Diff
Modified: trunk/LayoutTests/ChangeLog (279031 => 279032)
--- trunk/LayoutTests/ChangeLog 2021-06-18 05:35:58 UTC (rev 279031)
+++ trunk/LayoutTests/ChangeLog 2021-06-18 08:05:25 UTC (rev 279032)
@@ -1,3 +1,13 @@
+2021-06-18 Carlos Garcia Campos <[email protected]>
+
+ [SOUP] Add Timing-Allow-Origin checks to NetworkDataTaskSoup
+ https://bugs.webkit.org/show_bug.cgi?id=227008
+ <rdar://problem/79384792>
+
+ Reviewed by Adrian Perez de Castro.
+
+ * platform/glib/TestExpectations:
+
2021-06-17 Diego Pino Garcia <[email protected]>
[GTK][WPE] Unreviewed test gardening. Update baselines after r278974.
Modified: trunk/LayoutTests/platform/glib/TestExpectations (279031 => 279032)
--- trunk/LayoutTests/platform/glib/TestExpectations 2021-06-18 05:35:58 UTC (rev 279031)
+++ trunk/LayoutTests/platform/glib/TestExpectations 2021-06-18 08:05:25 UTC (rev 279032)
@@ -881,22 +881,6 @@
webkit.org/b/179475 imported/w3c/web-platform-tests/fetch/api/basic/request-headers-case.any.html [ Failure ]
webkit.org/b/179475 imported/w3c/web-platform-tests/fetch/api/basic/request-headers-case.any.worker.html [ Failure ]
-# Related to moving to Timing-Allow-Origin checks into the network process
-webkit.org/b/227008 http/tests/misc/webtiming-cross-origin-and-back1.html [ Failure ]
-webkit.org/b/227008 http/tests/misc/webtiming-cross-origin-redirect.py [ Failure ]
-webkit.org/b/227008 http/wpt/resource-timing/rt-cors.html [ Failure ]
-webkit.org/b/227008 http/wpt/resource-timing/rt-cors.worker.html [ Failure ]
-webkit.org/b/227008 http/wpt/resource-timing/rt-revalidate-requests-2.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/TAO-case-insensitive-null-opaque-origin.sub.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/TAO-crossorigin-port.sub.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/cross-origin-redirects.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/redirects.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/resource_reuse.sub.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/resource_timing_content_length.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/resource-timing/same-origin-from-cross-origin-redirect.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/server-timing/cross_origin.html [ Failure ]
-webkit.org/b/227008 imported/w3c/web-platform-tests/service-workers/service-worker/resource-timing-cross-origin.https.html [ Failure ]
-
#////////////////////////////////////////////////////////////////////////////////////////
# End of SOUP and Networking-related bugs
#////////////////////////////////////////////////////////////////////////////////////////
Modified: trunk/Source/WebKit/ChangeLog (279031 => 279032)
--- trunk/Source/WebKit/ChangeLog 2021-06-18 05:35:58 UTC (rev 279031)
+++ trunk/Source/WebKit/ChangeLog 2021-06-18 08:05:25 UTC (rev 279032)
@@ -1,3 +1,21 @@
+2021-06-18 Carlos Garcia Campos <[email protected]>
+
+ [SOUP] Add Timing-Allow-Origin checks to NetworkDataTaskSoup
+ https://bugs.webkit.org/show_bug.cgi?id=227008
+ <rdar://problem/79384792>
+
+ Reviewed by Adrian Perez de Castro.
+
+ Add missing TAO checks to Soup backend.
