Changeset 19952 in webkit


Ignore:
Timestamp:
Mar 2, 2007, 6:18:43 PM (18 years ago)
Author:
kmccullo
Message:

LayoutTests:

Reviewed by Geoff.

  • rdar://problem/4922454
  • This fixes a security issue by making remote referrers not able to access local resources, unless they register their schemes to be treated as local. The result is that those schemes can access local resources and cannot be accessed by remote referrers. Because this behavior is new a link-on-or-after check is made to determine if the app should use the older, less safe, behavior.
  • fast/loader/local-CSS-from-local-expected.txt: Added.
  • fast/loader/local-CSS-from-local.html: Added.
  • fast/loader/local-JavaScript-from-local-expected.txt: Added.
  • fast/loader/local-JavaScript-from-local.html: Added.
  • fast/loader/local-iFrame-source-from-local-expected.txt: Added.
  • fast/loader/local-iFrame-source-from-local.html: Added.
  • fast/loader/local-image-from-local-expected.txt: Added.
  • fast/loader/local-image-from-local.html: Added.
  • http/tests/security/local-CSS-from-remote-expected.txt: Added.
  • http/tests/security/local-CSS-from-remote.html: Added.
  • http/tests/security/local-JavaScript-from-remote-expected.txt: Added.
  • http/tests/security/local-JavaScript-from-remote.html: Added.
  • http/tests/security/local-iFrame-from-remote-expected.txt: Added.
  • http/tests/security/local-iFrame-from-remote.html: Added.
  • http/tests/security/local-image-from-remote-expected.txt: Added.
  • http/tests/security/local-image-from-remote.html: Added.
  • http/tests/security/resources/compass.jpg: Added.
  • http/tests/security/resources/cssStyle.css: Added.
  • http/tests/security/resources/localPage.html: Added.
  • http/tests/security/resources/localScript.js: Added.

WebCore:

Reviewed by Geoff.

