Patch for webkitgtk version 2.36.x

diff -pru webkitgtk-2.36.5-orig/Source/WebCore/loader/cache/CachedResourceLoader.cpp webkitgtk-2.36.5/Source/WebCore/loader/cache/CachedResourceLoader.cpp
--- webkitgtk-2.36.5-orig/Source/WebCore/loader/cache/CachedResourceLoader.cpp	2022-07-30 19:01:15.573319942 +0100
+++ webkitgtk-2.36.5/Source/WebCore/loader/cache/CachedResourceLoader.cpp	2022-07-30 19:15:46.737344831 +0100
@@ -67,6 +67,7 @@
 #include "Page.h"
 #include "PingLoader.h"
 #include "PlatformStrategies.h"
+#include "PublicSuffix.h"
 #include "RenderElement.h"
 #include "ResourceLoadInfo.h"
 #include "ResourceTiming.h"
@@ -1187,6 +1188,23 @@ ResourceErrorOr<CachedResourceHandle<Cac
         originalRequest->clearHTTPOrigin();
     }
 
+    bool disableCORS = frame.page()->isCORSDisabled();
+    bool enableCORSSameDomain = frame.page()->isCORSSameDomainEnabled();
+
+    if (disableCORS) {
+        if (enableCORSSameDomain) {
+            String requestDomain = topPrivatelyControlledDomain(url.host().toString());
+            String documentDomain = topPrivatelyControlledDomain(frame.document()->url().host().toString());
+            if (!equalIgnoringASCIICase(requestDomain, documentDomain) && type != CachedResource::Type::MainResource) {
+                CACHEDRESOURCELOADER_RELEASE_LOG_WITH_FRAME("requestResource: Resource blocked by Cross-Origin Resource Sharing policy", frame);
+                return makeUnexpected(ResourceError { errorDomainWebKitInternal, 0, url, "Resource blocked by Cross-Origin Resource Sharing policy"_s, ResourceError::Type::AccessControl });
+            }
+        } else if (!equalIgnoringASCIICase(url.host(), frame.document()->url().host()) && type != CachedResource::Type::MainResource) {
+                CACHEDRESOURCELOADER_RELEASE_LOG_WITH_FRAME("requestResource: Resource blocked by Cross-Origin Resource Sharing policy", frame);
+                return makeUnexpected(ResourceError { errorDomainWebKitInternal, 0, url, "Resource blocked by Cross-Origin Resource Sharing policy"_s, ResourceError::Type::AccessControl });
+        }
+    }
+
     prepareFetch(type, request);
 
     if (request.options().destination == FetchOptions::Destination::Document || request.options().destination == FetchOptions::Destination::Iframe) {
@@ -1298,7 +1316,8 @@ ResourceErrorOr<CachedResourceHandle<Cac
     RevalidationPolicy policy = determineRevalidationPolicy(type, request, resource.get(), forPreload, imageLoading);
     switch (policy) {
     case Reload:
-        memoryCache.remove(*resource);
+        if (resource)
+            memoryCache.remove(*resource);
         FALLTHROUGH;
     case Load:
         if (resource) {
diff -pru webkitgtk-2.36.5-orig/Source/WebCore/loader/LinkLoader.cpp webkitgtk-2.36.5/Source/WebCore/loader/LinkLoader.cpp
--- webkitgtk-2.36.5-orig/Source/WebCore/loader/LinkLoader.cpp	2022-07-30 19:01:15.573319942 +0100
+++ webkitgtk-2.36.5/Source/WebCore/loader/LinkLoader.cpp	2022-07-30 19:41:22.637388711 +0100
@@ -53,7 +53,9 @@
 #include "MIMETypeRegistry.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
+#include "Page.h"
 #include "PlatformStrategies.h"
+#include "PublicSuffix.h"
 #include "ResourceError.h"
 #include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
@@ -315,6 +317,26 @@ void LinkLoader::cancelLoad()
 
