webkit caches res://, stock:// resources

[gue5t gue5t]

It looks like webkit caches the responses to res:// and stock:// URIs: midori_view_web_view_resource_request_cb is never called in some cases, so we don't even get a chance to check the "special" flag before providing access; webkit short-circuits us.

This is not a security problem because only pre-cached resources are visible, and those contain no personally identifying information; at best an untrusted web-page can identify that midori is being used, and perhaps its version.

To reproduce:

Download the attached files to the same directory and run the .sh (after reading it, of course).