Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,28 @@
+2016-01-14 Youenn Fablet <[email protected]>
+
+ Fix problems with cross-origin redirects
+ https://bugs.webkit.org/show_bug.cgi?id=116075
+
+ Reviewed by Daniel Bates.
+
+ Merging https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
+ This merge adds tests for cross origin requests triggered from same origin redirection responses with and without credentials).
+ Rebaseline of some tests due to console error messages generated from newly hit CORS checks.
+
+ * TestExpectations: Disabled WPT tests that require access to non localhost URLs which are currently blocked by DTR/WTR.
+ * http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
+ * http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin-expected.txt: Added.
+ * http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html: Added.
+ * http/tests/xmlhttprequest/access-control-and-redirects-async.html:
+ * http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
+ * http/tests/xmlhttprequest/access-control-and-redirects.html:
+ * http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt:
+ * http/tests/xmlhttprequest/redirect-cross-origin-expected.txt:
+ * http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt:
+ * http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt:
+ * http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi: Added.
+ * http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt:
+
2016-01-13 Daniel Bates <[email protected]>
[XSS Auditor] Do not include trailing comment characters in _javascript_ snippets
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,33 +1,24 @@
Tests that asynchronous XMLHttpRequests handle redirects according to the CORS standard.
-Testing resources/redirect-cors.php?url=""
+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" without credentials
Expecting success: false
PASS: 0
-Testing resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000& access-control-allow-credentials=true
-Expecting success: false
-PASS: 0
-Testing resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000& access-control-allow-credentials=true
-Expecting success: false
-PASS: 0
-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=""
-Expecting success: false
-PASS: 0
-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000
+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000 without credentials
Expecting success: true
FAIL: 0
-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000
+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000 without credentials
Expecting success: false
PASS: 0
-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000
+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url="" access-control-allow-origin=http://localhost:8000 without credentials
Expecting success: false
PASS: 0
-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true& url="" access-control-allow-origin=*
+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true& url="" access-control-allow-origin=* without credentials
Expecting success: false
PASS: 0
-Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false& url="" access-control-allow-origin=*& access-control-allow-headers=x-webkit
+Testing http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false& url="" access-control-allow-origin=*& access-control-allow-headers=x-webkit without credentials
Expecting success: false
PASS: 0
-Testing resources/redirect-cors.php?url=""
+Testing resources/redirect-cors.php?url="" without credentials
Expecting success: true
PASS: PASS
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin-expected.txt (0 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -0,0 +1,27 @@
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi. Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi. Credentials flag is true, but Access-Control-Allow-Credentials is not "true".
+Tests that asynchronous XMLHttpRequests handle redirects according to the CORS standard.
+
+Testing ../resources/redirect.php?url="" without credentials
+Expecting success: true
+PASS: PASS: Cross-domain access allowed.
+
+Testing ../resources/redirect.php?url="" with credentials
+Expecting success: false
+PASS: 0
+Testing ../resources/redirect.php?url="" without credentials
+Expecting success: true
+PASS: PASS: Cross-domain access allowed.
+
+Testing ../resources/redirect.php?url="" with credentials
+Expecting success: true
+PASS: PASS: Cross-domain access allowed.
+
+Testing ../resources/redirect.php?url="" without credentials
+Expecting success: true
+PASS: PASS: Cross-domain access allowed.
