Changeset 100181 in webkit

Timestamp:

Nov 14, 2011, 12:56:15 PM (15 years ago)

Author:

abarth@webkit.org

Message:

SecurityContext::isSecureTransitionTo should not refer to empty security origins
​https://bugs.webkit.org/show_bug.cgi?id=72277

Reviewed by Eric Seidel.

Now that we're tracking the "failed to initialized SecurityOrigin"
state explicitly, we should use that to determine whether we can make a
secure transition.

• dom/SecurityContext.cpp:

(WebCore::SecurityContext::isSecureTransitionTo):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/SecurityContext.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-11-14  Adam Barth  <abarth@webkit.org>
+
+        SecurityContext::isSecureTransitionTo should not refer to empty security origins
+        https://bugs.webkit.org/show_bug.cgi?id=72277
+
+        Reviewed by Eric Seidel.
+
+        Now that we're tracking the "failed to initialized SecurityOrigin"
+        state explicitly, we should use that to determine whether we can make a
+        secure transition.
+
+        * dom/SecurityContext.cpp:
+        (WebCore::SecurityContext::isSecureTransitionTo):
+
 2011-11-14  Vincent Scheib  <scheib@chromium.org>
 

trunk/Source/WebCore/dom/SecurityContext.cpp

@@ -57 +57 @@
 bool SecurityContext::isSecureTransitionTo(const KURL& url) const
 {
-    // This origin represents a new window created by the application.
-    if (securityOrigin()->isEmpty())
+    // If we haven't initialized our security origin by now, this is probably
+    // a new window created via the API (i.e., that lacks an origin and lacks
+    // a place to inherit the origin from).
+    if (!haveInitializedSecurityOrigin())
         return true;