⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 195075 in webkit


Ignore:
Timestamp:
Jan 14, 2016, 1:42:35 PM (11 years ago)
Author:
dbates@webkit.org
Message:

Disallow use of Geolocation service from unique origins
​https://bugs.webkit.org/show_bug.cgi?id=153102
<rdar://problem/23055645>

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Tests: fast/dom/Geolocation/dataURL-getCurrentPosition.html

fast/dom/Geolocation/dataURL-watchPosition.html
fast/dom/Geolocation/srcdoc-getCurrentPosition.html
fast/dom/Geolocation/srcdoc-watchPosition.html
http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition.html
http/tests/security/sandboxed-iframe-geolocation-watchPosition.html

  • Modules/geolocation/Geolocation.cpp:

(WebCore::Geolocation::securityOrigin): Convenience function to get the SecurityOrigin object
associated with this script execution context.
(WebCore::Geolocation::startRequest): Notify requester POSITION_UNAVAILABLE when requested
from a document with a unique origin.

  • Modules/geolocation/Geolocation.h:
  • page/SecurityOrigin.h:

(WebCore::SecurityOrigin::canRequestGeolocation): Added.

LayoutTests:

  • fast/dom/Geolocation/dataURL-getCurrentPosition-expected.txt: Added.
  • fast/dom/Geolocation/dataURL-getCurrentPosition.html: Added.
  • fast/dom/Geolocation/dataURL-watchPosition-expected.txt: Added.
  • fast/dom/Geolocation/dataURL-watchPosition.html: Added.
  • fast/dom/Geolocation/srcdoc-getCurrentPosition-expected.txt: Added.
  • fast/dom/Geolocation/srcdoc-getCurrentPosition.html: Added.
  • fast/dom/Geolocation/srcdoc-watchPosition-expected.txt: Added.
  • fast/dom/Geolocation/srcdoc-watchPosition.html: Added.
  • http/tests/security/resources/checkThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod.js: Added.

(done):
(logMessage):
(didReceivePosition):
(didReceiveError):
(checkThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod):
(markupToCheckThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod):
(dataURLToCheckThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod):

  • http/tests/security/resources/sandboxed-iframe-geolocation-getCurrentPosition.html: Added.
  • http/tests/security/resources/sandboxed-iframe-geolocation-watchPosition.html: Added.
  • http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt: Added.
  • http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition.html: Added.
  • http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt: Added.
  • http/tests/security/sandboxed-iframe-geolocation-watchPosition.html: Added.
Location:
trunk
Files:
15 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r195073 r195075  
     12016-01-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow use of Geolocation service from unique origins
     4        https://bugs.webkit.org/show_bug.cgi?id=153102
     5        <rdar://problem/23055645>
     6
     7        Reviewed by Alexey Proskuryakov.
     8
     9        * fast/dom/Geolocation/dataURL-getCurrentPosition-expected.txt: Added.
     10        * fast/dom/Geolocation/dataURL-getCurrentPosition.html: Added.
     11        * fast/dom/Geolocation/dataURL-watchPosition-expected.txt: Added.
     12        * fast/dom/Geolocation/dataURL-watchPosition.html: Added.
     13        * fast/dom/Geolocation/srcdoc-getCurrentPosition-expected.txt: Added.
     14        * fast/dom/Geolocation/srcdoc-getCurrentPosition.html: Added.
     15        * fast/dom/Geolocation/srcdoc-watchPosition-expected.txt: Added.
     16        * fast/dom/Geolocation/srcdoc-watchPosition.html: Added.
     17        * http/tests/security/resources/checkThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod.js: Added.
     18        (done):
     19        (logMessage):
     20        (didReceivePosition):
     21        (didReceiveError):
     22        (checkThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod):
     23        (markupToCheckThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod):
     24        (dataURLToCheckThatPositionErrorCallbackIsCalledWithPositionUnavailableForGeolocationMethod):
     25        * http/tests/security/resources/sandboxed-iframe-geolocation-getCurrentPosition.html: Added.
     26        * http/tests/security/resources/sandboxed-iframe-geolocation-watchPosition.html: Added.
     27        * http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt: Added.
     28        * http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition.html: Added.
     29        * http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt: Added.
     30        * http/tests/security/sandboxed-iframe-geolocation-watchPosition.html: Added.
     31
    1322016-01-14  Daniel Bates  <dabates@apple.com>
    233

