Skip to main content

Browse the archive

Revision 0c874a2e11885dc750902ae6c119f20affc6b49e authored by Matt Falkenhagen on 09 February 2018, 04:17:57 UTC, committed by Blink WPT Bot on 09 February 2018, 04:27:24 UTC 
service worker: Disallow opaque responses for WebVTT.
 
WebVTT loading code was determining if a response was cross-origin by looking
at request URL. But a service worker may have intercepted the request and
provided a response from cross-origin.

Bug: 808825
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: Ia121c0a8eae782de93d9777603426500a9709f8c
Reviewed-on: https://chromium-review.googlesource.com/907013
Reviewed-by: Tsuyoshi Horo <horo@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Commit-Queue: Matt Falkenhagen <falken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#535625}
1 parent e472f40
Raw File
redirect-preflight.htm 
<!DOCTYPE html>
<meta charset=utf-8>
<title>CORS - redirect with preflight</title>
<meta name=author title="Odin Hørthe Omdal" href="mailto:odiho@opera.com">
<meta name=author title="Fernando Jiménez Moreno" href="mailto:ferjmoreno@gmail.com">

<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script src=support.js?pipe=sub></script>

<h1>Redirect with preflight</h1>

<div id=log></div>
<script>

// Request count for cache busting and easy identifying of request in traffic
// analyzer.
var req_c = 0;

var CROSSDOMAIN_URL = CROSSDOMAIN + 'resources/cors-makeheader.py?';

/*
 * Redirection after successfull (200) preflight.
 */
function redir_after_successfull_preflight(code) {
  var desc = 'Should allow redirect ' + code + ' after succesful (200) preflight';
  async_test(desc).step(function() {
    var client = new XMLHttpRequest();
    var redirect = encodeURIComponent(
      CROSSDOMAIN + 'resources/cors-makeheader.py?headers=x-test&' + req_c++
    );

    client.open('GET', CROSSDOMAIN + 'resources/cors-makeheader.py?'
        + 'preflight=200&headers=x-test&location='
        + redirect + '&code=' + code + '&' + req_c++,
        true /* async */);
    client.setRequestHeader('x-test', 'test');
    client.onreadystatechange = this.step_func(function() {
      assert_equals(client.status, 200, 'Successfull redirect');
      this.done();
    });
    client.send(null);
  });
}
[301, 302, 303, 307, 308].forEach(redir_after_successfull_preflight);

</script>
back to top