Changeset 194065 in webkit

Timestamp:

Dec 14, 2015, 3:07:24 PM (11 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r194001. rdar://problem/23581577

Location:

branches/safari-601-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/contentdispositionattachmentsandbox/resources/echo-http-referer.php (added)
• LayoutTests/http/tests/contentdispositionattachmentsandbox/resources/subresource-request-not-include-referer-header-frame.php (added)
• LayoutTests/http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header-expected.txt (added)
• LayoutTests/http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (2 diffs)

branches/safari-601-branch/LayoutTests/ChangeLog

@@ +1 @@
+2015-12-14  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r194001. rdar://problem/23581577
+
+    2015-12-11  Jiewen Tan  <jiewen_tan@apple.com>
+
+            Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
+            https://bugs.webkit.org/show_bug.cgi?id=152102
+            <rdar://problem/22124230>
+
+            Reviewed by Andy Estes.
+
+            * http/tests/contentdispositionattachmentsandbox/resources/echo-http-referer.php: Added.
+            * http/tests/contentdispositionattachmentsandbox/resources/subresource-request-not-include-referer-header-frame.php: Added.
+            * http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header-expected.txt: Added.
+            * http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html: Added.
+
 2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-601-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2015-12-14  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r194001. rdar://problem/23581577
+
+    2015-12-11  Jiewen Tan  <jiewen_tan@apple.com>
+
+            Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
+            https://bugs.webkit.org/show_bug.cgi?id=152102
+            <rdar://problem/22124230>
+
+            Reviewed by Andy Estes.
+
+            Keep the ReferrerPolicy for a document as ReferrerPolicyNever if the document is loaded with
+            "Content-Disposition: attachment".
+
+            Test: http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html
+
+            * dom/Document.cpp:
+            (WebCore::Document::processReferrerPolicy):
+            (WebCore::Document::applyContentDispositionAttachmentSandbox):
+
 2015-12-14  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-601-branch/Source/WebCore/dom/Document.cpp

@@ -3270 +3270 @@
     ASSERT(!policy.isNull());
 
+    // Documents in a Content-Disposition: attachment sandbox should never send a Referer header,
+    // even if the document has a meta tag saying otherwise.
+    if (shouldEnforceContentDispositionAttachmentSandbox())
+        return;
+
     // Note that we're supporting both the standard and legacy keywords for referrer
     // policies, as defined by http://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-meta
@@ -4949 +4954 @@
     enforceSandboxFlags(m_frame->loader().effectiveSandboxFlags());
 
-    if (shouldEnforceContentDispositionAttachmentSandbox())
-        enforceSandboxFlags(SandboxAll);
+    if (shouldEnforceContentDispositionAttachmentSandbox()) {
+        setReferrerPolicy(ReferrerPolicyNever);
+        enforceSandboxFlags(SandboxAll);        
+    }
 
     setSecurityOriginPolicy(SecurityOriginPolicy::create(isSandboxed(SandboxOrigin) ? SecurityOrigin::createUnique() : SecurityOrigin::create(m_url)));