Changeset 125736 in webkit

Timestamp:

Aug 15, 2012, 7:14:16 PM (14 years ago)

Author:

jpfau@apple.com

Message:

Allow blocking of Web SQL databases in third-party documents
​https://bugs.webkit.org/show_bug.cgi?id=94057

Reviewed by Adam Barth.

Source/WebCore:

Add a check for pages in third-party pages to allow third-party storage blocking of Web SQL databases.

Tests: http/tests/security/cross-origin-websql-allowed.html

http/tests/security/cross-origin-websql.html

• Modules/webdatabase/DOMWindowWebDatabase.cpp:

(WebCore::DOMWindowWebDatabase::openDatabase): Pass top origin to canAccessDatabase

• page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::canAccessStorage): Common method for various types of storage that use the same criteria

• page/SecurityOrigin.h:

(WebCore::SecurityOrigin::canAccessDatabase): Use canAccessStorage
(WebCore::SecurityOrigin::canAccessLocalStorage): Change to using canAccessStorage
(SecurityOrigin):

LayoutTests:

Created tests for accessing openDatabase from a third party and first party context when third-party blocking is on and off.

• http/tests/security/cross-origin-websql-allowed-expected.txt: Added.
• http/tests/security/cross-origin-websql-allowed.html: Added.
• http/tests/security/cross-origin-websql-expected.txt: Added.
• http/tests/security/cross-origin-websql.html: Added.
• http/tests/security/resources/cross-origin-iframe-for-websql.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/cross-origin-websql-allowed-expected.txt (added)
• LayoutTests/http/tests/security/cross-origin-websql-allowed.html (added)
• LayoutTests/http/tests/security/cross-origin-websql-expected.txt (added)
• LayoutTests/http/tests/security/cross-origin-websql.html (added)
• LayoutTests/http/tests/security/resources/cross-origin-iframe-for-websql.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/Modules/webdatabase/DOMWindowWebDatabase.cpp (modified) (1 diff)
• Source/WebCore/page/SecurityOrigin.cpp (modified) (1 diff)
• Source/WebCore/page/SecurityOrigin.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-08-14  Jeffrey Pfau  <jpfau@apple.com>
+
+        Allow blocking of Web SQL databases in third-party documents
+        https://bugs.webkit.org/show_bug.cgi?id=94057
+
+        Reviewed by Adam Barth.
+
+        Created tests for accessing openDatabase from a third party and first party context when third-party blocking is on and off.
+
+        * http/tests/security/cross-origin-websql-allowed-expected.txt: Added.
+        * http/tests/security/cross-origin-websql-allowed.html: Added.
+        * http/tests/security/cross-origin-websql-expected.txt: Added.
+        * http/tests/security/cross-origin-websql.html: Added.
+        * http/tests/security/resources/cross-origin-iframe-for-websql.html: Added.
+
 2012-08-15  Kiran Muppala  <cmuppala@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-08-14  Jeffrey Pfau  <jpfau@apple.com>
+
+        Allow blocking of Web SQL databases in third-party documents
+        https://bugs.webkit.org/show_bug.cgi?id=94057
+
+        Reviewed by Adam Barth.
+
+        Add a check for pages in third-party pages to allow third-party storage blocking of Web SQL databases.
+
+        Tests: http/tests/security/cross-origin-websql-allowed.html
+               http/tests/security/cross-origin-websql.html
+
+        * Modules/webdatabase/DOMWindowWebDatabase.cpp:
+        (WebCore::DOMWindowWebDatabase::openDatabase): Pass top origin to canAccessDatabase
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canAccessStorage): Common method for various types of storage that use the same criteria
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessDatabase): Use canAccessStorage
+        (WebCore::SecurityOrigin::canAccessLocalStorage): Change to using canAccessStorage
+        (SecurityOrigin):
+
 2012-08-15  Nikhil Bhargava  <nbhargava@google.com>
 

trunk/Source/WebCore/Modules/webdatabase/DOMWindowWebDatabase.cpp

@@ -47 +47 @@
 
     RefPtr<Database> database = 0;
-    if (AbstractDatabase::isAvailable() && window->document()->securityOrigin()->canAccessDatabase())
+    if (AbstractDatabase::isAvailable() && window->document()->securityOrigin()->canAccessDatabase(window->document()->topDocument()->securityOrigin()))
         database = Database::openDatabase(window->document(), name, version, displayName, estimatedSize, creationCallback, ec);
 

trunk/Source/WebCore/page/SecurityOrigin.cpp

@@ -392 +392 @@
 }
 
-bool SecurityOrigin::canAccessLocalStorage(const SecurityOrigin* topOrigin) const
+bool SecurityOrigin::canAccessStorage(const SecurityOrigin* topOrigin) const
 {
     if (isUnique())
         return false;
+
+    // FIXME: This check should be replaced with an ASSERT once we can guarantee that topOrigin is not null.
+    if (!topOrigin)
+        return true;
 
     if (m_blockThirdPartyStorage && topOrigin->isThirdParty(this))

trunk/Source/WebCore/page/SecurityOrigin.h

@@ -124 +124 @@
     void blockThirdPartyStorage() { m_blockThirdPartyStorage = true; }
 
-    bool canAccessDatabase() const { return !isUnique(); }
-    bool canAccessLocalStorage(const SecurityOrigin* topOrigin) const;
+    bool canAccessDatabase(const SecurityOrigin* topOrigin = 0) const { return canAccessStorage(topOrigin); };
+    bool canAccessLocalStorage(const SecurityOrigin* topOrigin) const { return canAccessStorage(topOrigin); };
     bool canAccessCookies() const { return !isUnique(); }
     bool canAccessPasswordManager() const { return !isUnique(); }
@@ -193 +193 @@
     bool passesFileCheck(const SecurityOrigin*) const;
     bool isThirdParty(const SecurityOrigin*) const;
+    bool canAccessStorage(const SecurityOrigin*) const;
 
     String m_protocol;