+
+Testing ../resources/redirect.php?url="" with credentials
+Expecting success: false
+PASS: 0
+
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html (0 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html 2016-01-19 08:59:16 UTC (rev 195265)
@@ -0,0 +1,88 @@
+<p>Tests that asynchronous XMLHttpRequests handle redirects according to the CORS standard.</p>
+
+<pre id="console"></pre>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+function log(message)
+{
+ document.getElementById('console').appendChild(document.createTextNode(message + '\n'));
+}
+
+function runTestAsync(url, credentials, addCustomHeader, expectSuccess) {
+ log("Testing " + url + (credentials ? " with " : " without ") + "credentials");
+ log("Expecting success: " + expectSuccess);
+
+ xhr = new XMLHttpRequest();
+ xhr.withCredentials = credentials;
+ xhr.open("GET", url, true);
+ if (addCustomHeader)
+ xhr.setRequestHeader("x-webkit", "foo");
+
+ xhr._onload_ = function() {
+ log((expectSuccess ? "PASS" : "FAIL") + ": " + xhr.responseText);
+ nextTest();
+ }
+ xhr._onerror_ = function() {
+ log((expectSuccess ? "FAIL" : "PASS") + ": " + xhr.status);
+ nextTest();
+ }
+ xhr.send(null);
+}
+
+var withoutCredentials = false;
+var withCredentials = true;
+var noCustomHeader = false;
+var addCustomHeader = true;
+var succeeds = true;
+var fails = false;
+
+var tests = [
+// Test simple same origin requests that receive cross origin redirects.
+
+// Request without credentials is redirected to a cross-origin response with Access-Control-Allow-Origin=*.
+// The redirect response passes the access check.
+["../resources/redirect.php?url=""
+ withoutCredentials, noCustomHeader, succeeds],
+
+// Request with credentials is redirected to a cross-origin response with Access-Control-Allow-Origin=*.
+// The redirect response fails the access check because credentials were sent.
+["../resources/redirect.php?url=""
+ withCredentials, noCustomHeader, fails],
+
+// Request without credentials is redirected to a cross-origin response with a specific Access-Control-Allow-Origin.
+// The redirect response passes the access check.
+["../resources/redirect.php?url=""
+ withoutCredentials, noCustomHeader, succeeds],
+
+// Request with credentials is redirected to a cross-origin response with a specific Access-Control-Allow-Origin.
+// The redirect response passes the access check.
+["../resources/redirect.php?url=""
+ withCredentials, noCustomHeader, succeeds],
+
+// Request without credentials is redirected to a cross-origin response with a specific Access-Control-Allow-Origin
+// forbidding credentials. The redirect response passes the access check.
+["../resources/redirect.php?url=""
+ withoutCredentials, noCustomHeader, succeeds],
+
+// Request with credentials is redirected to a cross-origin response with a specific Access-Control-Allow-Origin
+// forbidding credentials. The redirect response fails the access check.
+["../resources/redirect.php?url=""
+ withCredentials, noCustomHeader, fails],
+
+]
+
+var currentTest = 0;
+
+function nextTest() {
+ if (currentTest < tests.length)
+ runTestAsync.apply(null, tests[currentTest++]);
+ else if (window.testRunner)
+ testRunner.notifyDone();
+}
+
+nextTest();
+</script>
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-async.html 2016-01-19 08:59:16 UTC (rev 195265)
@@ -12,11 +12,12 @@
document.getElementById('console').appendChild(document.createTextNode(message + '\n'));
}
-function runTestAsync(url, addCustomHeader, expectSuccess) {
- log("Testing " + url);
+function runTestAsync(url, credentials, addCustomHeader, expectSuccess) {
+ log("Testing " + url + (credentials ? " with " : " without ") + "credentials");
log("Expecting success: " + expectSuccess);
xhr = new XMLHttpRequest();
+ xhr.withCredentials = credentials;
xhr.open("GET", url, true);
if (addCustomHeader)
xhr.setRequestHeader("x-webkit", "foo");
@@ -32,72 +33,57 @@
xhr.send(null);
}
+var withoutCredentials = false;
+var withCredentials = true;
var noCustomHeader = false;
var addCustomHeader = true;
var succeeds = true;
var fails = false;
var tests = [
-// 1) Test simple same origin requests that receive cross origin redirects.
+// 1) Test simple cross origin requests that receive redirects.
-// Request receives a cross-origin redirect response without CORS headers. The redirect response fails the access check.
-["resources/redirect-cors.php?url=""
- noCustomHeader, fails],
-
-// Request receives a cross-origin redirect response with CORS headers. The redirect response passes the access check,
-// but the resource response fails its access check because the security origin is a globally unique identifier after
-// the redirect and the same origin XHR has 'allowCredentials' true.