 void LinkLoader::loadLink(const LinkLoadParameters& params, Document& document)
 {
+    Page *page = document.page();
+    bool disableCORS = true;
+    bool enableCORSSameDomain = true;
+
+    if (page) {
+        disableCORS = page->isCORSDisabled();
+        enableCORSSameDomain = page->isCORSSameDomainEnabled();
+    }
+
+    if (disableCORS) {
+        if (enableCORSSameDomain) {
+            String requestDomain = topPrivatelyControlledDomain(params.href.host().toString());
+            String documentDomain = topPrivatelyControlledDomain(document.url().host().toString());
+            if (!documentDomain.isEmpty() && !equalIgnoringASCIICase(requestDomain, documentDomain))
+                return;
+        } else if (!document.url().host().isEmpty() && params.href.host() != document.url().host()) {
+                return;
+        }
+    }
+
     if (params.relAttribute.isDNSPrefetch) {
         // FIXME: The href attribute of the link element can be in "//hostname" form, and we shouldn't attempt
         // to complete that as URL <https://bugs.webkit.org/show_bug.cgi?id=48857>.
diff -pru webkitgtk-2.36.5-orig/Source/WebCore/loader/SubresourceLoader.cpp webkitgtk-2.36.5/Source/WebCore/loader/SubresourceLoader.cpp
--- webkitgtk-2.36.5-orig/Source/WebCore/loader/SubresourceLoader.cpp	2022-07-30 19:01:15.574319942 +0100
+++ webkitgtk-2.36.5/Source/WebCore/loader/SubresourceLoader.cpp	2022-07-30 19:26:40.579363511 +0100
@@ -183,6 +183,39 @@ bool SubresourceLoader::isSubresourceLoa
     return true;
 }
 
+bool SubresourceLoader::isCORSDisabled() const
+{
+    if (!m_frame)
+        return true;
+
+    if (!m_frame->page())
+        return true;
+
+    return m_frame->page()->isCORSDisabled();
+}
+
+bool SubresourceLoader::isCORSSameDomainEnabled() const
+{
+    if (!m_frame)
+        return true;
+
+    if (!m_frame->page())
+        return true;
+
+    return m_frame->page()->isCORSSameDomainEnabled();
+}
+
+bool SubresourceLoader::isCORSRedirectionDisabled() const
+{
+    if (!m_frame)
+        return false;
+
+    if (!m_frame->page())
+        return false;
+
+    return m_frame->page()->isCORSRedirectionDisabled();
+}
+
 void SubresourceLoader::willSendRequestInternal(ResourceRequest&& newRequest, const ResourceResponse& redirectResponse, CompletionHandler<void(ResourceRequest&&)>&& completionHandler)
 {
     // Store the previous URL because the call to ResourceLoader::willSendRequest will modify it.
@@ -632,12 +665,25 @@ Expected<void, String> SubresourceLoader
 {
     bool crossOriginFlag = m_resource->isCrossOrigin();
     bool isNextRequestCrossOrigin = m_origin && !m_origin->canRequest(newRequest.url());
+    bool disableCORS = isCORSDisabled();
+    bool disableCORSRedirection = isCORSRedirectionDisabled();
 
     if (isNextRequestCrossOrigin)
         m_resource->setCrossOrigin();
 
     ASSERT(options().mode != FetchOptions::Mode::SameOrigin || !m_resource->isCrossOrigin());
 
+    if (options().mode != FetchOptions::Mode::Cors) {
+        if (!disableCORS) {
+            return { };
+        } else {
+            if (!disableCORSRedirection)
+                return { };
+            else
+                return makeUnexpected("CORS redirection is disabled"_s);
+        }
+    }
+
     // Implementing https://fetch.spec.whatwg.org/#concept-http-redirect-fetch step 7 & 8.
     if (options().mode == FetchOptions::Mode::Cors) {
         if (m_resource->isCrossOrigin()) {
diff -pru webkitgtk-2.36.5-orig/Source/WebCore/loader/SubresourceLoader.h webkitgtk-2.36.5/Source/WebCore/loader/SubresourceLoader.h
--- webkitgtk-2.36.5-orig/Source/WebCore/loader/SubresourceLoader.h	2022-07-30 19:01:15.574319942 +0100
+++ webkitgtk-2.36.5/Source/WebCore/loader/SubresourceLoader.h	2022-07-30 16:19:17.407042297 +0100
@@ -49,6 +49,9 @@ public:
 
