tree fa7cf413034602a88140a87045fcea2dd41e95d4
parent 9203d324d7584aec736a0955fd111dee3277f622
author Takashi Toyoshima <toyoshim@chromium.org> 1524045150 +0000
committer Commit Bot <commit-bot@chromium.org> 1524045150 +0000

OOR-CORS: strip username and password in CORSURLLoader

In the legacy Blink CORS, these information are stripped in
DocumentThreadableLoader in MakeCrossOriginAccessRequest().

Current OOR-CORS implementation only has DCHECKS for them,
but hasn't stripped.

Bug: 803766
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: If1a4657804215a8ce9a302acb658f9407348a79a
Reviewed-on: https://chromium-review.googlesource.com/999672
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#551621}