From da1f30e36a77dd96d54e8145e402a36c4596be92 Mon Sep 17 00:00:00 2001 From: Richard Moore Date: Fri, 30 Nov 2012 11:16:51 +0000 Subject: [PATCH] Fix QML XmlHttpRequest Insecure Redirection Flaw Fix the redirection flaw in QML's XmlHttpRequest implementation that is described in http://lists.qt-project.org/pipermail/announce/2012-November/000014.html Change-Id: Idfad4bc5dde6eda8840737c38e85568f3a4c0420 Reviewed-by: Lars Knoll --- src/qml/qml/qqmlxmlhttprequest.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/qml/qml/qqmlxmlhttprequest.cpp b/src/qml/qml/qqmlxmlhttprequest.cpp index c289ec5..c2a0741 100644 --- a/src/qml/qml/qqmlxmlhttprequest.cpp +++ b/src/qml/qml/qqmlxmlhttprequest.cpp @@ -1338,9 +1338,11 @@ void QQmlXMLHttpRequest::finished() QVariant redirect = m_network->attribute(QNetworkRequest::RedirectionTargetAttribute); if (redirect.isValid()) { QUrl url = m_network->url().resolved(redirect.toUrl()); - destroyNetwork(); - requestFromUrl(url); - return; + if (url.scheme() != QLatin1String("file")) { + destroyNetwork(); + requestFromUrl(url); + return; + } } } -- 2.7.4