Changeset 197263 in webkit

Timestamp:

Feb 27, 2016, 4:50:28 PM (11 years ago)

Author:

Chris Dumez

Message:

Prevent cross-origin access to Location.assign() / Location.reload()
​https://bugs.webkit.org/show_bug.cgi?id=154779

Reviewed by Darin Adler.

Source/WebCore:

Prevent cross-origin access to Location.assign() / Location.reload()
to match the latest specification:

• ​https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

Firefox and Chrome already prevent this but WebKit allowed it.

No new tests, already covered by existing tests.

• bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertySlotDelegate):
(WebCore::JSLocation::putDelegate): Deleted.

LayoutTests:

Update existing layout tests now that we prevent cross-origin access to
Location.assign() / Location.reload().

• http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
• http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
• http/tests/security/cross-frame-access-location-get-expected.txt:
• http/tests/security/cross-frame-access-location-get-override-expected.txt:
• http/tests/security/cross-frame-access-location-get-override.html:
• http/tests/security/cross-frame-access-location-get.html:
• http/tests/security/xss-DENIED-defineProperty-expected.txt:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt (modified) (2 diffs)
• LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html (modified) (1 diff)
• LayoutTests/http/tests/security/cross-frame-access-location-get-expected.txt (modified) (2 diffs)
• LayoutTests/http/tests/security/cross-frame-access-location-get-override-expected.txt (modified) (1 diff)
• LayoutTests/http/tests/security/cross-frame-access-location-get-override.html (modified) (1 diff)
• LayoutTests/http/tests/security/cross-frame-access-location-get.html (modified) (1 diff)
• LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSLocationCustom.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-02-27  Chris Dumez  <cdumez@apple.com>
+
+        Prevent cross-origin access to Location.assign() / Location.reload()
+        https://bugs.webkit.org/show_bug.cgi?id=154779
+
+        Reviewed by Darin Adler.
+
+        Update existing layout tests now that we prevent cross-origin access to
+        Location.assign() / Location.reload().
+
+        * http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
+        * http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
+        * http/tests/security/cross-frame-access-location-get-expected.txt:
+        * http/tests/security/cross-frame-access-location-get-override-expected.txt:
+        * http/tests/security/cross-frame-access-location-get-override.html:
+        * http/tests/security/cross-frame-access-location-get.html:
+        * http/tests/security/xss-DENIED-defineProperty-expected.txt:
+
 2016-02-27  Andy VanWagoner  <thetalecrafter@gmail.com>
 

trunk/LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt

@@ +1 @@
+CONSOLE MESSAGE: line 64: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 64: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 64: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 64: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
@@ -409 +411 @@
 PASS: canGetDescriptor(targetLocation, 'valueOf') should be 'false' and is.
 PASS: canGetDescriptor(targetLocation, 'customProperty') should be 'false' and is.
-PASS: canGetDescriptor(targetLocation, 'assign') should be 'true' and is.
+PASS: canGetDescriptor(targetLocation, 'assign') should be 'false' and is.
+PASS: canGetDescriptor(targetLocation, 'reload') should be 'false' and is.
 PASS: canGetDescriptor(targetLocation, 'replace') should be 'true' and is.
-PASS: canGetDescriptor(targetLocation, 'reload') should be 'true' and is.
 ----- tests access to cross domain history object -----
 PASS: canGetDescriptor(targetHistory, 'length') should be 'false' and is.

trunk/LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html

@@ -254 +254 @@
             window.targetLocation = targetWindow.location;
             var locationPropertiesNotAllowed = [
-                "protocol", "host", "hostname", "port", "pathname", "search", "hash", "toString", "valueOf", "customProperty"
+                "protocol", "host", "hostname", "port", "pathname", "search", "hash", "toString", "valueOf", "customProperty", "assign", "reload"
             ];
             var locationPropertiesAllowed = [
-                "assign", "replace", "reload"
+                "replace"
             ];
             for (var i = 0; i < locationPropertiesNotAllowed.length; i++)

trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-expected.txt

@@ -1 +1 @@
 CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
@@ -27 +29 @@
 PASS: canGet('targetWindow.location.protocol') should be 'false' and is.
 PASS: canGet('targetWindow.location.search') should be 'false' and is.
-PASS: canGet('targetWindow.location.assign') should be 'true' and is.
-PASS: canGet('targetWindow.location.reload') should be 'true' and is.
+PASS: canGet('targetWindow.location.assign') should be 'false' and is.
+PASS: canGet('targetWindow.location.reload') should be 'false' and is.
 PASS: canGet('targetWindow.location.replace') should be 'true' and is.
 PASS: canGet('targetWindow.location.existingCustomProperty') should be 'false' and is.

trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-override-expected.txt

@@ +1 @@
+CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 
 ----- tests for getting a targetWindow's location object's functions which have custom overrides.  The desired behavior is for the targetWindow to return the builtin function, not the override -----
 
-PASS: canGet('targetWindow.location.assign') should be 'true' and is.
-PASS: toString('targetWindow.location.assign') should be 'function assign() {    [native code]}' and is.
-PASS: canGet('targetWindow.location.reload') should be 'true' and is.
-PASS: toString('targetWindow.location.reload') should be 'function reload() {    [native code]}' and is.
+PASS: canGet('targetWindow.location.assign') should be 'false' and is.
+PASS: canGet('targetWindow.location.reload') should be 'false' and is.
 PASS: canGet('targetWindow.location.replace') should be 'true' and is.
 PASS: toString('targetWindow.location.replace') should be 'function replace() {    [native code]}' and is.

trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-override.html

@@ -41 +41 @@
 
             // Overriden using window.location.assign = function() { return "new assign" }
-            shouldBeTrue("canGet('targetWindow.location.assign')");
-            shouldBe("toString('targetWindow.location.assign')", "toString('window.location.assign')");
+            shouldBeFalse("canGet('targetWindow.location.assign')");
 
             // Overriden using window.location.reload = "new reload"
-            shouldBeTrue("canGet('targetWindow.location.reload')");
-            shouldBe("toString('targetWindow.location.reload')", "toString('window.location.reload')");
+            shouldBeFalse("canGet('targetWindow.location.reload')");
 
             // Overriden using window.location.reload = "new replace"

trunk/LayoutTests/http/tests/security/cross-frame-access-location-get.html

@@ -51 +51 @@
             shouldBeFalse("canGet('targetWindow.location.protocol')");
             shouldBeFalse("canGet('targetWindow.location.search')");
+            shouldBeFalse("canGet('targetWindow.location.assign')");
+            shouldBeFalse("canGet('targetWindow.location.reload')");
 
-            shouldBeTrue("canGet('targetWindow.location.assign')");
-            shouldBeTrue("canGet('targetWindow.location.reload')");
             shouldBeTrue("canGet('targetWindow.location.replace')");
 

trunk/LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt

@@ -53 +53 @@
 CONSOLE MESSAGE: line 36: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 36: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 40: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 40: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-02-27  Chris Dumez  <cdumez@apple.com>
+
+        Prevent cross-origin access to Location.assign() / Location.reload()
+        https://bugs.webkit.org/show_bug.cgi?id=154779
+
+        Reviewed by Darin Adler.
+
+        Prevent cross-origin access to Location.assign() / Location.reload()
+        to match the latest specification:
+        - https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)
+
+        Firefox and Chrome already prevent this but WebKit allowed it.
+
+        No new tests, already covered by existing tests.
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertySlotDelegate):
+        (WebCore::JSLocation::putDelegate): Deleted.
+
 2016-02-27  Andy VanWagoner  <thetalecrafter@gmail.com>
 

trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp

@@ -48 +48 @@
         return false;
 
-    // Check for the few functions that we allow, even when called cross-domain.
-    // Make these read-only / non-configurable to prevent writes via defineProperty.
+    // We only allow access to Location.replace() cross origin.
+    // Make it read-only / non-configurable to prevent writes via defineProperty.
     if (propertyName == exec->propertyNames().replace) {
         slot.setCustom(this, ReadOnly | DontDelete | DontEnum, nonCachingStaticFunctionGetter<jsLocationInstanceFunctionReplace, 1>);
         return true;
     }
-    if (propertyName == exec->propertyNames().reload) {
-        slot.setCustom(this, ReadOnly | DontDelete | DontEnum, nonCachingStaticFunctionGetter<jsLocationInstanceFunctionReload, 0>);
-        return true;
-    }
-    if (propertyName == exec->propertyNames().assign) {
-        slot.setCustom(this, ReadOnly | DontDelete | DontEnum, nonCachingStaticFunctionGetter<jsLocationInstanceFunctionAssign, 1>);
-        return true;
-    }
-
-    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
-    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
-    // such cases when normally the string form of Location would be the URL.
 
     printErrorMessageForFrame(frame, message);