-["resources/redirect-cors.php?url=""
- access-control-allow-origin=http://localhost:8000&\
- access-control-allow-credentials=true",
- noCustomHeader, fails],
-
-// Same as above, but to a less permissive resource that only allows the requesting origin.
-["resources/redirect-cors.php?url=""
- access-control-allow-origin=http://localhost:8000&\
- access-control-allow-credentials=true",
- noCustomHeader, fails],
-
-// 2) Test simple cross origin requests that receive redirects.
-
// Receives a redirect response without CORS headers. The redirect response fails the access check.
["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=""
- noCustomHeader, fails],
+ withoutCredentials, noCustomHeader, fails],
// Receives a redirect response with CORS headers. The redirect response passes the access check and the resource response
// passes the access check.
+// FIXME: this test fails because the redirect is vetoed. There are continued bugs with redirects when the original
+// request was cross-origin.
["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=""
access-control-allow-origin=http://localhost:8000",
- noCustomHeader, succeeds],
+ withoutCredentials, noCustomHeader, succeeds],
// Receives a redirect response with a URL containing the userinfo production.
["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=""
access-control-allow-origin=http://localhost:8000",
- noCustomHeader, fails],
+ withoutCredentials, noCustomHeader, fails],
// Receives a redirect response with a URL with an unsupported scheme.
["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?url=""
access-control-allow-origin=http://localhost:8000",
- noCustomHeader, fails],
+ withoutCredentials, noCustomHeader, fails],
-// 3) Test preflighted cross origin requests that receive redirects.
+// 2) Test preflighted cross origin requests that receive redirects.
// Receives a redirect response to the preflight request and fails.
["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=true&\
url=""
access-control-allow-origin=*",
- addCustomHeader, fails],
+ withoutCredentials, addCustomHeader, fails],
// Successful preflight and receives a redirect response to the actual request and fails.
["http://localhost:8000/xmlhttprequest/resources/redirect-cors.php?redirect-preflight=false&\
url=""
access-control-allow-origin=*&\
access-control-allow-headers=x-webkit",
- addCustomHeader, fails],
+ withoutCredentials, addCustomHeader, fails],
-// 4) Test same origin requests with a custom header that receive a same origin redirect.
+// 3) Test same origin requests with a custom header that receive a same origin redirect.
["resources/redirect-cors.php?url=""
- addCustomHeader, succeeds],
+ withoutCredentials, addCustomHeader, succeeds],
+
]
var currentTest = 0;
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -6,8 +6,9 @@
Expecting success: false
PASS: Error: NETWORK_ERR: XMLHttpRequest Exception 101
Testing /resources/redirect.php?url=""
-Expecting success: false
-PASS: 0
+Expecting success: true
+PASS: PASS: Cross-domain access allowed.
+
Testing http://localhost:8000/resources/redirect.php?url="" (sync)
Expecting success: false
PASS: Error: NETWORK_ERR: XMLHttpRequest Exception 101
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects.html (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects.html 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-and-redirects.html 2016-01-19 08:59:16 UTC (rev 195265)
@@ -45,7 +45,7 @@
}
var tests = [
- ["/resources/redirect.php?url="" false, false],
+ ["/resources/redirect.php?url="" false, true],
["http://localhost:8000/resources/redirect.php?url="" false, false],
["http://localhost:8000/resources/redirect.php?url="" false, false]
]
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,4 @@
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
PASS
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,4 @@
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
PASS
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,4 @@
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/reply.xml. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
Test that a cross-origin redirect to a server that responds is indistinguishable from one that does not. Should say PASS:
PASS
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cross-origin-tripmine-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,13 @@
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/redirect-cross-origin-tripmine.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
Test that a cross-origin redirect does not result in a non-simple request being sent to the target.
Asynchronous XMLHttpRequest 307 POST redirect:
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi (0 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi 2016-01-19 08:59:16 UTC (rev 195265)
@@ -0,0 +1,7 @@
+#!/usr/bin/perl -wT
+use strict;
+
+print "Content-Type: text/plain\n";
+print "Access-Control-Allow-Origin: http://127.0.0.1:8000\n\n";
+
+print "PASS: Cross-domain access allowed.\n";
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-basic-allow-no-credentials.cgi
___________________________________________________________________
Added: svn:executable
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,4 @@
+CONSOLE MESSAGE: XMLHttpRequest cannot load http://localhost:8080/xmlhttprequest/resources/forbidden.txt. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
This tests that unsafe redirects won't be allowed when making an XMLHttpRequest.
