From e010835ad3979c20846eba07b2925ccc8a400c44 Mon Sep 17 00:00:00 2001
From: Shunya Shishido <[email protected]>
Date: Tue, 07 Jul 2026 23:26:18 -0700
Subject: [PATCH] ServiceWorker: Apply CORS filter when building response headers

FetchAPIResponse carries the internal response's full header list
together with the response_type and the list of CORS- exposed header
names. ServiceWorkerLoaderHelpers:: GetHttpResponseHeaders() previously
copied every header into the HttpResponseHeaders used for
URLResponseHead, regardless of response_type, so a kCors response
surfaced its internal headers to downstream consumers (the committed
document's response headers and the Static Router header re-parse path).

Restrict the rebuilt header list for kCors responses to the
CORS-safelisted response header names plus any names in
cors_exposed_header_names, matching the Fetch "CORS filtered response"
definition. Basic and default responses are unchanged.

Add unit tests covering GetHttpResponseHeaders and SaveResponseInfo for
kCors and kBasic responses.

Update audit_non_blink_usage.py to allowlist base::MakeFixedFlatSet,
base::ToLowerASCII, base::EqualsCaseInsensitiveASCII, and
network::mojom::FetchResponseType in service_worker_loader_helpers.cc,
as third_party/blink/common/ requires allowlisting non-std and non-blink
utilities.

TAG=agy

Bug: 524541667
Change-Id: Id4ef2bd8ae47e436422f19a3cce491bc91efebc5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8017364
Reviewed-by: Kentaro Hara <[email protected]>
Reviewed-by: Yoshisato Yanagisawa <[email protected]>
Commit-Queue: Shunya Shishido <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1658520}
---
diff --git a/third_party/blink/common/service_worker/service_worker_loader_helpers.cc b/third_party/blink/common/service_worker/service_worker_loader_helpers.cc
index 276927a6..5e07b46 100644
--- a/third_party/blink/common/service_worker/service_worker_loader_helpers.cc
+++ b/third_party/blink/common/service_worker/service_worker_loader_helpers.cc
@@ -7,10 +7,13 @@
 #include <limits>
 #include <memory>
 #include <string>
+#include <string_view>
 #include <utility>
 #include <vector>
 
+#include "base/containers/fixed_flat_set.h"
 #include "base/strings/strcat.h"
+#include "base/strings/string_util.h"
 #include "base/strings/to_string.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/http/http_response_headers.h"
@@ -28,6 +31,40 @@
 namespace blink {
 namespace {
 
+// LINT.IfChange(kCorsSafelistedResponseHeaderNames)
+// https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
+constexpr auto kCorsSafelistedResponseHeaderNames =
+    base::MakeFixedFlatSet<std::string_view>({
+        "cache-control",
+        "content-language",
+        "content-length",
+        // "content-range" is not a standard CORS-safelisted response header,
+        // but it is required by C++ media loaders (e.g. WebMediaPlayer) to
+        // process "206 Partial Content" range responses. We permit it in
+        // URLResponseHead to avoid breaking media playback, while it remains
+        // filtered out and hidden from JavaScript's view in the renderer.
+        "content-range",
+        "content-type",
+        "expires",
+        "last-modified",
+        "pragma",
+    });
+// LINT.ThenChange(third_party/blink/renderer/platform/loader/cors/cors.cc:allowed_cross_origin_response_headers)
+
+bool IsCorsExposedResponseHeader(
+    std::string_view name,
+    const std::vector<std::string>& cors_exposed_header_names) {
+  if (kCorsSafelistedResponseHeaderNames.contains(base::ToLowerASCII(name))) {
+    return true;
+  }
+  for (const auto& exposed : cors_exposed_header_names) {
+    if (base::EqualsCaseInsensitiveASCII(name, exposed)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // Calls |callback| when Blob reading is complete.
 class BlobCompleteCaller : public mojom::BlobReaderClient {
  public:
@@ -228,7 +265,18 @@
   std::string status = base::StrCat(
       {base::ToString(response.status_code), " ", response.status_text});
   net::HttpResponseHeaders::Builder builder({1, 1}, status);
+  // |response.headers| holds the header list of the internal response. For a
+  // CORS filtered response, restrict the resulting header list to the
+  // CORS-safelisted response headers and any explicitly exposed names.
+  // https://fetch.spec.whatwg.org/#concept-filtered-response-cors
+  const bool is_cors_filtered =
+      response.response_type == network::mojom::FetchResponseType::kCors;
   for (const auto& item : response.headers) {
+    if (is_cors_filtered &&
+        !IsCorsExposedResponseHeader(item.first,
+                                     response.cors_exposed_header_names)) {
+      continue;
+    }
     builder.AddHeader(item.first, item.second);
   }
   return builder.Build();
diff --git a/third_party/blink/renderer/platform/loader/cors/cors.cc b/third_party/blink/renderer/platform/loader/cors/cors.cc
index 53fadafe..107209d2 100644
--- a/third_party/blink/renderer/platform/loader/cors/cors.cc
+++ b/third_party/blink/renderer/platform/loader/cors/cors.cc
@@ -205,6 +205,7 @@
 }
 
