Bug 1313711 - Fix track element CORS bug. r=dveditz

MozReview-Commit-ID: SRWbiIuUdt

--HG--
extra : rebase_source : ecdedf2599205e547fbf6cafd12d154b2d7d26bc

dom/html/HTMLTrackElement.cpp

@@ -293,12 +293,37 @@ HTMLTrackElement::LoadResource()
     mChannel = nullptr;
   }
 
+  // According to https://www.w3.org/TR/html5/embedded-content-0.html#sourcing-out-of-band-text-tracks
+  //
+  // "8: If the track element's parent is a media element then let CORS mode
+  // be the state of the parent media element's crossorigin content attribute.
+  // Otherwise, let CORS mode be No CORS."
+  //
+  CORSMode corsMode = mMediaParent ? mMediaParent->GetCORSMode() : CORS_NONE;
+
+  // Determine the security flag based on corsMode.
+  nsSecurityFlags secFlags;
+  if (CORS_NONE == corsMode) {
+    // Same-origin is required for track element.
+    secFlags = nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS;
+  } else {
+    secFlags = nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS;
+    if (CORS_ANONYMOUS == corsMode) {
+      secFlags |= nsILoadInfo::SEC_COOKIES_SAME_ORIGIN;
+    } else if (CORS_USE_CREDENTIALS == corsMode) {
+      secFlags |= nsILoadInfo::SEC_COOKIES_INCLUDE;
+    } else {
+      NS_WARNING("Unknown CORS mode.");
+      secFlags = nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS;
+    }
+  }
+
   nsCOMPtr<nsIChannel> channel;
   nsCOMPtr<nsILoadGroup> loadGroup = OwnerDoc()->GetDocumentLoadGroup();
   rv = NS_NewChannel(getter_AddRefs(channel),
                      uri,
                      static_cast<Element*>(this),
-                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
+                     secFlags,
                      nsIContentPolicy::TYPE_INTERNAL_TRACK,
                      loadGroup,
                      nullptr,   // aCallbacks
@@ -313,7 +338,11 @@ HTMLTrackElement::LoadResource()
 
   LOG(LogLevel::Debug, ("opening webvtt channel"));
   rv = channel->AsyncOpen2(mListener);
-  NS_ENSURE_TRUE_VOID(NS_SUCCEEDED(rv));
+
+  if (NS_FAILED(rv)) {
+    SetReadyState(TextTrackReadyState::FailedToLoad);
+    return;
+  }
 
   mChannel = channel;
 }

toolkit/components/url-classifier/tests/mochitest/basic.vtt^headers^

@@ -0,0 +1 @@
+Access-Control-Allow-Origin: *

toolkit/components/url-classifier/tests/mochitest/mochitest.ini

@@ -20,6 +20,7 @@ support-files =
   workerFrame.html
   ping.sjs
   basic.vtt
+  basic.vtt^headers^
   dnt.html
   dnt.sjs
   update.sjs
@@ -28,6 +29,7 @@ support-files =
   gethash.sjs
   gethashFrame.html
   tracker.js
+  seek.webm
 
 [test_classifier.html]
 skip-if = (os == 'linux' && debug) #Bug 1199778

toolkit/components/url-classifier/tests/mochitest/test_classify_track.html

@@ -20,6 +20,9 @@
   const validtrack_url = "http://mochi.test:8888/" + track_path;
 
   var video = document.createElement("video");
+  video.src = "seek.webm";
+  video.crossOrigin = "anonymous";
+
   document.body.appendChild(video);
 
   function testValidTrack() {