diff options
| author | Allan Sandfeld Jensen <allan.jensen@theqtcompany.com> | 2015-04-17 17:16:23 +0200 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@theqtcompany.com> | 2015-04-28 19:29:19 +0000 |
| commit | 9cbcd93cfe0ba6f7531574f7784e8978bd723110 (patch) | |
| tree | 2f7c926e7f334669b7885ecd219a197bd181de0c /Source/WebCore/page/SecurityOrigin.cpp | |
| parent | 8ce4aba7d1742f07c01f2786e75ff7a5c8386aa6 (diff) | |
| download | qtwebkit-9cbcd93cfe0ba6f7531574f7784e8978bd723110.tar.gz | |
Enforce no remote access from local URLs for XHR
Add a specific setting to disable remote access for local URLs and also
enforce that on data-URLs loaded owned by local URLs.
Change-Id: Ied8ec141eb1c28775644fce184a4759a79e1d177
Task-number: QTBUG-45556
Reviewed-by: Dmitry Shachnev <mitya57@gmail.com>
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
Diffstat (limited to 'Source/WebCore/page/SecurityOrigin.cpp')
| -rw-r--r-- | Source/WebCore/page/SecurityOrigin.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp index cebc89684..ae2822aaa 100644 --- a/Source/WebCore/page/SecurityOrigin.cpp +++ b/Source/WebCore/page/SecurityOrigin.cpp @@ -127,6 +127,7 @@ SecurityOrigin::SecurityOrigin(const KURL& url) , m_storageBlockingPolicy(AllowAllStorage) , m_enforceFilePathSeparation(false) , m_needsDatabaseIdentifierQuirkForFiles(false) + , m_deniedCORS(false) { // document.domain starts as m_host, but can be set by the DOM. m_domain = m_host; @@ -153,6 +154,7 @@ SecurityOrigin::SecurityOrigin() , m_storageBlockingPolicy(AllowAllStorage) , m_enforceFilePathSeparation(false) , m_needsDatabaseIdentifierQuirkForFiles(false) + , m_deniedCORS(false) { } @@ -169,6 +171,7 @@ SecurityOrigin::SecurityOrigin(const SecurityOrigin* other) , m_storageBlockingPolicy(other->m_storageBlockingPolicy) , m_enforceFilePathSeparation(other->m_enforceFilePathSeparation) , m_needsDatabaseIdentifierQuirkForFiles(other->m_needsDatabaseIdentifierQuirkForFiles) + , m_deniedCORS(other->m_deniedCORS) { } @@ -442,6 +445,11 @@ void SecurityOrigin::grantUniversalAccess() m_universalAccess = true; } +void SecurityOrigin::denyCrossOriginRequests() +{ + m_deniedCORS = true; +} + #if ENABLE(CACHE_PARTITIONING) String SecurityOrigin::cachePartition() const { |