Title: [205750] trunk
Revision
205750
Author
[email protected]
Date
2016-09-09 10:24:58 -0700 (Fri, 09 Sep 2016)

Log Message

TextTrackLoader should use FetchOptions::mode according its crossOrigin attribute
https://bugs.webkit.org/show_bug.cgi?id=161792

Patch by Youenn Fablet <[email protected]> on 2016-09-09
Reviewed by Eric Carlson.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/addCue-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/removeCue-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/endTime-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/id-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/pauseOnExit-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/startTime-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/track-expected.txt:

Source/WebCore:

Covered by existing and updated tests.

Updating text track loader to use fetch mode according crossOrigin value.

Removed the check done in the case the crossOrigin value is not set.
Previously cross-origin loads were forbidden, now this is authorized.
This change allows aligning with the spec.
Also, this check could be bypassed in the case of a same-origin URL redirecting to a cross-origin one.

* loader/TextTrackLoader.cpp:
(WebCore::TextTrackLoader::notifyFinished): Checking resource error in lieu of doing CORS checks on its own.
(WebCore::TextTrackLoader::load): Using CachedResourceRequest::setAsPotentiallyCrossOrigin
* loader/TextTrackLoader.h:
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::loadFrom): Setting loading and status values as would be done when load is finished.
(WebCore::CachedResource::setBodyDataFrom): Default implementation is to copy the shared buffer.
* loader/cache/CachedResource.h:
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::updateCachedResourceWithCurrentRequest): Enabling resource update when mode or origin is different for TextTrack resources.

LayoutTests:

* http/tests/security/text-track-crossorigin-expected.txt:
* http/tests/security/text-track-crossorigin.html: Updating test to be more robust against timeout.
Updated test to succeed doing no-cors loading of cross-origin resources.

Modified Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (205749 => 205750)


--- trunk/LayoutTests/ChangeLog	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/ChangeLog	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,3 +1,14 @@
+2016-09-09  Youenn Fablet  <[email protected]>
+
+        TextTrackLoader should use FetchOptions::mode according its crossOrigin attribute
+        https://bugs.webkit.org/show_bug.cgi?id=161792
+
+        Reviewed by Eric Carlson.
+
+        * http/tests/security/text-track-crossorigin-expected.txt:
+        * http/tests/security/text-track-crossorigin.html: Updating test to be more robust against timeout.
+        Updated test to succeed doing no-cors loading of cross-origin resources.
+
 2016-09-09  Ryan Haddad  <[email protected]>
 
         Marking imported/w3c/web-platform-tests/IndexedDB/keyorder.htm as flaky on mac-wk2 debug.

Modified: trunk/LayoutTests/http/tests/security/text-track-crossorigin-expected.txt (205749 => 205750)


--- trunk/LayoutTests/http/tests/security/text-track-crossorigin-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/http/tests/security/text-track-crossorigin-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,13 +1,13 @@
+CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
 CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 Tests loading cross-domain <track>.
 
 
 Loading without Access-Control-Allow-Origin header, no "crossorigin" attribute on <video>
-EVENT(error)
-PASS: shouldLoad should be 'false' and is.
+EVENT(load)
+PASS: shouldLoad should be 'true' and is.
 PASS: event.target should be '[object HTMLTrackElement]' and is.
-PASS: trackElement.readyState should be '3' and is.
+PASS: trackElement.readyState should be '2' and is.
 