  • trunk/Source/WebCore/ChangeLog

    r195074 r195075  
     12016-01-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow use of Geolocation service from unique origins
     4        https://bugs.webkit.org/show_bug.cgi?id=153102
     5        <rdar://problem/23055645>
     6
     7        Reviewed by Alexey Proskuryakov.
     8
     9        Tests: fast/dom/Geolocation/dataURL-getCurrentPosition.html
     10               fast/dom/Geolocation/dataURL-watchPosition.html
     11               fast/dom/Geolocation/srcdoc-getCurrentPosition.html
     12               fast/dom/Geolocation/srcdoc-watchPosition.html
     13               http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition.html
     14               http/tests/security/sandboxed-iframe-geolocation-watchPosition.html
     15
     16        * Modules/geolocation/Geolocation.cpp:
     17        (WebCore::Geolocation::securityOrigin): Convenience function to get the SecurityOrigin object
     18        associated with this script execution context.
     19        (WebCore::Geolocation::startRequest): Notify requester POSITION_UNAVAILABLE when requested
     20        from a document with a unique origin.
     21        * Modules/geolocation/Geolocation.h:
     22        * page/SecurityOrigin.h:
     23        (WebCore::SecurityOrigin::canRequestGeolocation): Added.
     24
    1252016-01-14  Daniel Bates  <dabates@apple.com>
    226

  • trunk/Source/WebCore/Modules/geolocation/Geolocation.cpp

    r194496 r195075  
    4141#include "Page.h"
    4242#include "PositionError.h"
     43#include "SecurityOrigin.h"
    4344#include <wtf/CurrentTime.h>
    4445#include <wtf/Ref.h>
    … …  
    4950static const char failedToStartServiceErrorMessage[] = "Failed to start Geolocation service";
    5051static const char framelessDocumentErrorMessage[] = "Geolocation cannot be used in frameless documents";
     52static const char originCannotRequestGeolocationErrorMessage[] = "Origin does not have permission to use Geolocation service";
    5153
    5254static RefPtr<Geoposition> createGeoposition(GeolocationPosition* position)
    … …  
    150152{
    151153    return downcast<Document>(scriptExecutionContext());
     154}
     155
     156SecurityOrigin* Geolocation::securityOrigin() const
     157{
     158    return scriptExecutionContext()->securityOrigin();
    152159}
    153160
    … …  
    333340void Geolocation::startRequest(GeoNotifier* notifier)
    334341{
     342    if (!securityOrigin()->canRequestGeolocation()) {
     343        notifier->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, ASCIILiteral(originCannotRequestGeolocationErrorMessage)));
     344        return;
     345    }
     346
    335347    // Check whether permissions have already been denied. Note that if this is the case,
    336348    // the permission state can not change again in the lifetime of this page.

  • trunk/Source/WebCore/Modules/geolocation/Geolocation.h

    r192848 r195075  
    4949class Page;
    5050class ScriptExecutionContext;
     51class SecurityOrigin;
    5152
    5253class Geolocation : public ScriptWrappable, public RefCounted<Geolocation>, public ActiveDOMObject
    … …  
    8889
    8990    Page* page() const;
     91    SecurityOrigin* securityOrigin() const;
    9092
    9193    typedef Vector<RefPtr<GeoNotifier>> GeoNotifierVector;

  • trunk/Source/WebCore/page/SecurityOrigin.h

    r194367 r195075  
    157157    bool canAccessApplicationCache(const SecurityOrigin* topOrigin) const { return canAccessStorage(topOrigin); }
    158158    bool canAccessCookies() const { return !isUnique(); }
     159    bool canRequestGeolocation() const { return !isUnique(); }
    159160    Policy canShowNotifications() const;
    160161
Note: See TracChangeset for help on using the changeset viewer.