  • rdar://problem/4922454
  • This fixes a security issue by making remote referrers not able to access local resources, unless they register their schemes to be treated as local. The result is that those schemes can access local resources and cannot be accessed by remote referrers. Because this behavior is new a link-on-or-after check is made to determine if the app should use the older, less safe, behavior.
  • WebCore.exp: added exported functions
  • bindings/objc/DOM.mm: consolodated function to base class (-[DOMElement image]): (-[DOMElement _imageTIFFRepresentation]):
  • dom/Document.cpp: Cache the document's ability to load local resources. (WebCore::Document::Document): (WebCore::Document::setURL): (WebCore::Document::shouldBeAllowedToLoadLocalResources): (WebCore::Document::stylesheetLoaded):
  • dom/Document.h: Cache the docuent's ability to load local resources. (WebCore::Document::getPendingSheet): (WebCore::Document::isAllowedToLoadLocalResources):
  • html/HTMLImageLoader.cpp: Moved functionality into base class. (WebCore::HTMLImageLoader::updateFromElement): (WebCore::HTMLImageLoader::dispatchLoadEvent):
  • html/HTMLLinkElement.cpp: Handles null returns correctly now.
  • html/HTMLTokenizer.cpp: Moved functionality into base class. (WebCore::HTMLTokenizer::notifyFinished):
  • ksvg2/misc/SVGImageLoader.cpp: Moved functionality into base class. (WebCore::SVGImageLoader::dispatchLoadEvent):
  • loader/Cache.cpp: Checks if the cached resource can be loaded. (WebCore::Cache::requestResource):
  • loader/CachedCSSStyleSheet.cpp: Moved functionality into base class. (WebCore::CachedCSSStyleSheet::ref): (WebCore::CachedCSSStyleSheet::error):
  • loader/CachedImage.cpp: Moved functionality into base class. (WebCore::CachedImage::CachedImage):
  • loader/CachedImage.h: Moved functionality into base class. (WebCore::CachedImage::canRender):
  • loader/CachedResource.cpp: Cache if the CachedResource should be treated as local (WebCore::CachedResource::CachedResource):
  • loader/CachedResource.h: Moved functionality into base class. (WebCore::CachedResource::errorOccurred): (WebCore::CachedResource::shouldTreatAsLocal):
  • loader/CachedScript.cpp: Moved functionality into base class. (WebCore::CachedScript::CachedScript):
  • loader/CachedScript.h: Moved functionality into base class. (WebCore::CachedScript::schedule):
  • loader/CachedXBLDocument.cpp: Moved functionality into base class. (WebCore::CachedXBLDocument::error):
  • loader/CachedXSLStyleSheet.cpp: Moved functionality into base class. (WebCore::CachedXSLStyleSheet::error):
  • loader/FrameLoader.cpp: See comments for each function below. (WebCore::FrameLoader::loadSubframe): Use new canLoad. (WebCore::FrameLoader::restrictAccessToLocal): return value of linked-on-or-after check. (WebCore::FrameLoader::setRestrictAccessToLocal): set value for linked-on-or-after check. (WebCore::localSchemes): Return set of schemes that are to be treated as local. (WebCore::FrameLoader::loadPlugin): Use new canLoad. (WebCore::FrameLoader::canLoad): Now multiple functions that each do the same work but some can take advantage of the cached values, if they were computed previously. (WebCore::FrameLoader::shouldHideReferrer): Extracted out the logic to determine if the referrer should be hidden so it is only calculated when needed. (WebCore::FrameLoader::loadResourceSynchronously): No longer calls canLoad to get hideReferrer info. (WebCore::FrameLoader::registerSchemeAsLocal): Functionality to register a scheme to be treated as local. (WebCore::FrameLoader::treatURLAsLocal): Given a URL this function determines if it should be treated as local.
  • loader/FrameLoader.h: Declared functions for this security fix. See above.
  • loader/MainResourceLoader.cpp: Optized order of bools to regain performance. (WebCore::MainResourceLoader::continueAfterContentPolicy):
  • loader/SubresourceLoader.cpp: Now restricts remote from loading local resources. (WebCore::SubresourceLoader::create):
  • page/EventHandler.cpp: Moved functionality into base class. (WebCore::selectCursor):
  • platform/KURL.cpp: KURLs need to check all the registered schemes now. (WebCore::KURL::isLocalFile):
  • rendering/HitTestResult.cpp: Moved functionality into base class. (WebCore::HitTestResult::image):
  • rendering/RenderImage.cpp: Moved functionality into base class. (WebCore::RenderImage::setCachedImage): (WebCore::RenderImage::imageChanged): (WebCore::RenderImage::paint): (WebCore::RenderImage::layout): (WebCore::RenderImage::calcAspectRatioWidth): (WebCore::RenderImage::calcAspectRatioHeight):
  • rendering/RenderImage.h: Moved functionality into base class. (WebCore::RenderImage::errorOccurred):
  • rendering/RenderListItem.cpp: Moved functionality into base class. (WebCore::RenderListItem::setStyle):
  • rendering/RenderListMarker.cpp: Moved functionality into base class. (WebCore::RenderListMarker::isImage):
  • xml/xmlhttprequest.cpp: Check doc's cached value instead of determining independently. (WebCore::XMLHttpRequest::urlMatchesDocumentDomain):

WebKit:

Reviewed by Geoff.