     void cancelIfNotFinishing();
     bool isSubresourceLoader() const override;
+    bool isCORSDisabled() const;
+    bool isCORSSameDomainEnabled() const;
+    bool isCORSRedirectionDisabled() const;
     CachedResource* cachedResource() const override { return m_resource; };
     WEBCORE_EXPORT const HTTPHeaderMap* originalHeaders() const;
 
diff -pru webkitgtk-2.36.5-orig/Source/WebCore/page/Page.h webkitgtk-2.36.5/Source/WebCore/page/Page.h
--- webkitgtk-2.36.5-orig/Source/WebCore/page/Page.h	2022-07-30 19:01:15.574319942 +0100
+++ webkitgtk-2.36.5/Source/WebCore/page/Page.h	2022-07-30 16:19:17.407042297 +0100
@@ -40,6 +40,7 @@
 #include "Region.h"
 #include "RegistrableDomain.h"
 #include "ScrollTypes.h"
+#include "Settings.h"
 #include "ShouldRelaxThirdPartyCookieBlocking.h"
 #include "SpeechRecognitionConnection.h"
 #include "Supplementable.h"
@@ -955,6 +956,10 @@ public:
 
     void timelineControllerMaximumAnimationFrameRateDidChange(DocumentTimelinesController&);
 
+    bool isCORSDisabled() const { return m_settings->disableCORS(); }
+    bool isCORSSameDomainEnabled() const { return m_settings->enableCORSSameDomain(); }
+    bool isCORSRedirectionDisabled() const { return m_settings->disableCORSRedirection(); }
+
 private:
     struct Navigation {
         RegistrableDomain domain;
diff -pru webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/C/WKPreferences.cpp webkitgtk-2.36.5/Source/WebKit/UIProcess/API/C/WKPreferences.cpp
--- webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/C/WKPreferences.cpp	2022-07-30 19:01:15.574319942 +0100
+++ webkitgtk-2.36.5/Source/WebKit/UIProcess/API/C/WKPreferences.cpp	2022-07-30 16:19:17.408042297 +0100
@@ -724,6 +724,36 @@ bool WKPreferencesGetTopNavigationToData
     return toImpl(preferencesRef)->allowTopNavigationToDataURLs();
 }
 
+void WKPreferencesSetDisableCORS(WKPreferencesRef preferencesRef, bool allowed)
+{
+    toImpl(preferencesRef)->setDisableCORS(allowed);
+}
+
+bool WKPreferencesGetDisableCORS(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->disableCORS();
+}
+
+void WKPreferencesSetEnableCORSSameDomain(WKPreferencesRef preferencesRef, bool allowed)
+{
+    toImpl(preferencesRef)->setEnableCORSSameDomain(allowed);
+}
+
+bool WKPreferencesGetEnableCORSSameDomain(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->enableCORSSameDomain();
+}
+
+void WKPreferencesSetDisableCORSRedirection(WKPreferencesRef preferencesRef, bool allowed)
+{
+    toImpl(preferencesRef)->setDisableCORSRedirection(allowed);
+}
+
+bool WKPreferencesGetDisableCORSRedirection(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->disableCORSRedirection();
+}
+
 void WKPreferencesSetNeedsStorageAccessFromFileURLsQuirk(WKPreferencesRef preferencesRef, bool needsQuirk)
 {
     toImpl(preferencesRef)->setNeedsStorageAccessFromFileURLsQuirk(needsQuirk);
diff -pru webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h webkitgtk-2.36.5/Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h
--- webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h	2022-07-30 19:01:15.575319942 +0100
+++ webkitgtk-2.36.5/Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h	2022-07-30 16:19:17.408042297 +0100
@@ -163,6 +163,18 @@ WK_EXPORT bool WKPreferencesGetFileAcces
 WK_EXPORT void WKPreferencesSetTopNavigationToDataURLsAllowed(WKPreferencesRef preferences, bool allowed);
 WK_EXPORT bool WKPreferencesGetTopNavigationToDataURLsAllowed(WKPreferencesRef preferences);
 