Sync XHR started.
readyState change 1
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,17 @@
+2016-01-14 Youenn Fablet <[email protected]>
+
+ Fix problems with cross-origin redirects
+ https://bugs.webkit.org/show_bug.cgi?id=116075
+
+ Reviewed by Daniel Bates.
+
+ Rebasing test expectations.
+ These tests cannot work as expected as WTR/DRT block access to www2.localhost and example.not.
+
+ * web-platform-tests/XMLHttpRequest/send-redirect-bogus-expected.txt:
+ * web-platform-tests/XMLHttpRequest/send-redirect-to-cors-expected.txt:
+ * web-platform-tests/XMLHttpRequest/send-redirect-to-non-cors-expected.txt:
+
2015-12-09 Keith Rollin <[email protected]>
form.elements should reflect the element ordering after the HTML tree builder algorithm
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1,3 +1,49 @@
+2016-01-14 Youenn Fablet <[email protected]>
+
+ Fix problems with cross-origin redirects
+ https://bugs.webkit.org/show_bug.cgi?id=116075
+
+ Reviewed by Daniel Bates.
+
+ Merging https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
+ Same origin redirect responses leading to cross-origin requests were checked as cross-origin redirect responses.
+ Introduced ClientRequestedCredentials to manage whether credentials are needed or not in the cross-origin request.
+
+ In addition to Blink patch, it was needed to update some loaders with the newly introduced ClientRequestedCredentials parameter.
+ Added the clearing of "Accept-Encoding" header from cross-origin requests as Mac HTTP network layer is adding it for same-origin requests.
+
+ Test: http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html
+
+ * loader/DocumentLoader.cpp:
+ (WebCore::DocumentLoader::startLoadingMainResource): Added new security parameter (from Blink patch).
+ * loader/DocumentThreadableLoader.cpp:
+ (WebCore::DocumentThreadableLoader::redirectReceived): Updated checks so that same origin redirections are not treated as cross origin redirections (from Blink patch).
+ * loader/MediaResourceLoader.cpp:
+ (WebCore::MediaResourceLoader::start):
+ * loader/NetscapePlugInStreamLoader.cpp:
+ (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Added new security parameter.
+ * loader/ResourceLoaderOptions.h:
+ (WebCore::ResourceLoaderOptions::ResourceLoaderOptions): Added new security parameter (from Blink patch).
+ (WebCore::ResourceLoaderOptions::credentialRequest):
+ (WebCore::ResourceLoaderOptions::setCredentialRequest):
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Ditto.
+ (WebCore::CachedResourceLoader::defaultCachedResourceOptions): Ditto.
+ * loader/icon/IconLoader.cpp:
+ (WebCore::IconLoader::startLoading): Added new security parameter.
+ * page/EventSource.cpp:
+ (WebCore::EventSource::connect): Added new security parameter (from Blink patch).
+ * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
+ (WebCore::WebCoreAVCFResourceLoader::startLoading): Added new security parameter.
+ * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
+ (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
+ * platform/network/ResourceHandleTypes.h: Added new security parameter constants (from Blink patch).
+ * platform/network/ResourceRequestBase.cpp:
+ (WebCore::ResourceRequestBase::clearHTTPAcceptEncoding): Function to remove "Accept-Encoding" header.
+ * platform/network/ResourceRequestBase.h: Ditto.
+ * xml/XMLHttpRequest.cpp:
+ (WebCore::XMLHttpRequest::createRequest): Added new security parameter.