 bool IsCorsSafelistedResponseHeader(const String& name) {
+  // LINT.IfChange(allowed_cross_origin_response_headers)
   // https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
   // TODO(dcheng): Consider using a flat_set here with a transparent comparator.
   DEFINE_THREAD_SAFE_STATIC_LOCAL(HTTPHeaderSet,
@@ -218,6 +219,7 @@
                                       "last-modified",
                                       "pragma",
                                   }));
+  // LINT.ThenChange(third_party/blink/common/service_worker/service_worker_loader_helpers.cc:kCorsSafelistedResponseHeaderNames)
   return allowed_cross_origin_response_headers.contains(name.Ascii());
 }
 
diff --git a/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py b/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py
index ea470517..4195e77 100755
--- a/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py
+++ b/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py
@@ -547,6 +547,17 @@
     },
     {
         'paths': [
+            'third_party/blink/common/service_worker/service_worker_loader_helpers.cc',
+        ],
+        'allowed': [
+            'base::EqualsCaseInsensitiveASCII',
+            'base::MakeFixedFlatSet',
+            'base::ToLowerASCII',
+            'network::mojom::FetchResponseType',
+        ],
+    },
+    {
+        'paths': [
             'third_party/blink/common/navigation/navigation_params.cc',
         ],
         'allowed': [
diff --git a/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc b/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc
index 461ce9e3..e0f1b3e3 100644
--- a/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc
+++ b/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc
@@ -5,6 +5,8 @@
 #include "third_party/blink/public/common/service_worker/service_worker_loader_helpers.h"
 
 #include "net/http/http_response_headers.h"
+#include "services/network/public/mojom/fetch_api.mojom-shared.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_response.mojom.h"
 
@@ -41,4 +43,83 @@
   EXPECT_EQ("Not Found", headers->GetStatusText());
 }
 
+TEST(ServiceWorkerLoaderHelpersTest, GetHttpResponseHeaders_CorsFiltered) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kCors;
+  response->headers["Content-Type"] = "text/html";
+  response->headers["Cache-Control"] = "no-store";
+  response->headers["Server-Timing"] = "metric;desc=value";
+  response->headers["Link"] = "</a>; rel=preload";
+  response->headers["X-Exposed"] = "ok";
+  response->headers["X-Hidden"] = "no";
+  response->cors_exposed_header_names = {"x-exposed"};
+
+  scoped_refptr<net::HttpResponseHeaders> headers =
+      ServiceWorkerLoaderHelpers::GetHttpResponseHeaders(*response);
+
+  ASSERT_TRUE(headers);
+  EXPECT_EQ(200, headers->response_code());
+  EXPECT_EQ("text/html", headers->GetNormalizedHeader("Content-Type"));
+  EXPECT_EQ("no-store", headers->GetNormalizedHeader("Cache-Control"));
+  EXPECT_EQ("ok", headers->GetNormalizedHeader("X-Exposed"));
+  EXPECT_FALSE(headers->HasHeader("Server-Timing"));
+  EXPECT_FALSE(headers->HasHeader("Link"));
+  EXPECT_FALSE(headers->HasHeader("X-Hidden"));
+}
+
+TEST(ServiceWorkerLoaderHelpersTest, GetHttpResponseHeaders_CorsNoExposed) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kCors;
+  response->headers["Content-Length"] = "10";
+  response->headers["Content-Range"] = "bytes 0-9/10";
+  response->headers["Server-Timing"] = "metric;desc=value";
+
+  scoped_refptr<net::HttpResponseHeaders> headers =
+      ServiceWorkerLoaderHelpers::GetHttpResponseHeaders(*response);
+
+  ASSERT_TRUE(headers);
+  EXPECT_EQ("10", headers->GetNormalizedHeader("Content-Length"));
+  EXPECT_EQ("bytes 0-9/10", headers->GetNormalizedHeader("Content-Range"));
+  EXPECT_FALSE(headers->HasHeader("Server-Timing"));
+}
+
+TEST(ServiceWorkerLoaderHelpersTest, SaveResponseInfo_CorsFiltered) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kCors;
+  response->headers["Content-Type"] = "text/html";
+  response->headers["Server-Timing"] = "metric;desc=value";
+  response->cors_exposed_header_names = {"X-Exposed"};
+
+  auto head = network::mojom::URLResponseHead::New();
+  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, head.get());
+
+  ASSERT_TRUE(head->headers);
+  EXPECT_EQ("text/html", head->headers->GetNormalizedHeader("Content-Type"));
+  EXPECT_FALSE(head->headers->HasHeader("Server-Timing"));
+  EXPECT_EQ(network::mojom::FetchResponseType::kCors, head->response_type);
+}
+
+TEST(ServiceWorkerLoaderHelpersTest, SaveResponseInfo_BasicNotFiltered) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kBasic;
+  response->headers["Content-Type"] = "text/html";
+  response->headers["Server-Timing"] = "metric;desc=value";
+
+  auto head = network::mojom::URLResponseHead::New();
+  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, head.get());
+
+  ASSERT_TRUE(head->headers);
+  EXPECT_EQ("text/html", head->headers->GetNormalizedHeader("Content-Type"));
+  EXPECT_EQ("metric;desc=value",
+            head->headers->GetNormalizedHeader("Server-Timing"));
+}
+
 }  // namespace blink

