Emerick Rogul
2bad3ba722
Upstream's `webView:startURLSchemeTask:` now rejects any WebUI sub-resource
whose `SchemeHostPort` differs from the main `webView.URL` unless it is
served from `chrome://resources`. That breaks Brave's per-frame `WebUIIOS`
support (04db68e84d), where a trusted WebUI page deliberately embeds a
chrome-untrusted (or sibling-host) WebUI iframe (e.g. AI Chat).
Extend the existing chromium_src override to also admit any URL recognized
by a registered `WebUIIOSControllerFactory`. Non-WebUI URLs continue to
fall through to the upstream check, preserving its hardening intent.
Fixes the `WebUITest.LoadWebUIPageWithWebUIChildFrame` integration test.
Note: AI-assisted: requires thorough review
Chromium changes:
https://source.chromium.org/chromium/chromium/src/+/6b67808f449e4e6ebfd00182dcf09c7a37bb75b9
commit 6b67808f449e4e6ebfd00182dcf09c7a37bb75b9
Author: Mike Dougherty <michaeldo@chromium.org>
Date: Mon Apr 27 02:18:09 2026 -0700
Correctly pass WebUI headers to resource response
This CL forwards headers set on URLRequestChromeJob instances inside
URLDataManagerIOSBackend to the actual response. Previously these
headers were unintentionally discarded.
Although set_add_content_security_policy is being explicitly disabled in
this CL, it represents no change in behavior because the header was not
previously forwarded to the response.
Bug: 502503860
Change-Id: I85b33794a405bf132b094c47e890df0473c1b591
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7764734
Auto-Submit: Mike Dougherty <michaeldo@chromium.org>
Commit-Queue: Gauthier Ambard <gambard@chromium.org>
Reviewed-by: Gauthier Ambard <gambard@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1620954}
8 lines
115 B
HTML
8 lines
115 B
HTML
<!doctype html>
|
|
<html>
|
|
<body>
|
|
WebUI page
|
|
<iframe src="chrome-untrusted://testwebui2"></iframe>
|
|
</body>
|
|
</html>
|