+// Defaults to true.
+WK_EXPORT void WKPreferencesSetDisableCORS(WKPreferencesRef preferences, bool allowed);
+WK_EXPORT bool WKPreferencesGetDisableCORS(WKPreferencesRef preferences);
+
+// Defaults to true.
+WK_EXPORT void WKPreferencesSetEnableCORSSameDomain(WKPreferencesRef preferences, bool allowed);
+WK_EXPORT bool WKPreferencesGetEnableCORSSameDomain(WKPreferencesRef preferences);
+
+// Defaults to false.
+WK_EXPORT void WKPreferencesSetDisableCORSRedirection(WKPreferencesRef preferences, bool allowed);
+WK_EXPORT bool WKPreferencesGetDisableCORSRedirection(WKPreferencesRef preferences);
+
 // Defaults to true
 WK_EXPORT void WKPreferencesSetNeedsStorageAccessFromFileURLsQuirk(WKPreferencesRef preferences, bool needsQuirk);
 WK_EXPORT bool WKPreferencesGetNeedsStorageAccessFromFileURLsQuirk(WKPreferencesRef preferences);
diff -pru webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp webkitgtk-2.36.5/Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp
--- webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp	2022-07-30 19:01:15.575319942 +0100
+++ webkitgtk-2.36.5/Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp	2022-07-30 19:05:55.608327942 +0100
@@ -171,6 +171,9 @@ enum {
     PROP_ENABLE_JAVASCRIPT_MARKUP,
     PROP_ENABLE_MEDIA,
     PROP_MEDIA_CONTENT_TYPES_REQUIRING_HARDWARE_SUPPORT,
+    PROP_DISABLE_CORS,
+    PROP_ENABLE_CORS_SAME_DOMAIN,
+    PROP_DISABLE_CORS_REDIRECTION,
     N_PROPERTIES,
 };
 
@@ -401,6 +404,15 @@ static void webKitSettingsSetProperty(GO
     case PROP_MEDIA_CONTENT_TYPES_REQUIRING_HARDWARE_SUPPORT:
         webkit_settings_set_media_content_types_requiring_hardware_support(settings, g_value_get_string(value));
         break;
+    case PROP_DISABLE_CORS:
+        webkit_settings_set_disable_cors(settings, g_value_get_boolean(value));
+        break;
+    case PROP_ENABLE_CORS_SAME_DOMAIN:
+        webkit_settings_set_enable_cors_same_domain(settings, g_value_get_boolean(value));
+        break;
+    case PROP_DISABLE_CORS_REDIRECTION:
+        webkit_settings_set_disable_cors_redirection(settings, g_value_get_boolean(value));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -597,6 +609,15 @@ static void webKitSettingsGetProperty(GO
     case PROP_MEDIA_CONTENT_TYPES_REQUIRING_HARDWARE_SUPPORT:
         g_value_set_string(value, webkit_settings_get_media_content_types_requiring_hardware_support(settings));
         break;
+    case PROP_DISABLE_CORS:
+        g_value_set_boolean(value, webkit_settings_get_disable_cors(settings));
+        break;
+    case PROP_ENABLE_CORS_SAME_DOMAIN:
+        g_value_set_boolean(value, webkit_settings_get_enable_cors_same_domain(settings));
+        break;
+    case PROP_DISABLE_CORS_REDIRECTION:
+        g_value_set_boolean(value, webkit_settings_get_disable_cors_redirection(settings));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -1557,6 +1578,51 @@ static void webkit_settings_class_init(W
             nullptr, // A null string forces the default value.
             readWriteConstructParamFlags);
 