 
 Loading without Access-Control-Allow-Origin header, setting video.crossorigin to "anonymous"

Modified: trunk/LayoutTests/http/tests/security/text-track-crossorigin.html (205749 => 205750)


--- trunk/LayoutTests/http/tests/security/text-track-crossorigin.html	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/http/tests/security/text-track-crossorigin.html	2016-09-09 17:24:58 UTC (rev 205750)
@@ -4,7 +4,7 @@
         <script src=""
         <script>
 
-            var shouldLoad = false;
+            var shouldLoad = true;
             var counter = 0;
 
             if (window.testRunner) {
@@ -29,6 +29,16 @@
 
                 log('<br>');
                 switch(counter) {
+                case 0:
+                    log('Loading <b>without</b> Access-Control-Allow-Origin header, setting video.crossorigin to "anonymous"');
+                    url = "" + counter;
+                    videoElement.setAttribute('crossorigin', 'anonymous');
+                    trackElement.removeAttribute('src');
+                    trackElement.setAttribute('src', url);
+                    shouldLoad = false;
+                    ++counter;
+                    break;
+
                 case 2:
                     log('Loading <b>with</b> Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers, setting video.crossorigin to "use-credentials"');
                     url = ""
@@ -41,6 +51,9 @@
                     log("END OF TEST");
                     if (window.testRunner)
                         testRunner.notifyDone();
+                defaut:
+                    if (window.testRunner)
+                        testRunner.notifyDone();
                 }
             }
 
@@ -56,15 +69,6 @@
 
                 log('<br>');
                 switch(counter) {
-                case 0:
-                    log('Loading <b>without</b> Access-Control-Allow-Origin header, setting video.crossorigin to "anonymous"');
-                    url = "" + counter;
-                    videoElement.setAttribute('crossorigin', 'anonymous');
-                    trackElement.removeAttribute('src');
-                    trackElement.setAttribute('src', url);
-                    ++counter;
-                    break;
-
                 case 1:
                     log('Loading <b>with</b> Access-Control-Allow-Origin header, leaving video.crossorigin as "anonymous"');
                     url = ""
@@ -72,8 +76,10 @@
                     shouldLoad = true;
                     ++counter;
                     break;
+                defaut:
+                    if (window.testRunner)
+                        testRunner.notifyDone();
                 }
-
             }
 
             function start()

Modified: trunk/LayoutTests/imported/w3c/ChangeLog (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/ChangeLog	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/ChangeLog	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,22 @@
 2016-09-09  Youenn Fablet  <[email protected]>
 
+        TextTrackLoader should use FetchOptions::mode according its crossOrigin attribute
+        https://bugs.webkit.org/show_bug.cgi?id=161792
+
+        Reviewed by Eric Carlson.
+
+        Rebaseline W3C test now that more checks are passing.
+
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/addCue-expected.txt:
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/removeCue-expected.txt:
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/endTime-expected.txt:
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/id-expected.txt:
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/pauseOnExit-expected.txt:
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/startTime-expected.txt:
+        * web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/track-expected.txt:
+
+2016-09-09  Youenn Fablet  <[email protected]>
+
         Sync web-platform-tests up to revision 6d9c836
         https://bugs.webkit.org/show_bug.cgi?id=161738
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/addCue-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/addCue-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/addCue-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,8 +1,7 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrack.addCue(), adding a cue to two different tracks 
 PASS TextTrack.addCue(), adding a cue to a track twice 
 PASS TextTrack.addCue(), adding a removed cue to a different track 
 PASS TextTrack.addCue(), adding an associated but removed cue to the same track 
-FAIL TextTrack.addCue(), adding a cue associated with a track element to other track assert_unreached: got error event Reached unreachable code
+PASS TextTrack.addCue(), adding a cue associated with a track element to other track 
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/removeCue-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/removeCue-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrack/removeCue-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,4 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrack.removeCue(), two elementless tracks 
-FAIL TextTrack.removeCue(), cue from track element assert_unreached: got error event Reached unreachable code
+PASS TextTrack.removeCue(), cue from track element 
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/endTime-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/endTime-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/endTime-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,4 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrackCue.endTime, script-created cue 
-FAIL TextTrackCue.endTime, parsed cue assert_unreached: got error event Reached unreachable code
+FAIL TextTrackCue.endTime, parsed cue null is not an object (evaluating 'assert_equals')
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/id-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/id-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/id-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,4 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrackCue.id, script-created cue 
-FAIL TextTrackCue.id, parsed cue assert_unreached: got error event Reached unreachable code
+FAIL TextTrackCue.id, parsed cue null is not an object (evaluating 'assert_equals')
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/pauseOnExit-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/pauseOnExit-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/pauseOnExit-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,4 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrackCue.pauseOnExit, script-created cue 
-FAIL TextTrackCue.pauseOnExit, parsed cue assert_unreached: got error event Reached unreachable code
+FAIL TextTrackCue.pauseOnExit, parsed cue null is not an object (evaluating 't.track.cues')
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/startTime-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/startTime-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/startTime-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,4 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrackCue.startTime, script-created cue 
-FAIL TextTrackCue.startTime, parsed cue assert_unreached: got error event Reached unreachable code
+FAIL TextTrackCue.startTime, parsed cue null is not an object (evaluating 'assert_equals')
 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/track-expected.txt (205749 => 205750)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/track-expected.txt	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/interfaces/TextTrackCue/track-expected.txt	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,5 +1,4 @@
-CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
 