  • rdar://problem/4922454
  • This fixes a security issue by making remote referrers not able to access local resources, unless they register their schemes to be treated as local. The result is that those schemes can access local resources and cannot be accessed by remote referrers. Because this behavior is new a link-on-or-after check is made to determine if the app should use the older, less safe, behavior.
  • Misc/WebKitVersionChecks.h: added linked-on-or-after check
  • Misc/WebNSAttributedStringExtras.mm: Moved functionalit into the base class. (fileWrapperForElement):
  • Plugins/WebNetscapePluginStream.mm: uses new canLoad functions
  • Plugins/WebPluginContainerCheck.mm: uses new canLoad functions (-[WebPluginContainerCheck _isForbiddenFileLoad]):
  • WebView/WebView.mm: make linked-on-or-after check and cache value, exposes SPI for registering a scheme as local. (-[WebView _commonInitializationWithFrameName:groupName:]): (+[WebView registerSchemeAsLocal:]):
  • WebView/WebViewPrivate.h: exposes SPI for registering a scheme as local.
Location:
trunk
Files:
20 added
39 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r19951 r19952  
     12007-03-02  Kevin McCullough  <kmccullough@apple.com>
     2
     3        Reviewed by Geoff.
     4
     5        - rdar://problem/4922454
     6        - This fixes a security issue by making remote referrers not able to access local
     7        resources, unless they register their schemes to be treated as local. The result is
     8        that those schemes can access local resources and cannot be accessed by remote
     9        referrers.
     10        Because this behavior is new a link-on-or-after check is made to determine if the
     11        app should use the older, less safe, behavior.
     12
     13        * fast/loader/local-CSS-from-local-expected.txt: Added.
     14        * fast/loader/local-CSS-from-local.html: Added.
     15        * fast/loader/local-JavaScript-from-local-expected.txt: Added.
     16        * fast/loader/local-JavaScript-from-local.html: Added.
     17        * fast/loader/local-iFrame-source-from-local-expected.txt: Added.
     18        * fast/loader/local-iFrame-source-from-local.html: Added.
     19        * fast/loader/local-image-from-local-expected.txt: Added.
     20        * fast/loader/local-image-from-local.html: Added.
     21        * http/tests/security/local-CSS-from-remote-expected.txt: Added.
     22        * http/tests/security/local-CSS-from-remote.html: Added.
     23        * http/tests/security/local-JavaScript-from-remote-expected.txt: Added.
     24        * http/tests/security/local-JavaScript-from-remote.html: Added.
     25        * http/tests/security/local-iFrame-from-remote-expected.txt: Added.
     26        * http/tests/security/local-iFrame-from-remote.html: Added.
     27        * http/tests/security/local-image-from-remote-expected.txt: Added.
     28        * http/tests/security/local-image-from-remote.html: Added.
     29        * http/tests/security/resources/compass.jpg: Added.
     30        * http/tests/security/resources/cssStyle.css: Added.
     31        * http/tests/security/resources/localPage.html: Added.
     32        * http/tests/security/resources/localScript.js: Added.
     33
    1342007-03-02  Justin Garcia  <justin.garcia@apple.com>
    235