+
2016-01-13 Daniel Bates <[email protected]>
Cleanup: XSS Auditor should avoid re-evaluating the parsed script tag
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentLoader.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentLoader.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentLoader.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -1456,7 +1456,7 @@
// If this is a reload the cache layer might have made the previous request conditional. DocumentLoader can't handle 304 responses itself.
request.makeUnconditional();
- static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck);
+ static NeverDestroyed<ResourceLoaderOptions> mainResourceLoadOptions(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, IncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck);
CachedResourceRequest cachedResourceRequest(request, mainResourceLoadOptions);
cachedResourceRequest.setInitiator(*this);
m_mainResource = m_cachedResourceLoader->requestMainResource(cachedResourceRequest);
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentThreadableLoader.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentThreadableLoader.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentThreadableLoader.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -182,7 +182,8 @@
return;
// When using access control, only simple cross origin requests are allowed to redirect. The new request URL must have a supported
- // scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check.
+ // scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check if the
+ // original request was not same-origin.
if (m_options.crossOriginRequestPolicy == UseAccessControl) {
bool allowRedirect = false;
if (m_simpleRequest) {
@@ -190,7 +191,7 @@
allowRedirect = SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())
&& request.url().user().isEmpty()
&& request.url().pass().isEmpty()
- && passesAccessControlCheck(redirectResponse, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription);
+ && (m_sameOriginRequest || passesAccessControlCheck(redirectResponse, m_options.allowCredentials(), securityOrigin(), accessControlErrorDescription));
}
if (allowRedirect) {
@@ -199,18 +200,26 @@
RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::createFromString(redirectResponse.url());
RefPtr<SecurityOrigin> requestOrigin = SecurityOrigin::createFromString(request.url());
- // If the request URL origin is not same origin with the original URL origin, set source origin to a globally unique identifier.
- if (!originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
+ // If the original request wasn't same-origin, then if the request URL origin is not same origin with the original URL origin,
+ // set the source origin to a globally unique identifier. (If the original request was same-origin, the origin of the new request
+ // should be the original URL origin.)
+ if (!m_sameOriginRequest && !originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
m_options.securityOrigin = SecurityOrigin::createUnique();
- // Force any subsequent requests to use these checks.
+ // Force any subsequent request to use these checks.
m_sameOriginRequest = false;
+ // Since the request is no longer same-origin, if the user didn't request credentials in
+ // the first place, update our state so we neither request them nor expect they must be allowed.
+ if (m_options.credentialRequest() == ClientDidNotRequestCredentials)
+ m_options.setAllowCredentials(DoNotAllowStoredCredentials);
+
// Remove any headers that may have been added by the network layer that cause access control to fail.
request.clearHTTPContentType();
request.clearHTTPReferrer();
request.clearHTTPOrigin();
request.clearHTTPUserAgent();
request.clearHTTPAccept();
+ request.clearHTTPAcceptEncoding();
makeCrossOriginAccessRequest(request);
return;
}
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/MediaResourceLoader.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/MediaResourceLoader.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/MediaResourceLoader.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -61,7 +61,7 @@
StoredCredentials allowCredentials = m_crossOriginMode.isNull() || equalIgnoringCase(m_crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials;
// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
- CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, allowCredentials, DoNotAskClientForCrossOriginCredentials, DoSecurityCheck, corsPolicy, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck));
+ CachedResourceRequest cacheRequest(request, ResourceLoaderOptions(SendCallbacks, DoNotSniffContent, bufferingPolicy, allowCredentials, DoNotAskClientForCrossOriginCredentials, ClientDidNotRequestCredentials, DoSecurityCheck, corsPolicy, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck));
if (!m_crossOriginMode.isNull())
updateRequestForAccessControl(cacheRequest.mutableResourceRequest(), m_document.securityOrigin(), allowCredentials);
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -43,7 +43,7 @@
// FIXME: Skip Content Security Policy check when associated plugin element is in a user agent shadow tree.
