tree aa8c2e4d2065a38b00e68a57075cb52f73cccd37
parent 85db3efdec5ca5eb5d671961c4826c59372af698
author youenn@apple.com <youenn@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1524852618 +0000
committer youenn@apple.com <youenn@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1524852618 +0000

Use NetworkLoadChecker for XHR/fetch loads
https://bugs.webkit.org/show_bug.cgi?id=184741

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

* web-platform-tests/XMLHttpRequest/send-authentication-basic-cors-expected.txt:
* web-platform-tests/XMLHttpRequest/send-network-error-async-events.sub-expected.txt:
* web-platform-tests/cors/late-upload-events-expected.txt:
* web-platform-tests/fetch/api/basic/mode-same-origin.any-expected.txt:
* web-platform-tests/fetch/api/basic/scheme-about.any-expected.txt:
* web-platform-tests/fetch/api/basic/scheme-about.any.worker-expected.txt:
* web-platform-tests/fetch/api/redirect/redirect-to-dataurl-expected.txt:
* web-platform-tests/service-workers/service-worker/redirected-response.https-expected.txt:

Source/WebCore:

Covered by existing tests.

* loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::shouldSetHTTPHeadersToKeep const):
We need to set this option for CORS done in NetworkProcess.
(WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
Set httpHeadersTokeep when needed (service worker or CORS loads).
Remove the synchronous disabling of preflight since this is now also done for asynchronous loads.
(WebCore::DocumentThreadableLoader::checkURLSchemeAsCORSEnabled):
Helper routine to make the same check for both simple and preflight case.
This allows more consistent error logging between WK1 and WK2.
(WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequest):
Skip preflight in case this is done in NetworkProcess.
(WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
(WebCore::isResponseComingFromNetworkProcess):
(WebCore::DocumentThreadableLoader::redirectReceived):
Bypass security checks when they are already done in NetworkProcess.
(WebCore::DocumentThreadableLoader::didFail):
In case of AccessControl error, it might be due to a CSP check done in NetworkProcess.
Check it again to enable specific CSP console logging and error reporting.
(WebCore::DocumentThreadableLoader::loadRequest):
Recreating the error in case of synchronous loads to be able to log it adequately.
(WebCore::DocumentThreadableLoader::isDoingSecurityChecksInNetworkProcess const):
* loader/DocumentThreadableLoader.h:
* loader/SubresourceLoader.cpp:
(WebCore::SubresourceLoader::checkResponseCrossOriginAccessControl):
Specific handling of SameOrigin credential mode for which cross-origin load will not use any credential.
(WebCore::SubresourceLoader::checkRedirectionCrossOriginAccessControl):
We keep the application headers so that DocumentThreadableLoader does not have to restart a brand new load.
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::requestResource):
DocumentThreadableLoader is setting referrer and origin directly. Until we fix that, we remove them from the original requests
as applications are not supposed to set these headers.

Source/WebKit:

* NetworkProcess/NetworkCORSPreflightChecker.cpp:
(WebKit::NetworkCORSPreflightChecker::didCompleteWithError):
Pass the preflight error as completion error if any.
* NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::willPerformHTTPRedirection):
Set response source to Network so that checks relying on that are correct.
* NetworkProcess/NetworkLoadChecker.cpp:
(WebKit::NetworkLoadChecker::validateResponse):
Adding Oppaqueredirect tainting.
(NetworkLoadChecker::doesNotNeedCORSCheck):
Adding a check to only activate CORS checks for CORS enabled schemes.
Non CORS enabled schemes loads should have failed in WebProcess already.
(WebKit::NetworkLoadChecker::checkCORSRedirectedRequest):
Remove Authorization header as done by SubresourceLoader.
(WebKit::NetworkLoadChecker::checkCORSRequestWithPreflight):
If error is cancellation, we still want to call the completion handler.
* NetworkProcess/NetworkResourceLoader.cpp:
Activate network load checker for all types of loads.
(WebKit::NetworkResourceLoader::willSendRedirectedRequest):
Handle manual redirection by directly calling didReceiveResponse.

LayoutTests:

* TestExpectations:
* http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/connect-src-eventsource-redirect-to-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-redirect-to-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin-expected.txt:
* http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt:
* http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
* platform/mac-wk1/http/tests/security/contentSecurityPolicy/connect-src-eventsource-redirect-to-blocked-expected.txt: Added.
* platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin-expected.txt: Added.
* platform/mac-wk1/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt: Added.
* platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/late-upload-events-expected.txt: Added.
* platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-basic-cors-expected.txt: Added.
* platform/mac-wk1/imported/w3c/web-platform-tests/XMLHttpRequest/send-network-error-async-events.sub-expected.txt: Added.
* platform/win/http/tests/security/contentSecurityPolicy/connect-src-eventsource-redirect-to-blocked-expected.txt: Added.
* platform/win/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-redirect-to-blocked-expected.txt: Added.
* platform/win/http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin-expected.txt: Added.
* platform/win/http/tests/xmlhttprequest/access-control-and-redirects-async-expected.txt: Added.
* platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/late-upload-events-expected.txt: Added.
* platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-basic-cors-expected.txt: Added.
* platform/win/imported/w3c/web-platform-tests/XMLHttpRequest/send-network-error-async-events.sub-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@231107 268f45cc-cd09-0410-ab3c-d52691b4dbfc