+    /**
+     * WebKitSettings:disable-cors:
+     *
+     * Enable or disable CORS.
+     *
+     * Since: 2.32.1
+     */
+    sObjProperties[PROP_DISABLE_CORS] =
+        g_param_spec_boolean(
+            "disable-cors",
+            _("Disable CORS"),
+            _("Whether CORS should be disabled"),
+            TRUE,
+            readWriteConstructParamFlags);
+
+    /**
+     * WebKitSettings:enable-cors-same-domain:
+     *
+     * Enable or disable CORS on same domain.
+     *
+     * Since: 2.32.1
+     */
+    sObjProperties[PROP_ENABLE_CORS_SAME_DOMAIN] =
+        g_param_spec_boolean(
+            "enable-cors-same-domain",
+            _("Enable CORS Same Domain"),
+            _("Whether CORS on same domain should be enabled"),
+            TRUE,
+            readWriteConstructParamFlags);
+
+    /**
+     * WebKitSettings:disable-cors-redirection:
+     *
+     * Enable or disable CORS redirection.
+     *
+     * Since: 2.32.1
+     */
+    sObjProperties[PROP_DISABLE_CORS_REDIRECTION] =
+        g_param_spec_boolean(
+            "disable-cors-redirection",
+            _("Disable CORS redirection"),
+            _("Whether CORS redirection should be disabled"),
+            FALSE,
+            readWriteConstructParamFlags);
+
     g_object_class_install_properties(gObjectClass, N_PROPERTIES, sObjProperties);
 }
 
@@ -3875,3 +3941,117 @@ void webkit_settings_set_media_content_t
     priv->mediaContentTypesRequiringHardwareSupport = mediaContentTypesRequiringHardwareSupportString.utf8();
     g_object_notify_by_pspec(G_OBJECT(settings), sObjProperties[PROP_MEDIA_CONTENT_TYPES_REQUIRING_HARDWARE_SUPPORT]);
 }
+
+/**
+ * webkit_settings_get_disable_cors:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:disable-cors property.
+ *
+ * Returns: %TRUE If CORS is disabled or %FALSE otherwise.
+ *
+ * Since: 2.32.1
+ */
+gboolean webkit_settings_get_disable_cors(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return settings->priv->preferences->disableCORS();
+}
+
+/**
+ * webkit_settings_set_disable_cors:
+ * @settings: a #WebKitSettings
+ * @allowed: Value to be set
+ *
+ * Set the #WebKitSettings:disable-cors property.
+ *
+ * Since: 2.32.1
+ */
+void webkit_settings_set_disable_cors(WebKitSettings* settings, gboolean allowed)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    if (priv->preferences->disableCORS() == allowed)
+        return;
+
+    priv->preferences->setDisableCORS(allowed);
+    g_object_notify(G_OBJECT(settings), "disable-cors");
+}
+
+/**
+ * webkit_settings_get_enable_cors_same_domain:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:enable-cors-same-domain property.
+ *
+ * Returns: %TRUE If CORS within the same domain is enabled or %FALSE otherwise.
+ *
+ * Since: 2.32.1
+ */
+gboolean webkit_settings_get_enable_cors_same_domain(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return settings->priv->preferences->enableCORSSameDomain();
+}
+
+/**
+ * webkit_settings_set_enable_cors_same_domain:
+ * @settings: a #WebKitSettings
+ * @allowed: Value to be set
+ *
+ * Set the #WebKitSettings:enable-cors-same-domain property.
+ *
+ * Since: 2.32.1
+ */
+void webkit_settings_set_enable_cors_same_domain(WebKitSettings* settings, gboolean allowed)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    if (priv->preferences->enableCORSSameDomain() == allowed)
+        return;
+
+    priv->preferences->setEnableCORSSameDomain(allowed);
+    g_object_notify(G_OBJECT(settings), "enable-cors-same-domain");
+}
+
+/**
+ * webkit_settings_get_disable_cors_redirection:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:disable-cors-redirection property.
+ *
+ * Returns: %TRUE If CORS redirection is disabled or %FALSE otherwise.
+ *
+ * Since: 2.32.1
+ */
+gboolean webkit_settings_get_disable_cors_redirection(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return settings->priv->preferences->disableCORSRedirection();
+}
+
+/**
+ * webkit_settings_set_disable_cors_redirection:
+ * @settings: a #WebKitSettings
+ * @allowed: Value to be set
+ *
+ * Set the #WebKitSettings:disable-cors-redirection property.
+ *
+ * Since: 2.32.1
+ */
+void webkit_settings_set_disable_cors_redirection(WebKitSettings* settings, gboolean allowed)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    if (priv->preferences->disableCORSRedirection() == allowed)
+        return;
+
+    priv->preferences->setDisableCORSRedirection(allowed);
+    g_object_notify(G_OBJECT(settings), "disable-cors-redirection");
+}
diff -pru webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/gtk/WebKitSettings.h webkitgtk-2.36.5/Source/WebKit/UIProcess/API/gtk/WebKitSettings.h
--- webkitgtk-2.36.5-orig/Source/WebKit/UIProcess/API/gtk/WebKitSettings.h	2022-07-30 19:01:15.575319942 +0100
+++ webkitgtk-2.36.5/Source/WebKit/UIProcess/API/gtk/WebKitSettings.h	2022-07-30 16:19:17.409042297 +0100
@@ -513,6 +513,27 @@ WEBKIT_API void
 webkit_settings_set_media_content_types_requiring_hardware_support (WebKitSettings *settings,
                                                                     const gchar *content_types);
 