 PASS TextTrackCue.track, script-created cue 
-FAIL TextTrackCue.track, parsed cue assert_unreached: got error event Reached unreachable code
+FAIL TextTrackCue.track, parsed cue null is not an object (evaluating 't.track.cues')
 

Modified: trunk/Source/WebCore/ChangeLog (205749 => 205750)


--- trunk/Source/WebCore/ChangeLog	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/Source/WebCore/ChangeLog	2016-09-09 17:24:58 UTC (rev 205750)
@@ -1,3 +1,30 @@
+2016-09-09  Youenn Fablet  <[email protected]>
+
+        TextTrackLoader should use FetchOptions::mode according its crossOrigin attribute
+        https://bugs.webkit.org/show_bug.cgi?id=161792
+
+        Reviewed by Eric Carlson.
+
+        Covered by existing and updated tests.
+
+        Updating text track loader to use fetch mode according crossOrigin value.
+
+        Removed the check done in the case the crossOrigin value is not set.
+        Previously cross-origin loads were forbidden, now this is authorized.
+        This change allows aligning with the spec.
+        Also, this check could be bypassed in the case of a same-origin URL redirecting to a cross-origin one.
+
+        * loader/TextTrackLoader.cpp:
+        (WebCore::TextTrackLoader::notifyFinished): Checking resource error in lieu of doing CORS checks on its own.
+        (WebCore::TextTrackLoader::load): Using CachedResourceRequest::setAsPotentiallyCrossOrigin
+        * loader/TextTrackLoader.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::loadFrom): Setting loading and status values as would be done when load is finished.
+        (WebCore::CachedResource::setBodyDataFrom): Default implementation is to copy the shared buffer.
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::updateCachedResourceWithCurrentRequest): Enabling resource update when mode or origin is different for TextTrack resources.
+
 2016-09-09  Alex Christensen  <[email protected]>
 
         URLParser should parse URLs with non-special schemes

Modified: trunk/Source/WebCore/loader/TextTrackLoader.cpp (205749 => 205750)


--- trunk/Source/WebCore/loader/TextTrackLoader.cpp	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/Source/WebCore/loader/TextTrackLoader.cpp	2016-09-09 17:24:58 UTC (rev 205750)
@@ -124,8 +124,7 @@
 {
     ASSERT(m_resource == resource);
 
-    Document* document = downcast<Document>(m_scriptExecutionContext);
-    if (!m_crossOriginMode.isNull() && !resource->passesSameOriginPolicyCheck(*document->securityOrigin()))
+    if (resource->resourceError().isAccessControl())
         corsPolicyPreventedLoad();
 
     if (m_state != Failed) {
@@ -141,7 +140,7 @@
 
     if (!m_cueLoadTimer.isActive())
         m_cueLoadTimer.startOneShot(0);
-    
+
     cancelLoad();
 }
 
@@ -156,25 +155,14 @@
     options.contentSecurityPolicyImposition = isInitiatingElementInUserAgentShadowTree ? ContentSecurityPolicyImposition::SkipPolicyCheck : ContentSecurityPolicyImposition::DoPolicyCheck;
 
     CachedResourceRequest cueRequest(ResourceRequest(document->completeURL(url)), options);
+    cueRequest.setAsPotentiallyCrossOrigin(crossOriginMode, *document);
 
-    if (!crossOriginMode.isNull()) {
-        m_crossOriginMode = crossOriginMode;
-        StoredCredentials allowCredentials = equalLettersIgnoringASCIICase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-        updateRequestForAccessControl(cueRequest.mutableResourceRequest(), *document->securityOrigin(), allowCredentials);
-    } else {
-        // Cross-origin resources that are not suitably CORS-enabled may not load.
-        if (!document->securityOrigin()->canRequest(url)) {
-            corsPolicyPreventedLoad();
-            return false;
-        }
-    }
-
     m_resource = document->cachedResourceLoader().requestTextTrack(cueRequest);
     if (!m_resource)
         return false;
 
     m_resource->addClient(this);
-    
+
     return true;
 }
 

Modified: trunk/Source/WebCore/loader/TextTrackLoader.h (205749 => 205750)


--- trunk/Source/WebCore/loader/TextTrackLoader.h	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/Source/WebCore/loader/TextTrackLoader.h	2016-09-09 17:24:58 UTC (rev 205750)
@@ -83,7 +83,6 @@
     CachedResourceHandle<CachedTextTrack> m_resource;
     ScriptExecutionContext* m_scriptExecutionContext;
     Timer m_cueLoadTimer;
-    String m_crossOriginMode;
     State m_state;
     unsigned m_parseOffset;
     bool m_newCuesAvailable;

Modified: trunk/Source/WebCore/loader/cache/CachedResource.cpp (205749 => 205750)


--- trunk/Source/WebCore/loader/cache/CachedResource.cpp	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/Source/WebCore/loader/cache/CachedResource.cpp	2016-09-09 17:24:58 UTC (rev 205750)
@@ -358,8 +358,15 @@
     }
 
     setBodyDataFrom(resource);
+    setStatus(Status::Cached);
+    setLoading(false);
 }
 
+void CachedResource::setBodyDataFrom(const CachedResource& resource)
+{
+    m_data = resource.m_data;
+}
+
 void CachedResource::checkNotify()
 {
     if (isLoading() || stillNeedsLoad())

Modified: trunk/Source/WebCore/loader/cache/CachedResource.h (205749 => 205750)


--- trunk/Source/WebCore/loader/cache/CachedResource.h	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/Source/WebCore/loader/cache/CachedResource.h	2016-09-09 17:24:58 UTC (rev 205750)
@@ -307,7 +307,7 @@
 
     virtual void checkNotify();
     virtual bool mayTryReplaceEncodedData() const { return false; }
-    virtual void setBodyDataFrom(const CachedResource&) { }
+    virtual void setBodyDataFrom(const CachedResource&);
 
     std::chrono::microseconds freshnessLifetime(const ResourceResponse&) const;
 

Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (205749 => 205750)


--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp	2016-09-09 17:06:24 UTC (rev 205749)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp	2016-09-09 17:24:58 UTC (rev 205750)
@@ -546,7 +546,7 @@
     CachedResource& resource = *resourceHandle;
 
     // FIXME: We should progressively extend this to other reusable resources
-    if (resource.type() != CachedResource::Type::ImageResource)
+    if (resource.type() != CachedResource::Type::ImageResource && resource.type() != CachedResource::Type::TextTrackResource)
         return false;
 
     bool shouldUpdate = resource.options().mode != request.options().mode || request.resourceRequest().httpOrigin() != resource.resourceRequest().httpOrigin();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to