  • trunk/WebCore/ChangeLog

    r19951 r19952  
     12007-03-02  Kevin McCullough  <kmccullough@apple.com>
     2
     3        Reviewed by Geoff.
     4
     5        - rdar://problem/4922454
     6        - This fixes a security issue by making remote referrers not able to access local
     7        resources, unless they register their schemes to be treated as local. The result is
     8        that those schemes can access local resources and cannot be accessed by remote
     9        referrers.
     10        Because this behavior is new a link-on-or-after check is made to determine if the
     11        app should use the older, less safe, behavior.
     12
     13        * WebCore.exp: added exported functions
     14        * bindings/objc/DOM.mm: consolodated function to base class
     15        (-[DOMElement image]):
     16        (-[DOMElement _imageTIFFRepresentation]):
     17        * dom/Document.cpp: Cache the document's ability to load local resources.
     18        (WebCore::Document::Document):
     19        (WebCore::Document::setURL):
     20        (WebCore::Document::shouldBeAllowedToLoadLocalResources):
     21        (WebCore::Document::stylesheetLoaded):
     22        * dom/Document.h: Cache the docuent's ability to load local resources.
     23        (WebCore::Document::getPendingSheet):
     24        (WebCore::Document::isAllowedToLoadLocalResources):
     25        * html/HTMLImageLoader.cpp: Moved functionality into base class.
     26        (WebCore::HTMLImageLoader::updateFromElement):
     27        (WebCore::HTMLImageLoader::dispatchLoadEvent):
     28        * html/HTMLLinkElement.cpp: Handles null returns correctly now.
     29        * html/HTMLTokenizer.cpp: Moved functionality into base class.
     30        (WebCore::HTMLTokenizer::notifyFinished):
     31        * ksvg2/misc/SVGImageLoader.cpp: Moved functionality into base class.
     32        (WebCore::SVGImageLoader::dispatchLoadEvent):
     33        * loader/Cache.cpp: Checks if the cached resource can be loaded.
     34        (WebCore::Cache::requestResource):
     35        * loader/CachedCSSStyleSheet.cpp: Moved functionality into base class.
     36        (WebCore::CachedCSSStyleSheet::ref):
     37        (WebCore::CachedCSSStyleSheet::error):
     38        * loader/CachedImage.cpp: Moved functionality into base class.
     39        (WebCore::CachedImage::CachedImage):
     40        * loader/CachedImage.h: Moved functionality into base class.
     41        (WebCore::CachedImage::canRender):
     42        * loader/CachedResource.cpp: Cache if the CachedResource should be treated as local
     43        (WebCore::CachedResource::CachedResource):
     44        * loader/CachedResource.h: Moved functionality into base class.
     45        (WebCore::CachedResource::errorOccurred):
     46        (WebCore::CachedResource::shouldTreatAsLocal):
     47        * loader/CachedScript.cpp: Moved functionality into base class.
     48        (WebCore::CachedScript::CachedScript):
     49        * loader/CachedScript.h: Moved functionality into base class.
     50        (WebCore::CachedScript::schedule):
     51        * loader/CachedXBLDocument.cpp: Moved functionality into base class.
     52        (WebCore::CachedXBLDocument::error):
     53        * loader/CachedXSLStyleSheet.cpp: Moved functionality into base class.
     54        (WebCore::CachedXSLStyleSheet::error):
     55        * loader/FrameLoader.cpp: See comments for each function below.
     56        (WebCore::FrameLoader::loadSubframe): Use new canLoad.
     57        (WebCore::FrameLoader::restrictAccessToLocal): return value of linked-on-or-after check.
     58        (WebCore::FrameLoader::setRestrictAccessToLocal): set value for linked-on-or-after check.
     59        (WebCore::localSchemes): Return set of schemes that are to be treated as local.
     60        (WebCore::FrameLoader::loadPlugin): Use new canLoad.
     61        (WebCore::FrameLoader::canLoad): Now multiple functions that each do the same work but some can take advantage of the cached values, if they were computed previously.
     62        (WebCore::FrameLoader::shouldHideReferrer): Extracted out the logic to determine if the referrer should be hidden so it is only calculated when needed.
     63        (WebCore::FrameLoader::loadResourceSynchronously): No longer calls canLoad to get hideReferrer info.
     64        (WebCore::FrameLoader::registerSchemeAsLocal): Functionality to register a scheme to be treated as local.
     65        (WebCore::FrameLoader::treatURLAsLocal): Given a URL this function determines if it should be treated as local.
     66        * loader/FrameLoader.h: Declared functions for this security fix.  See above.
     67        * loader/MainResourceLoader.cpp: Optized order of bools to regain performance.
     68        (WebCore::MainResourceLoader::continueAfterContentPolicy):
     69        * loader/SubresourceLoader.cpp: Now restricts remote from loading local resources.
     70        (WebCore::SubresourceLoader::create):
     71        * page/EventHandler.cpp: Moved functionality into base class.
     72        (WebCore::selectCursor):
     73        * platform/KURL.cpp: KURLs need to check all the registered schemes now.
     74        (WebCore::KURL::isLocalFile):
     75        * rendering/HitTestResult.cpp: Moved functionality into base class.
     76        (WebCore::HitTestResult::image):
     77        * rendering/RenderImage.cpp: Moved functionality into base class.
     78        (WebCore::RenderImage::setCachedImage):
     79        (WebCore::RenderImage::imageChanged):
     80        (WebCore::RenderImage::paint):
     81        (WebCore::RenderImage::layout):
     82        (WebCore::RenderImage::calcAspectRatioWidth):
     83        (WebCore::RenderImage::calcAspectRatioHeight):
     84        * rendering/RenderImage.h: Moved functionality into base class.
     85        (WebCore::RenderImage::errorOccurred):
     86        * rendering/RenderListItem.cpp: Moved functionality into base class.
     87        (WebCore::RenderListItem::setStyle):
     88        * rendering/RenderListMarker.cpp: Moved functionality into base class.
     89        (WebCore::RenderListMarker::isImage):
     90        * xml/xmlhttprequest.cpp: Check doc's cached value instead of determining independently.
     91        (WebCore::XMLHttpRequest::urlMatchesDocumentDomain):
     92
    1932007-03-02  Justin Garcia  <justin.garcia@apple.com>
    294