+WEBKIT_API gboolean
+webkit_settings_get_disable_cors                               (WebKitSettings *settings);
+
+WEBKIT_API void
+webkit_settings_set_disable_cors                               (WebKitSettings *settings,
+                                                                gboolean        allowed);
+
+WEBKIT_API gboolean
+webkit_settings_get_enable_cors_same_domain                    (WebKitSettings *settings);
+
+WEBKIT_API void
+webkit_settings_set_enable_cors_same_domain                    (WebKitSettings *settings,
+                                                                gboolean        allowed);
+
+WEBKIT_API gboolean
+webkit_settings_get_disable_cors_redirection                   (WebKitSettings *settings);
+
+WEBKIT_API void
+webkit_settings_set_disable_cors_redirection                   (WebKitSettings *settings,
+                                                                gboolean        allowed);
+
 G_END_DECLS
 
 #endif /* WebKitSettings_h */
diff -pru webkitgtk-2.36.5-orig/Source/WTF/Scripts/Preferences/WebPreferences.yaml webkitgtk-2.36.5/Source/WTF/Scripts/Preferences/WebPreferences.yaml
--- webkitgtk-2.36.5-orig/Source/WTF/Scripts/Preferences/WebPreferences.yaml	2022-07-30 19:01:15.576319942 +0100
+++ webkitgtk-2.36.5/Source/WTF/Scripts/Preferences/WebPreferences.yaml	2022-07-30 16:28:54.399058782 +0100
@@ -674,6 +674,26 @@ DirectoryUploadEnabled:
       "PLATFORM(COCOA) || PLATFORM(GTK) || PLATFORM(WPE)": true
       default: false
 
+DisableCORS:
+  type: bool
+  defaultValue:
+    WebKitLegacy:
+      default: true
+    WebKit:
+      default: true
+    WebCore:
+      default: true
+
+DisableCORSRedirection:
+  type: bool
+  defaultValue:
+    WebKitLegacy:
+      default: false
+    WebKit:
+      default: false
+    WebCore:
+      default: false
+
 DisabledAdaptationsMetaTagEnabled:
   type: bool
   defaultValue:
@@ -706,6 +726,16 @@ EditableLinkBehavior:
     WebKit:
       default: WebCore::EditableLinkBehavior::NeverLive
 
+EnableCORSSameDomain:
+  type: bool
+  defaultValue:
+    WebKitLegacy:
+      default: true
+    WebKit:
+      default: true
+    WebCore:
+      default: true
+
 EnableInheritURIQueryComponent:
   type: bool
   defaultValue:
