Title: [211926] trunk
- Revision
- 211926
- Author
- [email protected]
- Date
- 2017-02-08 18:50:00 -0800 (Wed, 08 Feb 2017)
Log Message
HTML Link elements should load data URLs as same origin
https://bugs.webkit.org/show_bug.cgi?id=168032
<rdar://problem/30275036>
Patch by Youenn Fablet <[email protected]> on 2017-02-08
Reviewed by Alex Christensen.
Source/WebCore:
Test: fast/dom/data-url-css-link-element-cors-active.html
Making CSS data URLs resources considered as same origin when loaded through link elements.
In the future, we should consider remove the data URL same origin flag and fully align with the fetch and HTML spec.
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::process):
LayoutTests:
* fast/dom/data-url-css-link-element-cors-active-expected.txt: Added.
* fast/dom/data-url-css-link-element-cors-active.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (211925 => 211926)
--- trunk/LayoutTests/ChangeLog 2017-02-09 02:13:51 UTC (rev 211925)
+++ trunk/LayoutTests/ChangeLog 2017-02-09 02:50:00 UTC (rev 211926)
@@ -1,3 +1,14 @@
+2017-02-08 Youenn Fablet <[email protected]>
+
+ HTML Link elements should load data URLs as same origin
+ https://bugs.webkit.org/show_bug.cgi?id=168032
+ <rdar://problem/30275036>
+
+ Reviewed by Alex Christensen.
+
+ * fast/dom/data-url-css-link-element-cors-active-expected.txt: Added.
+ * fast/dom/data-url-css-link-element-cors-active.html: Added.
+
2017-02-08 Sam Weinig <[email protected]>
REGRESSION (r193286): Promise chain no longer prevent UI refresh
Added: trunk/LayoutTests/fast/dom/data-url-css-link-element-cors-active-expected.txt (0 => 211926)
--- trunk/LayoutTests/fast/dom/data-url-css-link-element-cors-active-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/data-url-css-link-element-cors-active-expected.txt 2017-02-09 02:50:00 UTC (rev 211926)
@@ -0,0 +1,3 @@
+This test tries to load a CSS link data URL with CORS activated.
+
+PASS
Added: trunk/LayoutTests/fast/dom/data-url-css-link-element-cors-active.html (0 => 211926)
--- trunk/LayoutTests/fast/dom/data-url-css-link-element-cors-active.html (rev 0)
+++ trunk/LayoutTests/fast/dom/data-url-css-link-element-cors-active.html 2017-02-09 02:50:00 UTC (rev 211926)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+function log(message)
+{
+ document.getElementById("log").innerHTML = message;
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+}
+</script>
+<html>
+ <p>This test tries to load a CSS link data URL with CORS activated.</p>
+<link href="" crossOrigin="anonymous" rel="stylesheet" _onload_="log('PASS')" _onerror_="log('FAIL')">
+<p>
+<p id="log"></p>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (211925 => 211926)
--- trunk/Source/WebCore/ChangeLog 2017-02-09 02:13:51 UTC (rev 211925)
+++ trunk/Source/WebCore/ChangeLog 2017-02-09 02:50:00 UTC (rev 211926)
@@ -1,3 +1,19 @@
+2017-02-08 Youenn Fablet <[email protected]>
+
+ HTML Link elements should load data URLs as same origin
+ https://bugs.webkit.org/show_bug.cgi?id=168032
+ <rdar://problem/30275036>
+
+ Reviewed by Alex Christensen.
+
+ Test: fast/dom/data-url-css-link-element-cors-active.html
+
+ Making CSS data URLs resources considered as same origin when loaded through link elements.
+ In the future, we should consider remove the data URL same origin flag and fully align with the fetch and HTML spec.
+
+ * html/HTMLLinkElement.cpp:
+ (WebCore::HTMLLinkElement::process):
+
2017-02-08 Sam Weinig <[email protected]>
REGRESSION (r193286): Promise chain no longer prevent UI refresh
Modified: trunk/Source/WebCore/html/HTMLLinkElement.cpp (211925 => 211926)
--- trunk/Source/WebCore/html/HTMLLinkElement.cpp 2017-02-09 02:13:51 UTC (rev 211925)
+++ trunk/Source/WebCore/html/HTMLLinkElement.cpp 2017-02-09 02:50:00 UTC (rev 211926)
@@ -266,14 +266,15 @@
std::optional<ResourceLoadPriority> priority;
if (!isActive)
priority = ResourceLoadPriority::VeryLow;
- CachedResourceRequest request(url, CachedResourceLoader::defaultCachedResourceOptions(), priority, WTFMove(charset));
+
+ ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
+ options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
+ if (document().contentSecurityPolicy()->allowStyleWithNonce(attributeWithoutSynchronization(HTMLNames::nonceAttr)))
+ options.contentSecurityPolicyImposition = ContentSecurityPolicyImposition::SkipPolicyCheck;
+
+ CachedResourceRequest request(url, options, priority, WTFMove(charset));
request.setInitiator(*this);
- if (document().contentSecurityPolicy()->allowStyleWithNonce(attributeWithoutSynchronization(HTMLNames::nonceAttr))) {
- ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
- options.contentSecurityPolicyImposition = ContentSecurityPolicyImposition::SkipPolicyCheck;
- request.setOptions(options);
- }
request.setAsPotentiallyCrossOrigin(crossOrigin(), document());
m_cachedSheet = document().cachedResourceLoader().requestCSSStyleSheet(WTFMove(request));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
