github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

chore: cherry-pick 27eb11a28555 from chromium (#32016)

Browse Source 
* chore: cherry-pick 27eb11a28555 from chromium

* chore: update patches

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Co-authored-by: Electron Bot <electron@github.com>
This commit is contained in:
Pedro Pontes
2022-01-13 01:36:14 +01:00
committed by GitHub
parent e4c86842c3
commit ec0b62ea65
2 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/chromium/.patches
View File

@@ -127,6 +127,7 @@ use_weakptrs_for_the_threadediconloader_s_background_tasks.patch
cherry-pick-a5f54612590d.patch
mas_gate_private_enterprise_APIs.patch
fix_aspect_ratio_with_max_size.patch
cherry-pick-27eb11a28555.patch
cherry-pick-f781748dcb3c.patch
sandbox_fix_sandbox_inheritance_m96_merge.patch
cherry-pick-dbde8795233a.patch

71
patches/chromium/cherry-pick-27eb11a28555.patch Normal file
View File

@@ -0,0 +1,71 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Yutaka Hirano <yhirano@chromium.org>
Date: Wed, 29 Sep 2021 07:58:26 +0000
Subject: Run CORS check for manual redirects
...to prevent status code leak.
Bug: 1251179
Change-Id: I7fcab0daf49e16305ed53702f42d1d1eacc933e5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3193481
Reviewed-by: Yoav Weiss <yoavweiss@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/main@{#926166}
diff --git a/services/network/cors/cors_url_loader.cc b/services/network/cors/cors_url_loader.cc
index 6e4e8acf811f29712e87994e3fa125a811da978a..72aac202ca076fe7ea81f833549773f540e9b7d7 100644
--- a/services/network/cors/cors_url_loader.cc
+++ b/services/network/cors/cors_url_loader.cc
@@ -303,13 +303,6 @@ void CorsURLLoader::OnReceiveRedirect(const net::RedirectInfo& redirect_info,
DCHECK(forwarding_client_);
DCHECK(!deferred_redirect_url_);
- if (request_.redirect_mode == mojom::RedirectMode::kManual) {
- deferred_redirect_url_ = std::make_unique<GURL>(redirect_info.new_url);
- forwarding_client_->OnReceiveRedirect(redirect_info,
- std::move(response_head));
- return;
- }
-
// If |CORS flag| is set and a CORS check for |request| and |response| returns
// failure, then return a network error.
if (fetch_cors_flag_ && IsCorsEnabledRequestMode(request_.mode)) {
@@ -327,6 +320,13 @@ void CorsURLLoader::OnReceiveRedirect(const net::RedirectInfo& redirect_info,
}
}
+ if (request_.redirect_mode == mojom::RedirectMode::kManual) {
+ deferred_redirect_url_ = std::make_unique<GURL>(redirect_info.new_url);
+ forwarding_client_->OnReceiveRedirect(redirect_info,
+ std::move(response_head));
+ return;
+ }
+
timing_allow_failed_flag_ = !PassesTimingAllowOriginCheck(*response_head);
// Because we initiate a new request on redirect in some cases, we cannot
diff --git a/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-mode.any.js b/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-mode.any.js
index eed44e0414cb8947c9b7c21df6ef288f733f8994..9f1ff98c65af97bcf185867ac6c6e128dbd77715 100644
--- a/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-mode.any.js
+++ b/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-mode.any.js
@@ -1,6 +1,7 @@
// META: script=/common/get-host-info.sub.js
var redirectLocation = "cors-top.txt";
+const { ORIGIN, REMOTE_ORIGIN } = get_host_info();
function testRedirect(origin, redirectStatus, redirectMode, corsMode) {
var url = new URL("../resources/redirect.py", self.location);
@@ -47,4 +48,12 @@ for (var origin of ["same-origin", "cross-origin"]) {
}
}
+promise_test(async (t) => {
+ const destination = `${ORIGIN}/common/blank.html`;
+ // We use /common/redirect.py intentionally, as we want a CORS error.
+ const url =
+ `${REMOTE_ORIGIN}/common/redirect.py?location=${destination}`;
+ await promise_rejects_js(t, TypeError, fetch(url, { redirect: "manual" }));
+}, "manual redirect with a CORS error should be rejected");
+
done();