+
+ * NetworkProcess/NetworkDataTask.cpp:
+ (WebKit::NetworkDataTask::create):
+ * NetworkProcess/soup/NetworkDataTaskSoup.cpp:
+ (WebKit::NetworkDataTaskSoup::NetworkDataTaskSoup):
+ (WebKit::NetworkDataTaskSoup::didSendRequest):
+ (WebKit::NetworkDataTaskSoup::continueHTTPRedirection):
+ * NetworkProcess/soup/NetworkDataTaskSoup.h:
+
2021-06-17 Said Abou-Hallawa <[email protected]>
[Cocoa] Disable hardware decoding in the WebProcess
Modified: trunk/Source/WebKit/NetworkProcess/NetworkDataTask.cpp (279031 => 279032)
--- trunk/Source/WebKit/NetworkProcess/NetworkDataTask.cpp 2021-06-18 05:35:58 UTC (rev 279031)
+++ trunk/Source/WebKit/NetworkProcess/NetworkDataTask.cpp 2021-06-18 08:05:25 UTC (rev 279032)
@@ -56,7 +56,7 @@
return NetworkDataTaskCocoa::create(session, client, parameters);
#endif
#if USE(SOUP)
- return NetworkDataTaskSoup::create(session, client, parameters.request, parameters.webFrameID, parameters.webPageID, parameters.storedCredentialsPolicy, parameters.contentSniffingPolicy, parameters.contentEncodingSniffingPolicy, parameters.shouldClearReferrerOnHTTPSToHTTPRedirect, parameters.shouldPreconnectOnly, parameters.isMainFrameNavigation);
+ return NetworkDataTaskSoup::create(session, client, parameters);
#endif
#if USE(CURL)
return NetworkDataTaskCurl::create(session, client, parameters.request, parameters.webFrameID, parameters.webPageID, parameters.storedCredentialsPolicy, parameters.contentSniffingPolicy, parameters.contentEncodingSniffingPolicy, parameters.shouldClearReferrerOnHTTPSToHTTPRedirect, parameters.isMainFrameNavigation, parameters.shouldRelaxThirdPartyCookieBlocking);
Modified: trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp (279031 => 279032)
--- trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp 2021-06-18 05:35:58 UTC (rev 279031)
+++ trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp 2021-06-18 08:05:25 UTC (rev 279032)
@@ -45,6 +45,7 @@
#include <WebCore/SoupNetworkSession.h>
#include <WebCore/SoupVersioning.h>
#include <WebCore/TextEncoding.h>
+#include <WebCore/TimingAllowOrigin.h>
#include <wtf/MainThread.h>
#include <wtf/glib/RunLoopSourcePriority.h>
@@ -53,17 +54,18 @@
static const size_t gDefaultReadBufferSize = 8192;
-NetworkDataTaskSoup::NetworkDataTaskSoup(NetworkSession& session, NetworkDataTaskClient& client, const ResourceRequest& requestWithCredentials, FrameIdentifier frameID, PageIdentifier pageID, StoredCredentialsPolicy storedCredentialsPolicy, ContentSniffingPolicy shouldContentSniff, WebCore::ContentEncodingSniffingPolicy, bool shouldClearReferrerOnHTTPSToHTTPRedirect, PreconnectOnly shouldPreconnectOnly, bool dataTaskIsForMainFrameNavigation)
- : NetworkDataTask(session, client, requestWithCredentials, storedCredentialsPolicy, shouldClearReferrerOnHTTPSToHTTPRedirect, dataTaskIsForMainFrameNavigation)
- , m_frameID(frameID)
- , m_pageID(pageID)
- , m_shouldContentSniff(shouldContentSniff)
- , m_shouldPreconnectOnly(shouldPreconnectOnly)
+NetworkDataTaskSoup::NetworkDataTaskSoup(NetworkSession& session, NetworkDataTaskClient& client, const NetworkLoadParameters& parameters)
+ : NetworkDataTask(session, client, parameters.request, parameters.storedCredentialsPolicy, parameters.shouldClearReferrerOnHTTPSToHTTPRedirect, parameters.isMainFrameNavigation)
+ , m_frameID(parameters.webFrameID)
+ , m_pageID(parameters.webPageID)
+ , m_shouldContentSniff(parameters.contentSniffingPolicy)
