Commit df83dca4 authored by Yutaka Hirano's avatar Yutaka Hirano Committed by Commit Bot

Add "BypassSecurityChecks" suffix to content::CreateFileURLLoader

According to the comment "this does not restrict filesystem access
*in any way*", so make it look dangerous.

Bug: 1035575, 1036693,1026546
Change-Id: Iadd64b3b1be417b469b8d85144de21c86f67ceba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1981414Reviewed-by: default avatarMatt Falkenhagen <falken@chromium.org>
Reviewed-by: default avatarTakashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: default avatarKen Rockot <rockot@google.com>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#728817}
parent 23ce24ec
...@@ -4368,9 +4368,10 @@ class FileURLLoaderFactory : public network::mojom::URLLoaderFactory { ...@@ -4368,9 +4368,10 @@ class FileURLLoaderFactory : public network::mojom::URLLoaderFactory {
network::URLLoaderCompletionStatus(net::ERR_ACCESS_DENIED)); network::URLLoaderCompletionStatus(net::ERR_ACCESS_DENIED));
return; return;
} }
content::CreateFileURLLoader(request, std::move(loader), std::move(client), content::CreateFileURLLoaderBypassingSecurityChecks(
/*observer=*/nullptr, request, std::move(loader), std::move(client),
/* allow_directory_listing */ true); /*observer=*/nullptr,
/* allow_directory_listing */ true);
} }
void Clone( void Clone(
......
...@@ -891,7 +891,7 @@ void FileURLLoaderFactory::Clone( ...@@ -891,7 +891,7 @@ void FileURLLoaderFactory::Clone(
receivers_.Add(this, std::move(loader)); receivers_.Add(this, std::move(loader));
} }
void CreateFileURLLoader( void CreateFileURLLoaderBypassingSecurityChecks(
const network::ResourceRequest& request, const network::ResourceRequest& request,
mojo::PendingReceiver<network::mojom::URLLoader> loader, mojo::PendingReceiver<network::mojom::URLLoader> loader,
mojo::PendingRemote<network::mojom::URLLoaderClient> client, mojo::PendingRemote<network::mojom::URLLoaderClient> client,
......
...@@ -50,7 +50,7 @@ class CONTENT_EXPORT FileURLLoaderObserver ...@@ -50,7 +50,7 @@ class CONTENT_EXPORT FileURLLoaderObserver
// The URLLoader created by this function does *not* automatically follow // The URLLoader created by this function does *not* automatically follow
// filesytem links (e.g. Windows shortcuts) or support directory listing. // filesytem links (e.g. Windows shortcuts) or support directory listing.
// A directory path will always yield a FILE_NOT_FOUND network error. // A directory path will always yield a FILE_NOT_FOUND network error.
CONTENT_EXPORT void CreateFileURLLoader( CONTENT_EXPORT void CreateFileURLLoaderBypassingSecurityChecks(
const network::ResourceRequest& request, const network::ResourceRequest& request,
mojo::PendingReceiver<network::mojom::URLLoader> loader, mojo::PendingReceiver<network::mojom::URLLoader> loader,
mojo::PendingRemote<network::mojom::URLLoaderClient> client, mojo::PendingRemote<network::mojom::URLLoaderClient> client,
......
...@@ -604,7 +604,7 @@ class ExtensionURLLoaderFactory : public network::mojom::URLLoaderFactory { ...@@ -604,7 +604,7 @@ class ExtensionURLLoaderFactory : public network::mojom::URLLoaderFactory {
resource.relative_path()); resource.relative_path());
} }
content::CreateFileURLLoader( content::CreateFileURLLoaderBypassingSecurityChecks(
request, std::move(loader), std::move(client), request, std::move(loader), std::move(client),
std::make_unique<FileLoaderObserver>(std::move(verify_job)), std::make_unique<FileLoaderObserver>(std::move(verify_job)),
/* allow_directory_listing */ false, std::move(response_headers)); /* allow_directory_listing */ false, std::move(response_headers));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment