bcarrella/cef
1
0
Fork 0
mirror of https://bitbucket.org/chromiumembedded/cef synced 2025-06-05 21:39:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix credentials mode for fetch request redirect (fixes #3675)

Browse Source 
Also verified that https://browseraudit.com/ gives the same results
both with and without `--disable-request-handling-for-testing`.
This commit is contained in:
Marshall Greenblatt
2024-05-06 15:09:13 -04:00
parent 311eaf827e
commit 271c6f6446
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libcef/browser/net_service/proxy_url_loader_factory.cc
View File

@@ -358,6 +358,7 @@ class InterceptedRequest : public network::mojom::URLLoader,
GURL redirect_url_; GURL redirect_url_;
GURL header_client_redirect_url_; GURL header_client_redirect_url_;
const net::MutableNetworkTrafficAnnotationTag traffic_annotation_; const net::MutableNetworkTrafficAnnotationTag traffic_annotation_;
std::optional<network::mojom::CredentialsMode> original_crendentials_mode_;
mojo::Receiver<network::mojom::URLLoader> proxied_loader_receiver_; mojo::Receiver<network::mojom::URLLoader> proxied_loader_receiver_;
mojo::Remote<network::mojom::URLLoaderClient> target_client_; mojo::Remote<network::mojom::URLLoaderClient> target_client_;
@@ -506,6 +507,7 @@ void InterceptedRequest::Restart() {
// Match logic in CorsURLLoader::StartNetworkRequest. // Match logic in CorsURLLoader::StartNetworkRequest.
const auto response_tainting = CalculateResponseTainting( const auto response_tainting = CalculateResponseTainting(
should_check_cors, request_.mode, tainted_origin); should_check_cors, request_.mode, tainted_origin);
original_crendentials_mode_ = request_.credentials_mode;
request_.credentials_mode = request_.credentials_mode =
network::cors::CalculateCredentialsFlag(request_.credentials_mode, network::cors::CalculateCredentialsFlag(request_.credentials_mode,
response_tainting) response_tainting)
@@ -874,6 +876,14 @@ void InterceptedRequest::ContinueAfterIntercept() {
target_loader_.BindNewPipeAndPassReceiver(), id_, options, request_, target_loader_.BindNewPipeAndPassReceiver(), id_, options, request_,
proxied_client_receiver_.BindNewPipeAndPassRemote(), proxied_client_receiver_.BindNewPipeAndPassRemote(),
traffic_annotation_); traffic_annotation_);
if (original_crendentials_mode_) {
// Restore the original |credentials_mode| value after calling
// CreateLoaderAndStart. This matches the logic in CorsURLLoader::
// StartNetworkRequest and allows InterceptedRequest::Restart to compute
// the correct |credentials_mode| during a fetch request redirect.
request_.credentials_mode = *original_crendentials_mode_;
original_crendentials_mode_.reset();
}
} }
} }