Merge pull request #641 from brave/asar_vul

Do not add "Access-Control-Allow-Origin: *" to response header
brave · Aug 9, 2018 · f256433 · f256433
2 parents 7eccb60 + 23163c2
commit f256433
Show file tree

Hide file tree

Showing 5 changed files with 0 additions and 10 deletions.
diff --git a/atom/browser/net/asar/url_request_asar_job.cc b/atom/browser/net/asar/url_request_asar_job.cc
@@ -240,7 +240,6 @@ void URLRequestAsarJob::GetResponseInfo(net::HttpResponseInfo* info) {
   std::string status("HTTP/1.1 200 OK");
   auto* headers = new net::HttpResponseHeaders(status);
 
-  headers->AddHeader(atom::kCORSHeader);
   info->headers = headers;
 }
 

diff --git a/atom/browser/net/url_request_buffer_job.cc b/atom/browser/net/url_request_buffer_job.cc
@@ -78,8 +78,6 @@ void URLRequestBufferJob::GetResponseInfo(net::HttpResponseInfo* info) {
   status.append("\0\0", 2);
   auto* headers = new net::HttpResponseHeaders(status);
 
-  headers->AddHeader(kCORSHeader);
-
   if (!mime_type_.empty()) {
     std::string content_type_header(net::HttpRequestHeaders::kContentType);
     content_type_header.append(": ");

diff --git a/atom/browser/net/url_request_string_job.cc b/atom/browser/net/url_request_string_job.cc
@@ -34,8 +34,6 @@ void URLRequestStringJob::GetResponseInfo(net::HttpResponseInfo* info) {
   std::string status("HTTP/1.1 200 OK");
   auto* headers = new net::HttpResponseHeaders(status);
 
-  headers->AddHeader(kCORSHeader);
-
   if (!mime_type_.empty()) {
     std::string content_type_header(net::HttpRequestHeaders::kContentType);
     content_type_header.append(": ");

diff --git a/atom/common/atom_constants.cc b/atom/common/atom_constants.cc
@@ -6,8 +6,6 @@
 
 namespace atom {
 
-const char kCORSHeader[] = "Access-Control-Allow-Origin: *";
-
 const char kSHA1Certificate[] = "SHA-1 Certificate";
 const char kSHA1MajorDescription[] =
     "The certificate for this site expires in 2017 or later, "

diff --git a/atom/common/atom_constants.h b/atom/common/atom_constants.h
@@ -7,9 +7,6 @@
 
 namespace atom {
 
-// Header to ignore CORS.
-extern const char kCORSHeader[];
-
 // Strings describing Chrome security policy for DevTools security panel.
 extern const char kSHA1Certificate[];
 extern const char kSHA1MajorDescription[];