[GStreamer] No CORS support for media elements
https://bugs.webkit.org/show_bug.cgi?id=99037

Patch by Youenn Fablet <youenn.fablet@crf.canon.fr> on 2014-04-13
Reviewed by Philippe Normand.

Source/WebCore:

Added CORS access control check to media sources when crossorigin attribute is set.

Added getter to CORS access control check status (used to compute whether the stream is tainted or not).
Related test is http/tests/security/video-cross-origin-readback.html.

Disabled access to cross-origin streams that fail CORS check when crossorigin attribute is set.
Related test is http/tests/security/video-cross-origin-accessfailure.html.

Tests: http/tests/security/video-cross-origin-accessfailure.html
       http/tests/security/video-cross-origin-accesssameorigin.html

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::didPassCORSAccessCheck): Return whether media is cross-origin (tainted) or not by querying the gstreamer source layer.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Added MediaPlayerPrivateGStreamer::didPassCORSAccessCheck declaration.
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcStart): Passed CORS mode parameter to the streaming client. In case of CORS check failure, stop the resource loading.
(webKitSrcPassedCORSAccessCheck): Return whether CORS access control check was done and successful.
(StreamingClient::handleResponseReceived): Take a parameter to assign the CORS access control check result.
(CachedResourceStreamingClient::CachedResourceStreamingClient): Updated setting of the ResourceLoaderOptions according CORS mode.
(CachedResourceStreamingClient::responseReceived): Check CORS and pass result to handleResponseReceived.
(ResourceHandleStreamingClient::didReceiveResponse): No CORS check.
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.h: Added webKitSrcPassedCORSAccessCheck declaration.

LayoutTests:

http/tests/security/video-cross-origin-accessfailure.html verifies that cross-origin streams that fail CORS check
are not played when crossorigin attribute is set.
 http/tests/security/video-cross-origin-accesssameorigin.html verifies that access to same-origin streams
are played when crossorigin attribute is set.

* http/tests/security/video-cross-origin-accessfailure-expected.txt: Added.
* http/tests/security/video-cross-origin-accessfailure.html: Added.
* http/tests/security/video-cross-origin-accesssameorigin-expected.txt: Added.
* http/tests/security/video-cross-origin-accesssameorigin.html: Added.
* platform/efl/TestExpectations: Enabled http/tests/security/video-cross-origin-readback.html.
* platform/gtk/TestExpectations: Ditto.
* platform/mac/TestExpectations: Disabled http/tests/security/video-cross-origin-accessfailure.html.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167193 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Fix GTK+ build with recent cairo and GTK+ after r167168.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseCreateWebPage):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167194 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r167168 and r167194.
https://bugs.webkit.org/show_bug.cgi?id=131589

Caused massive ASSERTION failures on the GTK Debug bot
(Requested by philn on #webkit).

Reverted changesets:

"[GTK] Add HighDPI support for non-accelerated compositing
contents"
https://bugs.webkit.org/show_bug.cgi?id=131562
http://trac.webkit.org/changeset/167168

Source/WebCore:

"Unreviewed. Fix GTK+ build with recent cairo and GTK+ after
r167168."
http://trac.webkit.org/changeset/167194

Source/WebKit2:

"Unreviewed. Fix GTK+ build with recent cairo and GTK+ after
r167168."
http://trac.webkit.org/changeset/167194

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167195 268f45cc-cd09-0410-ab3c-d52691b4dbfc