diff --git a/src/core/renderer/content_renderer_client_qt.cpp b/src/core/renderer/content_renderer_client_qt.cpp
index 76baf131bfdb07c341f2e97f994858a54583a00f..3eda3993a8122ea96009b0e9566d386c1e4d92e7 100644
--- a/src/core/renderer/content_renderer_client_qt.cpp
+++ b/src/core/renderer/content_renderer_client_qt.cpp
@@ -69,6 +69,8 @@
#include "services/service_manager/public/cpp/service_context.h"
#include "third_party/blink/public/platform/web_url_error.h"
#include "third_party/blink/public/platform/web_url_request.h"
+#include "third_party/blink/public/web/web_security_policy.h"
+#include "third_party/blink/renderer/platform/weborigin/kurl.h"
#include "ui/base/resource/resource_bundle.h"
#include "ui/base/webui/jstemplate_builder.h"
#include "content/public/common/web_preferences.h"
@@ -131,6 +133,11 @@ void ContentRendererClientQt::RenderThreadStarted()
if (!m_spellCheck)
InitSpellCheck();
#endif
+
+ // Allow XMLHttpRequests from qrc to file.
+ blink::WebURL qrc(blink::KURL("qrc:"));
+ blink::WebString file(blink::WebString::FromASCII("file"));
+ blink::WebSecurityPolicy::AddOriginAccessWhitelistEntry(qrc, file, blink::WebString(), true);
}
void ContentRendererClientQt::RenderViewCreated(content::RenderView* render_view)
diff --git a/tests/auto/widgets/origins/resources/mixedXHR.html b/tests/auto/widgets/origins/resources/mixedXHR.html
new file mode 100644
index 0000000000000000000000000000000000000000..3dfd90006d5f890e5b2e4fe4c84bc6d7a13f1d9f
--- /dev/null
+++ b/tests/auto/widgets/origins/resources/mixedXHR.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <title>Mixed</title>
+ <script>
+ var result;
+ function sendXHR(url) {
+ result = undefined;
+ let req = new XMLHttpRequest();
+ req.addEventListener("load", () => { result = req.responseText });
+ req.addEventListener("error", () => { result = "error"; });
+ req.open("GET", url);
+ req.send();
+ }
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/tests/auto/widgets/origins/resources/mixedXHR.txt b/tests/auto/widgets/origins/resources/mixedXHR.txt
new file mode 100644
index 0000000000000000000000000000000000000000..b5754e20373fdaa5331ef6e4623dbae636225e3b
--- /dev/null
+++ b/tests/auto/widgets/origins/resources/mixedXHR.txt
@@ -0,0 +1 @@
+ok
\ No newline at end of file
diff --git a/tests/auto/widgets/origins/tst_origins.cpp b/tests/auto/widgets/origins/tst_origins.cpp
index a24791f6f4513ac0e314f840316ed1b886724945..4e415af900677394f4da70841b8153db666ffece 100644
--- a/tests/auto/widgets/origins/tst_origins.cpp
+++ b/tests/auto/widgets/origins/tst_origins.cpp
@@ -177,6 +177,7 @@ private Q_SLOTS:
void subdirWithoutAccess();
void mixedSchemes();
void mixedSchemesWithCsp();
+ void mixedXHR();
#if defined(WEBSOCKETS)
void webSocket();
#endif
@@ -479,6 +480,43 @@ void tst_Origins::mixedSchemesWithCsp()
QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("canLoadButNotAccess")));
}
+// Load the main page over one scheme, then make an XMLHttpRequest to a
+// different scheme.
+//
+// XMLHttpRequests can only be made to http, https, data, and chrome.
+void tst_Origins::mixedXHR()
+{
+ QVERIFY(load(QSL("file:" THIS_DIR "resources/mixedXHR.html")));
+ eval(QSL("sendXHR('file:" THIS_DIR "resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+ eval(QSL("sendXHR('qrc:/resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("error")));
+ eval(QSL("sendXHR('tst:/resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("error")));
+ eval(QSL("sendXHR('data:,ok')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+
+ QVERIFY(load(QSL("qrc:/resources/mixedXHR.html")));
+ eval(QSL("sendXHR('file:" THIS_DIR "resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+ eval(QSL("sendXHR('qrc:/resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+ eval(QSL("sendXHR('tst:/resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("error")));
+ eval(QSL("sendXHR('data:,ok')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+
+ QVERIFY(load(QSL("tst:/resources/mixedXHR.html")));
+ eval(QSL("sendXHR('file:" THIS_DIR "resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("error")));
+ eval(QSL("sendXHR('qrc:/resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("error")));
+ eval(QSL("sendXHR('tst:/resources/mixedXHR.txt')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+ eval(QSL("sendXHR('data:,ok')"));
+ QTRY_COMPARE(eval(QSL("result")), QVariant(QSL("ok")));
+}
+
#if defined(WEBSOCKETS)
class EchoServer : public QObject {
Q_OBJECT
diff --git a/tests/auto/widgets/origins/tst_origins.qrc b/tests/auto/widgets/origins/tst_origins.qrc
index 0b1fe2d311374499cb9c993aae78e1ee283f3bc6..fcf54aaeaed52b64201a4e41595a3059a1aa843e 100644
--- a/tests/auto/widgets/origins/tst_origins.qrc
+++ b/tests/auto/widgets/origins/tst_origins.qrc
@@ -7,6 +7,8 @@
<file>resources/mixedSchemes.html</file>
<file>resources/mixedSchemesWithCsp.html</file>
<file>resources/mixedSchemes_frame.html</file>
+ <file>resources/mixedXHR.html</file>
+ <file>resources/mixedXHR.txt</file>
<file>resources/serviceWorker.html</file>
<file>resources/serviceWorker.js</file>
<file>resources/sharedWorker.html</file>