diff --git a/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.cpp b/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.cpp index d1a5e707d9c..5a890b0aadf 100644 --- a/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.cpp +++ b/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.cpp @@ -201,6 +201,20 @@ GC::Ref Response::unsafe_response() return *this; } +// https://html.spec.whatwg.org/multipage/urls-and-fetching.html#cors-same-origin +bool Response::is_cors_same_origin() const +{ + // A response whose type is "basic", "cors", or "default" is CORS-same-origin. [FETCH] + switch (type()) { + case Type::Basic: + case Type::CORS: + case Type::Default: + return true; + default: + return false; + } +} + // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#cors-cross-origin bool Response::is_cors_cross_origin() const { diff --git a/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.h b/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.h index 2148a79839c..b765725b5ca 100644 --- a/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.h +++ b/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.h @@ -116,6 +116,7 @@ public: [[nodiscard]] GC::Ref unsafe_response(); + [[nodiscard]] bool is_cors_same_origin() const; [[nodiscard]] bool is_cors_cross_origin() const; [[nodiscard]] bool is_fresh() const; diff --git a/Libraries/LibWeb/WebAssembly/WebAssembly.cpp b/Libraries/LibWeb/WebAssembly/WebAssembly.cpp index af0d086d42e..30a18bde166 100644 --- a/Libraries/LibWeb/WebAssembly/WebAssembly.cpp +++ b/Libraries/LibWeb/WebAssembly/WebAssembly.cpp @@ -750,9 +750,7 @@ GC::Ref compile_potential_webassembly_response(JS::VM& vm, GC:: } // 6. If response is not CORS-same-origin, reject returnValue with a TypeError and abort these substeps. - // https://html.spec.whatwg.org/#cors-same-origin - auto type = response_object.type(); - if (type != Bindings::ResponseType::Basic && type != Bindings::ResponseType::Cors && type != Bindings::ResponseType::Default) { + if (!response->is_cors_same_origin()) { WebIDL::reject_promise(realm, return_value, *vm.throw_completion("Response is not CORS-same-origin"sv).value()); return JS::js_undefined(); }