diff --git a/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc b/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc
index 461ce9e3..e0f1b3e3 100644
--- a/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc
+++ b/third_party/blink/common/service_worker/service_worker_loader_helpers_unittest.cc
@@ -5,6 +5,8 @@
 #include "third_party/blink/public/common/service_worker/service_worker_loader_helpers.h"
 
 #include "net/http/http_response_headers.h"
+#include "services/network/public/mojom/fetch_api.mojom-shared.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_response.mojom.h"
 
@@ -41,4 +43,83 @@
   EXPECT_EQ("Not Found", headers->GetStatusText());
 }
 
+TEST(ServiceWorkerLoaderHelpersTest, GetHttpResponseHeaders_CorsFiltered) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kCors;
+  response->headers["Content-Type"] = "text/html";
+  response->headers["Cache-Control"] = "no-store";
+  response->headers["Server-Timing"] = "metric;desc=value";
+  response->headers["Link"] = "</a>; rel=preload";
+  response->headers["X-Exposed"] = "ok";
+  response->headers["X-Hidden"] = "no";
+  response->cors_exposed_header_names = {"x-exposed"};
+
+  scoped_refptr<net::HttpResponseHeaders> headers =
+      ServiceWorkerLoaderHelpers::GetHttpResponseHeaders(*response);
+
+  ASSERT_TRUE(headers);
+  EXPECT_EQ(200, headers->response_code());
+  EXPECT_EQ("text/html", headers->GetNormalizedHeader("Content-Type"));
+  EXPECT_EQ("no-store", headers->GetNormalizedHeader("Cache-Control"));
+  EXPECT_EQ("ok", headers->GetNormalizedHeader("X-Exposed"));
+  EXPECT_FALSE(headers->HasHeader("Server-Timing"));
+  EXPECT_FALSE(headers->HasHeader("Link"));
+  EXPECT_FALSE(headers->HasHeader("X-Hidden"));
+}
+
+TEST(ServiceWorkerLoaderHelpersTest, GetHttpResponseHeaders_CorsNoExposed) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kCors;
+  response->headers["Content-Length"] = "10";
+  response->headers["Content-Range"] = "bytes 0-9/10";
+  response->headers["Server-Timing"] = "metric;desc=value";
+
+  scoped_refptr<net::HttpResponseHeaders> headers =
+      ServiceWorkerLoaderHelpers::GetHttpResponseHeaders(*response);
+
+  ASSERT_TRUE(headers);
+  EXPECT_EQ("10", headers->GetNormalizedHeader("Content-Length"));
+  EXPECT_EQ("bytes 0-9/10", headers->GetNormalizedHeader("Content-Range"));
+  EXPECT_FALSE(headers->HasHeader("Server-Timing"));
+}
+
+TEST(ServiceWorkerLoaderHelpersTest, SaveResponseInfo_CorsFiltered) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kCors;
+  response->headers["Content-Type"] = "text/html";
+  response->headers["Server-Timing"] = "metric;desc=value";
+  response->cors_exposed_header_names = {"X-Exposed"};
+
+  auto head = network::mojom::URLResponseHead::New();
+  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, head.get());
+
+  ASSERT_TRUE(head->headers);
+  EXPECT_EQ("text/html", head->headers->GetNormalizedHeader("Content-Type"));
+  EXPECT_FALSE(head->headers->HasHeader("Server-Timing"));
+  EXPECT_EQ(network::mojom::FetchResponseType::kCors, head->response_type);
+}
+
+TEST(ServiceWorkerLoaderHelpersTest, SaveResponseInfo_BasicNotFiltered) {
+  auto response = mojom::FetchAPIResponse::New();
+  response->status_code = 200;
+  response->status_text = "OK";
+  response->response_type = network::mojom::FetchResponseType::kBasic;
+  response->headers["Content-Type"] = "text/html";
+  response->headers["Server-Timing"] = "metric;desc=value";
+
+  auto head = network::mojom::URLResponseHead::New();
+  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, head.get());
+
+  ASSERT_TRUE(head->headers);
+  EXPECT_EQ("text/html", head->headers->GetNormalizedHeader("Content-Type"));
+  EXPECT_EQ("metric;desc=value",
+            head->headers->GetNormalizedHeader("Server-Timing"));
+}
+
 }  // namespace blink