SVG loaded through html <img> can't request to load any external resources.

https://bugs.webkit.org/show_bug.cgi?id=137762.

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2014-10-22
Reviewed by Daniel Bates.

Source/WebCore:

SVG images have unique security rules that prevent them from loading any external
resources. This patch enforces these rules in CachedResourceLoader::canRequest for
all non-data-uri resources.

The fix and the tests are ported but modified a little from the chromium fix:
http://src.chromium.org/viewvc/blink?view=rev&rev=176084

Test: http/tests/security/svg-image-with-cached-remote-image.html
      http/tests/security/svg-image-with-css-cross-domain.html

For the SVG image, prevent loading any external sub-resource except for data urls.
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175074 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: Iec5014e81e25c37cc6754d7cc73645b17994974f
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 80e2f8de2..0735fc8ff 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -35,6 +35,8 @@
 #include "CachedResourceRequest.h"
 #include "CachedScript.h"
 #include "CachedXSLStyleSheet.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "Console.h"
 #include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
@@ -48,6 +50,7 @@
 #include "LoaderStrategy.h"
 #include "Logging.h"
 #include "MemoryCache.h"
+#include "Page.h"
 #include "PingLoader.h"
 #include "PlatformStrategies.h"
 #include "ResourceLoadScheduler.h"
@@ -409,6 +412,12 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
 #endif
     }
 
+    // SVG Images have unique security rules that prevent all subresource requests except for data urls.
+    if (type != CachedResource::MainResource && frame() && frame()->page()) {
+        if (frame()->page()->chrome().client()->isSVGImageChromeClient() && !url.protocolIsData())
+            return false;
+    }
+
     // Last of all, check for insecure content. We do this last so that when
     // folks block insecure content with a CSP policy, they don't get a warning.
     // They'll still get a warning in the console about CSP blocking the load.