetchHeaders::create(FetchHeaders::Guard::Immutable), { }));
-    response->m_response.setType(Type::Error);
+    response->m_internalResponse.setType(Type::Error);
     return response;
 }
 
@@ -132,7 +139,8 @@
     if (!ResourceResponse::isRedirectionStatusCode(status))
         return Exception { RangeError };
     auto redirectResponse = adoptRef(*new FetchResponse(context, { }, FetchHeaders::create(FetchHeaders::Guard::Immutable), { }));
-    redirectResponse->m_response.setHTTPStatusCode(status);
+    redirectResponse->m_internalResponse.setHTTPStatusCode(status);
+    redirectResponse->m_internalResponse.setHTTPHeaderField(HTTPHeaderName::Location, requestURL.string());
     redirectResponse->m_headers->fastSet(HTTPHeaderName::Location, requestURL.string());
     return WTFMove(redirectResponse);
 }
@@ -139,7 +147,7 @@
 
 FetchResponse::FetchResponse(ScriptExecutionContext& context, std::optional<FetchBody>&& body, Ref<FetchHeaders>&& headers, ResourceResponse&& response)
     : FetchBodyOwner(context, WTFMove(body), WTFMove(headers))
-    , m_response(WTFMove(response))
+    , m_internalResponse(WTFMove(response))
 {
 }
 
@@ -154,7 +162,7 @@
     if (isLoading())
         readableStream(*context.execState());
 
-    auto clone = adoptRef(*new FetchResponse(context, std::nullopt, FetchHeaders::create(headers()), ResourceResponse(m_response)));
+    auto clone = adoptRef(*new FetchResponse(context, std::nullopt, FetchHeaders::create(headers()), ResourceResponse(m_internalResponse)));
     clone->cloneBody(*this);
     if (isBodyOpaque())
         clone->setBodyAsOpaque();
@@ -182,7 +190,7 @@
 const String& FetchResponse::url() const
 {
     if (m_responseURL.isNull()) {
-        URL url = ""
+        URL url = ""
         url.removeFragmentIdentifier();
         m_responseURL = url.string();
     }
@@ -189,6 +197,13 @@
     return m_responseURL;
 }
 
+const ResourceResponse& FetchResponse::filteredResponse() const
+{
+    if (m_filteredResponse)
+        return m_filteredResponse.value();
+    return m_internalResponse;
+}
+
 void FetchResponse::BodyLoader::didSucceed()
 {
     ASSERT(m_response.hasPendingActivity());
@@ -246,13 +261,15 @@
 static uint64_t nextOpaqueLoadIdentifier { 0 };
 void FetchResponse::BodyLoader::didReceiveResponse(const ResourceResponse& resourceResponse)
 {
-    m_response.m_response = ResourceResponseBase::filter(resourceResponse);
+    m_response.m_filteredResponse = ResourceResponseBase::filter(resourceResponse);
+    m_response.m_internalResponse = resourceResponse;
+    m_response.m_internalResponse.setType(m_response.m_filteredResponse->type());
     if (resourceResponse.tainting() == ResourceResponse::Tainting::Opaque) {
         m_response.m_opaqueLoadIdentifier = ++nextOpaqueLoadIdentifier;
         m_response.setBodyAsOpaque();
     }
 
-    m_response.m_headers->filterAndFill(m_response.m_response.httpHeaderFields(), FetchHeaders::Guard::Response);
+    m_response.m_headers->filterAndFill(m_response.m_filteredResponse->httpHeaderFields(), FetchHeaders::Guard::Response);
     m_response.updateContentType();
 
     if (auto responseCallback = WTFMove(m_responseCallback))
@@ -442,10 +459,14 @@
 
 ResourceResponse FetchResponse::resourceResponse() const
 {
-    auto response = m_response;
-    // FIXME: Add a setHTTPHeaderFields on ResourceResponseBase.
-    for (auto& header : headers().internalHeaders())
-        response.setHTTPHeaderField(header.key, header.value);
+    auto response = m_internalResponse;
+
+    if (headers().guard() != FetchHeaders::Guard::Immutable) {
+        // FIXME: Add a setHTTPHeaderFields on ResourceResponseBase.
+        for (auto& header : headers().internalHeaders())
+            response.setHTTPHeaderField(header.key, header.value);
+    }
+
     return response;
 }
 

Modified: trunk/Source/WebCore/Modules/fetch/FetchResponse.h (225701 => 225702)


--- trunk/Source/WebCore/Modules/fetch/FetchResponse.h	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebCore/Modules/fetch/FetchResponse.h	2017-12-08 22:41:48 UTC (rev 225702)
@@ -68,12 +68,12 @@
     void finishConsumingStream(Ref<DeferredPromise>&&);
 #endif
 
-    Type type() const { return m_response.type(); }
+    Type type() const { return filteredResponse().type(); }
     const String& url() const;
-    bool redirected() const { return m_response.isRedirected(); }
-    int status() const { return m_response.httpStatusCode(); }
-    bool ok() const { return m_response.isSuccessful(); }
-    const String& statusText() const { return m_response.httpStatusText(); }
+    bool redirected() const { return filteredResponse().isRedirected(); }
+    int status() const { return filteredResponse().httpStatusCode(); }
+    bool ok() const { return filteredResponse().isSuccessful(); }
+    const String& statusText() const { return filteredResponse().httpStatusText(); }
 
     const FetchHeaders& headers() const { return m_headers; }
     FetchHeaders& headers() { return m_headers; }
@@ -108,6 +108,8 @@
     const char* activeDOMObjectName() const final;
     bool canSuspendForDocumentSuspension() const final;
 
