Fix QML XmlHttpRequest Insecure Redirection Flaw

Fix the redirection flaw in QML's XmlHttpRequest implementation that
is described in
http://lists.qt-project.org/pipermail/announce/2012-November/000014.html

Change-Id: Idfad4bc5dde6eda8840737c38e85568f3a4c0420
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

diff --git a/src/qml/qml/qqmlxmlhttprequest.cpp b/src/qml/qml/qqmlxmlhttprequest.cpp
index c289ec5..c2a0741 100644 (file)
--- a/src/qml/qml/qqmlxmlhttprequest.cpp
+++ b/src/qml/qml/qqmlxmlhttprequest.cpp
@@ -1338,9 +1338,11 @@ void QQmlXMLHttpRequest::finished()
         QVariant redirect = m_network->attribute(QNetworkRequest::RedirectionTargetAttribute);
         if (redirect.isValid()) {
             QUrl url = m_network->url().resolved(redirect.toUrl());
-            destroyNetwork();
-            requestFromUrl(url);
-            return;
+            if (url.scheme() != QLatin1String("file")) {
+                destroyNetwork();
+                requestFromUrl(url);
+                return;
+            }
         }
     }