+ , m_shouldPreconnectOnly(parameters.shouldPreconnectOnly)
+ , m_sourceOrigin(parameters.sourceOrigin)
, m_timeoutSource(RunLoop::main(), this, &NetworkDataTaskSoup::timeoutFired)
{
m_session->registerNetworkDataTask(*this);
- auto request = requestWithCredentials;
+ auto request = parameters.request;
if (request.url().protocolIsInHTTPFamily()) {
#if USE(SOUP2)
m_networkLoadMetrics.fetchStart = MonotonicTime::now();
@@ -483,6 +485,12 @@
m_networkLoadMetrics.responseStart = MonotonicTime::now();
#endif
+ if (!m_networkLoadMetrics.failsTAOCheck) {
+ RefPtr<SecurityOrigin> origin = isTopLevelNavigation() ? SecurityOrigin::create(firstRequest().url()) : m_sourceOrigin;
+ if (origin)
+ m_networkLoadMetrics.failsTAOCheck = !passesTimingAllowOriginCheck(m_response, *origin);
+ }
+
dispatchDidReceiveResponse();
}
@@ -865,8 +873,6 @@
request.setURL(redirectedURL);
m_networkLoadMetrics.hasCrossOriginRedirect = m_networkLoadMetrics.hasCrossOriginRedirect || !SecurityOrigin::create(m_currentRequest.url())->canRequest(request.url());
- // FIXME: Add TAO checks here and when receiving a response.
- // This was done on Cocoa platforms in https://bugs.webkit.org/show_bug.cgi?id=226678
// Clear the user agent to ensure a new one is computed.
auto userAgent = request.httpUserAgent();
Modified: trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h (279031 => 279032)
--- trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h 2021-06-18 05:35:58 UTC (rev 279031)
+++ trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h 2021-06-18 08:05:25 UTC (rev 279032)
@@ -41,15 +41,15 @@
class NetworkDataTaskSoup final : public NetworkDataTask {
public:
- static Ref<NetworkDataTask> create(NetworkSession& session, NetworkDataTaskClient& client, const WebCore::ResourceRequest& request, WebCore::FrameIdentifier frameID, WebCore::PageIdentifier pageID, WebCore::StoredCredentialsPolicy storedCredentialsPolicy, WebCore::ContentSniffingPolicy shouldContentSniff, WebCore::ContentEncodingSniffingPolicy shouldContentEncodingSniff, bool shouldClearReferrerOnHTTPSToHTTPRedirect, PreconnectOnly shouldPreconnectOnly, bool dataTaskIsForMainFrameNavigation)
+ static Ref<NetworkDataTask> create(NetworkSession& session, NetworkDataTaskClient& client, const NetworkLoadParameters& parameters)
{
- return adoptRef(*new NetworkDataTaskSoup(session, client, request, frameID, pageID, storedCredentialsPolicy, shouldContentSniff, shouldContentEncodingSniff, shouldClearReferrerOnHTTPSToHTTPRedirect, shouldPreconnectOnly, dataTaskIsForMainFrameNavigation));
+ return adoptRef(*new NetworkDataTaskSoup(session, client, parameters));
}
~NetworkDataTaskSoup();
private:
- NetworkDataTaskSoup(NetworkSession&, NetworkDataTaskClient&, const WebCore::ResourceRequest&, WebCore::FrameIdentifier, WebCore::PageIdentifier, WebCore::StoredCredentialsPolicy, WebCore::ContentSniffingPolicy, WebCore::ContentEncodingSniffingPolicy, bool shouldClearReferrerOnHTTPSToHTTPRedirect, PreconnectOnly shouldPreconnectOnly, bool dataTaskIsForMainFrameNavigation);
+ NetworkDataTaskSoup(NetworkSession&, NetworkDataTaskClient&, const NetworkLoadParameters&);
void cancel() override;
void resume() override;
@@ -202,6 +202,7 @@
bool m_allowOverwriteDownload { false };
WebCore::NetworkLoadMetrics m_networkLoadMetrics;
bool m_isBlockingCookies { false };
+ RefPtr<WebCore::SecurityOrigin> m_sourceOrigin;
RunLoop::Timer<NetworkDataTaskSoup> m_timeoutSource;
};
