Title: [285823] trunk
- Revision
- 285823
- Author
- [email protected]
- Date
- 2021-11-15 12:21:10 -0800 (Mon, 15 Nov 2021)
Log Message
`Cross-Origin-Embedder-Policy: require-corp` prevents loading of data URL images
https://bugs.webkit.org/show_bug.cgi?id=233131
<rdar://85236459>
Reviewed by Geoffrey Garen.
Source/WebCore:
When doing an initial data URL <img> load, we properly wouldn't perform a cross-origin resource policy check.
This is per the Fetch specification that says to use a scheme fetch [1] when the request URL is a data URL.
When the protocol is data, the scheme fetch algorithm would return a response without performing an HTTP
Fetch. The HTTP check [2] is the algorithm that actually performs a cross-origin resource policy check, at
step 7.
The issue with our implementation was that data URL <img> loads would perform a cross-origin resource policy
check in the case where the image is loaded from our memory cache, due to a check we had in
CachedResourceLoader::requestResource(). As a result, data URL <img> loads would fail when served from the
memory cache, when CORP is enforced. To address the issue and match the specification, we now disable this
CORP check when the request URL is a data URL.
[1] https://fetch.spec.whatwg.org/#scheme-fetch
[2] https://fetch.spec.whatwg.org/#concept-http-fetch
Test: http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::requestResource):
LayoutTests:
Add layout test coverage. This test is based on a reduce test case from Cameron McCormack.
* http/wpt/html/cross-origin-embedder-policy/require-corp-data-url-expected.txt: Added.
* http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html: Added.
* http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html.headers: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (285822 => 285823)
--- trunk/LayoutTests/ChangeLog 2021-11-15 20:18:04 UTC (rev 285822)
+++ trunk/LayoutTests/ChangeLog 2021-11-15 20:21:10 UTC (rev 285823)
@@ -1,3 +1,17 @@
+2021-11-15 Chris Dumez <[email protected]>
+
+ `Cross-Origin-Embedder-Policy: require-corp` prevents loading of data URL images
+ https://bugs.webkit.org/show_bug.cgi?id=233131
+ <rdar://85236459>
+
+ Reviewed by Geoffrey Garen.
+
+ Add layout test coverage. This test is based on a reduce test case from Cameron McCormack.
+
+ * http/wpt/html/cross-origin-embedder-policy/require-corp-data-url-expected.txt: Added.
+ * http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html: Added.
+ * http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html.headers: Added.
+
2021-11-15 Kiet Ho <[email protected]>
Implement parsing and animation support for offset-rotate
Added: trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url-expected.txt (0 => 285823)
--- trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url-expected.txt (rev 0)
+++ trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url-expected.txt 2021-11-15 20:21:10 UTC (rev 285823)
@@ -0,0 +1,3 @@
+
+PASS Tests that loading of data URL images works when COEP: require-corp is used
+
Added: trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html (0 => 285823)
--- trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html (rev 0)
+++ trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html 2021-11-15 20:21:10 UTC (rev 285823)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script src=""
+</head>
+<body>
+<img src=""
+<script>
+async_test((t) => {
+ _onload_ = t.step_func(function() {
+ let img = document.querySelector("img");
+ let clone = img.cloneNode();
+ clone._onload_ = t.step_func_done(() => {
+ });
+ clone._onerror_ = t.unreached_func();
+ document.body.append(clone);
+ t.add_cleanup(() => {
+ img.remove();
+ clone.remove();
+ });
+ });
+}, "Tests that loading of data URL images works when COEP: require-corp is used");
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html.headers (0 => 285823)
--- trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html.headers (rev 0)
+++ trunk/LayoutTests/http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html.headers 2021-11-15 20:21:10 UTC (rev 285823)
@@ -0,0 +1 @@
+Cross-Origin-Embedder-Policy: require-corp
Modified: trunk/Source/WebCore/ChangeLog (285822 => 285823)
--- trunk/Source/WebCore/ChangeLog 2021-11-15 20:18:04 UTC (rev 285822)
+++ trunk/Source/WebCore/ChangeLog 2021-11-15 20:21:10 UTC (rev 285823)
@@ -1,3 +1,31 @@
+2021-11-15 Chris Dumez <[email protected]>
+
+ `Cross-Origin-Embedder-Policy: require-corp` prevents loading of data URL images
+ https://bugs.webkit.org/show_bug.cgi?id=233131
+ <rdar://85236459>
+
+ Reviewed by Geoffrey Garen.
+
+ When doing an initial data URL <img> load, we properly wouldn't perform a cross-origin resource policy check.
+ This is per the Fetch specification that says to use a scheme fetch [1] when the request URL is a data URL.
+ When the protocol is data, the scheme fetch algorithm would return a response without performing an HTTP
+ Fetch. The HTTP check [2] is the algorithm that actually performs a cross-origin resource policy check, at
+ step 7.
+
+ The issue with our implementation was that data URL <img> loads would perform a cross-origin resource policy
+ check in the case where the image is loaded from our memory cache, due to a check we had in
+ CachedResourceLoader::requestResource(). As a result, data URL <img> loads would fail when served from the
+ memory cache, when CORP is enforced. To address the issue and match the specification, we now disable this
+ CORP check when the request URL is a data URL.
+
+ [1] https://fetch.spec.whatwg.org/#scheme-fetch
+ [2] https://fetch.spec.whatwg.org/#concept-http-fetch
+
+ Test: http/wpt/html/cross-origin-embedder-policy/require-corp-data-url.html
+
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::requestResource):
+
2021-11-15 Kiet Ho <[email protected]>
Implement parsing and animation support for offset-rotate
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (285822 => 285823)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2021-11-15 20:18:04 UTC (rev 285822)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2021-11-15 20:21:10 UTC (rev 285823)
@@ -1014,11 +1014,15 @@
return makeUnexpected(WTFMove(*error));
}
}
- if (request.options().mode == FetchOptions::Mode::NoCors) {
+ // Per the Fetch specification, the "cross-origin resource policy check" should only occur in the HTTP Fetch case (https://fetch.spec.whatwg.org/#concept-http-fetch).
+ // However, per https://fetch.spec.whatwg.org/#main-fetch, if the request URL's protocol is "data:", then we should perform a scheme fetch which would end up
+ // returning a response WITHOUT performing an HTTP fetch (and thus no CORP check).
+ if (request.options().mode == FetchOptions::Mode::NoCors && !url.protocolIsData()) {
auto coep = document() ? document()->crossOriginEmbedderPolicy().value : CrossOriginEmbedderPolicyValue::UnsafeNone;
if (auto error = validateCrossOriginResourcePolicy(coep, *request.origin(), request.resourceRequest().url(), resource->response(), ForNavigation::No))
return makeUnexpected(WTFMove(*error));
-
+ }
+ if (request.options().mode == FetchOptions::Mode::NoCors) {
if (auto error = validateRangeRequestedFlag(request.resourceRequest(), resource->response()))
return makeUnexpected(WTFMove(*error));
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