+    const ResourceResponse& filteredResponse() const;
+
 #if ENABLE(STREAMS_API)
     void closeStream();
 #endif
@@ -139,7 +141,8 @@
         std::unique_ptr<FetchLoader> m_loader;
     };
 
-    ResourceResponse m_response;
+    mutable std::optional<ResourceResponse> m_filteredResponse;
+    ResourceResponse m_internalResponse;
     std::optional<BodyLoader> m_bodyLoader;
     mutable String m_responseURL;
     // Opaque responses will padd their body size when used with Cache API.
@@ -147,9 +150,4 @@
     uint64_t m_opaqueLoadIdentifier { 0 };
 };
 
-inline Ref<FetchResponse> FetchResponse::create(ScriptExecutionContext& context, std::optional<FetchBody>&& body, Ref<FetchHeaders>&& headers, ResourceResponse&& response)
-{
-    return adoptRef(*new FetchResponse(context, WTFMove(body), WTFMove(headers), WTFMove(response)));
-}
-
 } // namespace WebCore

Modified: trunk/Source/WebCore/dom/Document.cpp (225701 => 225702)


--- trunk/Source/WebCore/dom/Document.cpp	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebCore/dom/Document.cpp	2017-12-08 22:41:48 UTC (rev 225702)
@@ -5464,7 +5464,13 @@
     if (shouldEnforceContentDispositionAttachmentSandbox())
         applyContentDispositionAttachmentSandbox();
 
-    setSecurityOriginPolicy(SecurityOriginPolicy::create(isSandboxed(SandboxOrigin) ? SecurityOrigin::createUnique() : SecurityOrigin::create(m_url)));
+    bool isSecurityOriginUnique = isSandboxed(SandboxOrigin);
+    if (!isSecurityOriginUnique) {
+        auto* loader = m_frame->loader().documentLoader();
+        isSecurityOriginUnique = loader && loader->response().tainting() == ResourceResponse::Tainting::Opaque;
+    }
+
+    setSecurityOriginPolicy(SecurityOriginPolicy::create(isSecurityOriginUnique ? SecurityOrigin::createUnique() : SecurityOrigin::create(m_url)));
     setContentSecurityPolicy(std::make_unique<ContentSecurityPolicy>(*this));
 
     String overrideContentSecurityPolicy = m_frame->loader().client().overrideContentSecurityPolicy();

Modified: trunk/Source/WebCore/loader/SubresourceLoader.cpp (225701 => 225702)


--- trunk/Source/WebCore/loader/SubresourceLoader.cpp	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebCore/loader/SubresourceLoader.cpp	2017-12-08 22:41:48 UTC (rev 225702)
@@ -214,6 +214,8 @@
             opaqueRedirectedResponse.setType(ResourceResponse::Type::Opaqueredirect);
             opaqueRedirectedResponse.setTainting(ResourceResponse::Tainting::Opaqueredirect);
             m_resource->responseReceived(opaqueRedirectedResponse);
+            if (reachedTerminalState())
+                return;
 
             NetworkLoadMetrics emptyMetrics;
             didFinishLoading(emptyMetrics);
@@ -497,7 +499,7 @@
 
 #if ENABLE(SERVICE_WORKER)
     if (response.source() == ResourceResponse::Source::ServiceWorker)
-        return true;
+        return response.tainting() != ResourceResponse::Tainting::Opaque;
 #endif
 
     ASSERT(m_origin);

Modified: trunk/Source/WebKit/ChangeLog (225701 => 225702)


--- trunk/Source/WebKit/ChangeLog	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebKit/ChangeLog	2017-12-08 22:41:48 UTC (rev 225702)
@@ -1,3 +1,14 @@
+2017-12-08  Youenn Fablet  <you...@apple.com>
+
+        FetchResponse should keep unfiltered ResourceResponse so that it can be used in Service Worker
+        https://bugs.webkit.org/show_bug.cgi?id=179641
+        <rdar://problem/35923570>
+
+        Reviewed by Alex Christensen.
+
+        * WebProcess/Storage/ServiceWorkerClientFetch.cpp:
+        (WebKit::ServiceWorkerClientFetch::didReceiveResponse): In case of opaque redirected response, handle it as a regular response.
+
 2017-12-08  Alex Christensen  <achristen...@webkit.org>
 
         Remove unused code in WebPageGroup

Modified: trunk/Source/WebKit/WebProcess/Storage/ServiceWorkerClientFetch.cpp (225701 => 225702)


--- trunk/Source/WebKit/WebProcess/Storage/ServiceWorkerClientFetch.cpp	2017-12-08 22:28:31 UTC (rev 225701)
+++ trunk/Source/WebKit/WebProcess/Storage/ServiceWorkerClientFetch.cpp	2017-12-08 22:41:48 UTC (rev 225702)
@@ -65,11 +65,11 @@
     m_connection->startFetch(m_loader, m_loader->identifier());
 }
 
-void ServiceWorkerClientFetch::didReceiveResponse(WebCore::ResourceResponse&& response)
+void ServiceWorkerClientFetch::didReceiveResponse(ResourceResponse&& response)
 {
     auto protectedThis = makeRef(*this);
 
-    if (response.isRedirection()) {
+    if (response.isRedirection() && response.tainting() != ResourceResponse::Tainting::Opaqueredirect) {
         m_redirectionStatus = RedirectionStatus::Receiving;
         // FIXME: Get shouldClearReferrerOnHTTPSToHTTPRedirect value from
         m_loader->willSendRequest(m_loader->request().redirectedRequest(response, m_shouldClearReferrerOnHTTPSToHTTPRedirect), response, [protectedThis = makeRef(*this), this](ResourceRequest&& request) {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to