Cross-protocol, cross-site scripting (XPSS) using HTML forms
authorbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 Jan 2016 01:29:17 +0000 (01:29 +0000)
committerbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 Jan 2016 01:29:17 +0000 (01:29 +0000)
commit1e5803736bc70772ca9d888ea11d3ebb73e70328
tree3ad7a46b63027778e3bdb844aab3eb66254299d8
parentd192e216fd7e99462a36c30b7df2d169525e30c5
Cross-protocol, cross-site scripting (XPSS) using HTML forms
https://bugs.webkit.org/show_bug.cgi?id=153017
<rdar://problem/5873254>

Reviewed by David Kilzer.

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::responseReceived): If response HTTP version is 0.9,
sandbox against script execution and plugins.
* loader/ResourceLoader.cpp:
(WebCore::ResourceLoader::didReceiveResponse): Ditto.
* loader/SubresourceLoader.cpp:
(WebCore::SubresourceLoader::didReceiveResponse): Ditto.
* platform/network/ResourceResponseBase.cpp:
(WebCore::ResourceResponseBase::adopt): Update for HTTP version.
(WebCore::ResourceResponseBase::copyData): Ditto.
(WebCore::ResourceResponseBase::httpVersion): Added.
(WebCore::ResourceResponseBase::setHTTPVersion): Ditto.
* platform/network/ResourceResponseBase.h:
(WebCore::ResourceResponseBase::encode): Update for HTTP version.
(WebCore::ResourceResponseBase::decode): Ditto.
* platform/network/cf/ResourceResponseCFNet.cpp:
(WebCore::ResourceResponse::platformLazyInit): Capture HTTP version.
* platform/network/cocoa/ResourceResponseCocoa.mm:
(WebCore::ResourceResponse::platformLazyInit): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@195004 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/loader/DocumentLoader.cpp
Source/WebCore/loader/ResourceLoader.cpp
Source/WebCore/loader/SubresourceLoader.cpp
Source/WebCore/platform/network/ResourceResponseBase.cpp
Source/WebCore/platform/network/ResourceResponseBase.h
Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
Source/WebCore/platform/network/cocoa/ResourceResponseCocoa.mm