fix: bypass CORB when web security is disabled

[deepak1556]

Description of Change

This temporarily adds a patch for disabling CORB checks for pre network service code path, things would be easier to solve once we get to implement ContentBrowserClient::CreateURLLoaderFactoryForNetworkRequests

Fixes #15132

Checklist

• PR description included and stakeholders cc'd
• npm test passes
• tests are changed or added
• relevant documentation is changed or added
• PR title follows semantic commit guidelines

Release Notes

Notes: Disable CORB checks when web security preference is disabled

[zcbenz]

Looks good to me as a temporary fix.

[nornagon]

It looks like this should be implementable without patching through the --disable-web-security switch?

[BinaryMuse]

It looks like this should be implementable without patching through the --disable-web-security switch?

That disables it for the entire app rather than a single BrowserWindow, correct?

[nornagon]

It looks like this should be implementable without patching through the --disable-web-security switch?

That disables it for the entire app rather than a single BrowserWindow, correct?

ah, yes, you're right.

One more try for a patchless fix: could we leverage this code from CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders()?

  // Give embedder a chance to skip document blocking for this response.
  const char* initiator_scheme_exception =
      GetContentClient()
          ->browser()
          ->GetInitatorSchemeBypassingDocumentBlocking();

  // Delegate most decisions to CrossOriginReadBlocking::ResponseAnalyzer.
  analyzer_ =
      std::make_unique<network::CrossOriginReadBlocking::ResponseAnalyzer>(
          *request(), response, initiator_scheme_exception);
  if (analyzer_->ShouldAllow())
    return false;

[deepak1556]

@nornagon that was my initial approach but its less generic and has a scheme based bypass. We can't easily make it compatible with our current webPreferences option, will have get the scheme of every navigation request using ResoureDispatcherHostDelegate, match process preference and finally add them to exception list, not worth the effort. This patch will only be short lived until network service is enabled.

[ckerr]

This still needs to be backported to 4-0-x in order to come down off the 4.0.x project board

[release-clerk]

Release Notes Persisted

Disable CORB checks when web security preference is disabled