// See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
NetscapePlugInStreamLoader::NetscapePlugInStreamLoader(Frame* frame, NetscapePlugInStreamLoaderClient* client)
- : ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck))
+ : ResourceLoader(frame, ResourceLoaderOptions(SendCallbacks, SniffContent, DoNotBufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck))
, m_client(client)
{
#if ENABLE(CONTENT_EXTENSIONS)
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/ResourceLoaderOptions.h (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/ResourceLoaderOptions.h 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/ResourceLoaderOptions.h 2016-01-19 08:59:16 UTC (rev 195265)
@@ -78,18 +78,20 @@
, m_dataBufferingPolicy(BufferData)
, m_allowCredentials(DoNotAllowStoredCredentials)
, m_clientCredentialPolicy(DoNotAskClientForAnyCredentials)
+ , m_credentialRequest(ClientDidNotRequestCredentials)
, m_securityCheck(DoSecurityCheck)
, m_requestOriginPolicy(UseDefaultOriginRestrictionsForType)
, m_certificateInfoPolicy(DoNotIncludeCertificateInfo)
{
}
- ResourceLoaderOptions(SendCallbackPolicy sendLoadCallbacks, ContentSniffingPolicy sniffContent, DataBufferingPolicy dataBufferingPolicy, StoredCredentials allowCredentials, ClientCredentialPolicy credentialPolicy, SecurityCheckPolicy securityCheck, RequestOriginPolicy requestOriginPolicy, CertificateInfoPolicy certificateInfoPolicy, ContentSecurityPolicyImposition contentSecurityPolicyImposition)
+ ResourceLoaderOptions(SendCallbackPolicy sendLoadCallbacks, ContentSniffingPolicy sniffContent, DataBufferingPolicy dataBufferingPolicy, StoredCredentials allowCredentials, ClientCredentialPolicy credentialPolicy, CredentialRequest credentialRequest, SecurityCheckPolicy securityCheck, RequestOriginPolicy requestOriginPolicy, CertificateInfoPolicy certificateInfoPolicy, ContentSecurityPolicyImposition contentSecurityPolicyImposition)
: m_sendLoadCallbacks(sendLoadCallbacks)
, m_sniffContent(sniffContent)
, m_dataBufferingPolicy(dataBufferingPolicy)
, m_allowCredentials(allowCredentials)
, m_clientCredentialPolicy(credentialPolicy)
+ , m_credentialRequest(credentialRequest)
, m_securityCheck(securityCheck)
, m_requestOriginPolicy(requestOriginPolicy)
, m_certificateInfoPolicy(certificateInfoPolicy)
@@ -107,6 +109,8 @@
void setAllowCredentials(StoredCredentials allow) { m_allowCredentials = allow; }
ClientCredentialPolicy clientCredentialPolicy() const { return static_cast<ClientCredentialPolicy>(m_clientCredentialPolicy); }
void setClientCredentialPolicy(ClientCredentialPolicy policy) { m_clientCredentialPolicy = policy; }
+ CredentialRequest credentialRequest() { return static_cast<CredentialRequest>(m_credentialRequest); }
+ void setCredentialRequest(CredentialRequest credentialRequest) { m_credentialRequest = credentialRequest; }
SecurityCheckPolicy securityCheck() const { return static_cast<SecurityCheckPolicy>(m_securityCheck); }
void setSecurityCheck(SecurityCheckPolicy check) { m_securityCheck = check; }
RequestOriginPolicy requestOriginPolicy() const { return static_cast<RequestOriginPolicy>(m_requestOriginPolicy); }
@@ -121,6 +125,7 @@
unsigned m_dataBufferingPolicy : 1;
unsigned m_allowCredentials : 1; // Whether HTTP credentials and cookies are sent with the request.
unsigned m_clientCredentialPolicy : 2; // When we should ask the client for credentials (if we allow credentials at all).
+ unsigned m_credentialRequest: 1; // Whether the client (e.g. XHR) wanted credentials in the first place.
unsigned m_securityCheck : 1;
unsigned m_requestOriginPolicy : 2;
unsigned m_certificateInfoPolicy : 1; // Whether the response should include certificate info.
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/cache/CachedResourceLoader.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -233,7 +233,7 @@
memoryCache.add(*userSheet);
// FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?
- userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck));
+ userSheet->load(*this, ResourceLoaderOptions(DoNotSendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, SkipSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::SkipPolicyCheck));
return userSheet;
}
@@ -1138,7 +1138,7 @@
const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
{
- static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck);
+ static ResourceLoaderOptions options(SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, AskClientForAllCredentials, ClientRequestedCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck);
return options;
}
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/icon/IconLoader.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/icon/IconLoader.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/icon/IconLoader.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -59,7 +59,7 @@
return;
// ContentSecurityPolicyImposition::DoPolicyCheck is a placeholder value. It does not affect the request since Content Security Policy does not apply to raw resources.
- CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck));
+ CachedResourceRequest request(ResourceRequest(m_frame.loader().icon().url()), ResourceLoaderOptions(SendCallbacks, SniffContent, BufferData, DoNotAllowStoredCredentials, DoNotAskClientForAnyCredentials, ClientDidNotRequestCredentials, DoSecurityCheck, UseDefaultOriginRestrictionsForType, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck));
request.mutableResourceRequest().setPriority(ResourceLoadPriority::Low);
request.setInitiator(cachedResourceRequestInitiators().icon);
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/page/EventSource.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/page/EventSource.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/page/EventSource.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -126,6 +126,7 @@
options.setSendLoadCallbacks(SendCallbacks);
options.setSniffContent(DoNotSniffContent);
options.setAllowCredentials((origin->canRequest(m_url) || m_withCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials);
+ options.setCredentialRequest(m_withCredentials ? ClientRequestedCredentials : ClientDidNotRequestCredentials);
options.preflightPolicy = PreventPreflight;
options.crossOriginRequestPolicy = UseAccessControl;
options.setDataBufferingPolicy(DoNotBufferData);
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceHandleTypes.h (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceHandleTypes.h 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceHandleTypes.h 2016-01-19 08:59:16 UTC (rev 195265)
@@ -39,6 +39,15 @@
DoNotAskClientForAnyCredentials
};
+// APIs like XMLHttpRequest and EventSource let the user decide
+// whether to send credentials, but they're always sent for
+// same-origin requests. Additional information is needed to handle
+// cross-origin redirects correctly.
+enum CredentialRequest {
+ ClientRequestedCredentials,
+ ClientDidNotRequestCredentials
+};
+
} // namespace WebCore
#endif // ResourceHandleTypes_h
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceRequestBase.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceRequestBase.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceRequestBase.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -378,6 +378,16 @@
m_platformRequestUpdated = false;
}
+void ResourceRequestBase::clearHTTPAcceptEncoding()
+{
+ updateResourceRequest();
+
+ m_httpHeaderFields.remove(HTTPHeaderName::AcceptEncoding);
+
+ if (url().protocolIsInHTTPFamily())
+ m_platformRequestUpdated = false;
+}
+
void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2, const String& encoding3)
{
updateResourceRequest();
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceRequestBase.h (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceRequestBase.h 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/ResourceRequestBase.h 2016-01-19 08:59:16 UTC (rev 195265)
@@ -115,6 +115,8 @@
void setHTTPAccept(const String&);
void clearHTTPAccept();
+ void clearHTTPAcceptEncoding();
+
const Vector<String>& responseContentDispositionEncodingFallbackArray() const { return m_responseContentDispositionEncodingFallbackArray; }
WEBCORE_EXPORT void setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2 = String(), const String& encoding3 = String());
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/xml/XMLHttpRequest.cpp (195264 => 195265)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/xml/XMLHttpRequest.cpp 2016-01-19 08:58:49 UTC (rev 195264)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/xml/XMLHttpRequest.cpp 2016-01-19 08:59:16 UTC (rev 195265)
@@ -764,6 +764,7 @@
options.setSniffContent(DoNotSniffContent);
options.preflightPolicy = uploadEvents ? ForcePreflight : ConsiderPreflight;
options.setAllowCredentials((m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials);
+ options.setCredentialRequest(m_includeCredentials ? ClientRequestedCredentials : ClientDidNotRequestCredentials);
options.crossOriginRequestPolicy = UseAccessControl;
options.securityOrigin = securityOrigin();
options.initiator = cachedResourceRequestInitiators().xmlhttprequest;
