[M150] Reject redirects from blob: URL navigations [chromium/src : refs/branch-heads/7871]
0 views
Skip to first unread message
chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com (Gerrit)
Jul 8, 2026, 5:20:39 PM (11 hours ago) Jul 8
to Minoru Chikamune, android-bu...@system.gserviceaccount.com, storage...@chromium.org, loading...@chromium.org
chrome-che...@chops-service-accounts.iam.gserviceaccount.com voted Auto-Submit+1![]( "Open in Gerrit")
| Auto-Submit | +1 |
Related details
Attention set is empty
Submit Requirements:
Code-Owners
Code-Review
Lint
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
rubber-stamper@appspot.gserviceaccount.com (Gerrit)
Jul 8, 2026, 5:21:31 PM (11 hours ago) Jul 8
to Minoru Chikamune, chrome-che...@chops-service-accounts.iam.gserviceaccount.com, android-bu...@system.gserviceaccount.com, storage...@chromium.org, loading...@chromium.org
rubber-...@appspot.gserviceaccount.com voted![]( "Open in Gerrit")
| Bot-Commit | +1 |
| Commit-Queue | +2 |
Related details
Attention set is empty
Submit Requirements:
Code-Owners
Code-Review
Lint
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Chromium LUCI CQ (Gerrit)
Jul 8, 2026, 8:16:29 PM (8 hours ago) Jul 8
to Minoru Chikamune, chrome-che...@chops-service-accounts.iam.gserviceaccount.com, rubber-...@appspot.gserviceaccount.com, android-bu...@system.gserviceaccount.com, storage...@chromium.org, loading...@chromium.org
Chromium LUCI CQ submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[M150] Reject redirects from blob: URL navigations
Original change's description:
> Reject redirects from blob: URL navigations
>
> NavigationURLLoaderImpl already assumes that requests to the blob:
> scheme are never redirected and skips interceptor setup on that basis.
> Make that assumption explicit in OnReceiveRedirect: if a redirect
> arrives while loading a blob: URL, fail the navigation with
> ERR_UNSAFE_REDIRECT instead of consulting bypass_redirect_checks from
> the response head, since the underlying Blob endpoint may live outside
> the browser process and a real blob load never produces a redirect.
>
> Add a content_browsertest that registers a blink::mojom::Blob whose
> Load() responds with OnReceiveRedirect and verifies that navigating to
> its blob: URL fails rather than following the redirect.
>
> TAG=agy
> CONV=51d0251b-c784-4f07-b4fe-93b5087402df
>
> Fixed: 513795122
> Change-Id: I8525501812232c2aa2bef9422d282ad4c12112e0
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8028880
> Commit-Queue: Minoru Chikamune <chik...@chromium.org>
> Reviewed-by: Rakina Zata Amni <rak...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1656964}
(cherry picked from commit d103c7ce9b9d0fd34a59c0b46647c6db6da5aaa5)
Bug: 532001785,513795122
Change-Id: I8525501812232c2aa2bef9422d282ad4c12112e0
Auto-Submit: chrome-che...@chops-service-accounts.iam.gserviceaccount.com <chrome-che...@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7871@{#3049}
Cr-Branched-From: f542126b8c1b3e80104b26bb05ec830bd1206f29-refs/heads/main@{#1639810}
Files:
- M content/browser/blob_storage/blob_url_browsertest.cc
- M content/browser/loader/navigation_url_loader_impl.cc
Change size: M
Delta: 2 files changed, 117 insertions(+), 2 deletions(-)
Branch: refs/branch-heads/7871
Submit Requirements:
Code-Review: Bot-Commit+1 by rubber-...@appspot.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages