Index: Source/core/workers/AbstractWorker.cpp |
diff --git a/Source/core/workers/AbstractWorker.cpp b/Source/core/workers/AbstractWorker.cpp |
index 24e9bb88a92c20ab990ded594f54a957a752d269..0d3907d6a537ee2fc80be9edb9d9f2f5aef105b3 100644 |
--- a/Source/core/workers/AbstractWorker.cpp |
+++ b/Source/core/workers/AbstractWorker.cpp |
@@ -68,13 +68,14 @@ KURL AbstractWorker::resolveURL(const String& url, ExceptionState& es) |
return KURL(); |
} |
+ // We can safely expose the URL in the following exceptions, as these checks happen synchronously before redirection. JavaScript receives no new information. |
if (!scriptExecutionContext()->securityOrigin()->canRequest(scriptURL)) { |
- es.throwDOMException(SecurityError, "Failed to create a worker: script with origin '" + SecurityOrigin::create(scriptURL)->toString() + "' cannot be accessed from origin '" + scriptExecutionContext()->securityOrigin()->toString() + "'."); |
+ es.throwSecurityError("Failed to create a worker: script at '" + scriptURL.elidedString() + "' cannot be accessed from origin '" + scriptExecutionContext()->securityOrigin()->toString() + "'."); |
return KURL(); |
} |
if (scriptExecutionContext()->contentSecurityPolicy() && !scriptExecutionContext()->contentSecurityPolicy()->allowScriptFromSource(scriptURL)) { |
- es.throwDOMException(SecurityError, "Failed to create a worker: access to the script at '" + url + "' is denied by the document's Content Security Policy."); |
+ es.throwSecurityError("Failed to create a worker: access to the script at '" + scriptURL.elidedString() + "' is denied by the document's Content Security Policy."); |
return KURL(); |
} |