  • trunk/WebCore/WebCore.exp

    r19921 r19952  
    146146__ZN7WebCore11FrameLoader16detachFromParentEv
    147147__ZN7WebCore11FrameLoader18currentHistoryItemEv
     148__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
    148149__ZN7WebCore11FrameLoader20continueLoadWithDataEPNS_12SharedBufferERKNS_6StringES5_RKNS_4KURLE
    149150__ZN7WebCore11FrameLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
     151__ZN7WebCore11FrameLoader21registerSchemeAsLocalERKNS_6StringE
    150152__ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
    151153__ZN7WebCore11FrameLoader22setPreviousHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
    … …  
    153155__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
    154156__ZN7WebCore11FrameLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
     157__ZN7WebCore11FrameLoader24setRestrictAccessToLocalEb
    155158__ZN7WebCore11FrameLoader25provisionalDocumentLoaderEv
    156159__ZN7WebCore11FrameLoader25setProvisionalHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
    … …  
    167170__ZN7WebCore11FrameLoader5clearEb
    168171__ZN7WebCore11FrameLoader6reloadEv
    169 __ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringERb
     172__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLEPKNS_8DocumentE
    170173__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
    171174__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE

  • trunk/WebCore/bindings/objc/DOM.mm

    r19855 r19952  
    492492    if (renderer && renderer->isImage()) {
    493493        WebCore::RenderImage* img = static_cast<WebCore::RenderImage*>(renderer);
    494         if (img->cachedImage() && !img->cachedImage()->isErrorImage())
     494        if (img->cachedImage() && !img->cachedImage()->errorOccurred())
    495495            return img->cachedImage()->image()->getNSImage();
    496496    }
    … …  
    517517    if (renderer && renderer->isImage()) {
    518518        WebCore::RenderImage* img = static_cast<WebCore::RenderImage*>(renderer);
    519         if (img->cachedImage() && !img->cachedImage()->isErrorImage())
     519        if (img->cachedImage() && !img->cachedImage()->errorOccurred())
    520520            return (NSData*)(img->cachedImage()->image()->getTIFFRepresentation());
    521521    }

  • trunk/WebCore/dom/Document.cpp

    r19934 r19952  
    300300    , m_createRenderers(true)
    301301    , m_inPageCache(false)
     302    , m_isAllowedToLoadLocalResources(false)
    302303{
    303304    m_document.resetSkippingRef(this);
    … …  
    12521253        setBaseURL(parent->baseURL());
    12531254    }
    1254     else
    1255         setURL(m_url);
    12561255
    12571256    if ((frame() && frame()->loader()->isLoadingMainResource()) || (tokenizer() && tokenizer()->executingScript()))
    … …  
    15131512void Document::setURL(const DeprecatedString& url)
    15141513{
     1514    if (url == m_url)
     1515        return;
     1516
    15151517    m_url = url;
    15161518    if (m_styleSelector)
    15171519        m_styleSelector->setEncodedURL(m_url);
     1520
     1521    m_isAllowedToLoadLocalResources = shouldBeAllowedToLoadLocalResources();
     1522 }
     1523 
     1524bool Document::shouldBeAllowedToLoadLocalResources() const
     1525{
     1526    if (FrameLoader::shouldTreatURLAsLocal(m_url))
     1527        return true;
     1528
     1529    Frame* frame = this->frame();
     1530    if (!frame)
     1531        return false;
     1532   
     1533    DocumentLoader* documentLoader = frame->loader()->documentLoader();
     1534    if (!documentLoader)
     1535        return false;
     1536   
     1537    return documentLoader->substituteData().isValid();
    15181538}
    15191539
    … …  
    18811901#endif
    18821902
    1883     updateStyleSelector();   
     1903    updateStyleSelector();
    18841904}
    18851905

  • trunk/WebCore/dom/Document.h

    r19855 r19952  
    619619    String iconURL();
    620620    void setIconURL(const String& iconURL, const String& type);
     621
     622    bool isAllowedToLoadLocalResources() const { return m_isAllowedToLoadLocalResources; }
     623
    621624protected:
    622625    CSSStyleSelector* m_styleSelector;
    … …  
    629632    DeprecatedString m_baseURL;
    630633    String m_baseTarget;
    631    
     634
    632635    RefPtr<DocumentType> m_docType;
    633636    RefPtr<DOMImplementation> m_implementation;
    … …  
    784787
    785788private:
     789    bool shouldBeAllowedToLoadLocalResources() const;
     790
    786791    void updateTitle();
    787792    void removeAllDisconnectedNodeEventListeners();
    … …  
    831836    bool m_inPageCache;
    832837    String m_iconURL;
     838
     839    bool m_isAllowedToLoadLocalResources;
    833840};
    834841

  • trunk/WebCore/html/HTMLImageLoader.cpp

    r19590 r19952  
    124124    if (!haveFiredLoadEvent() && image()) {
    125125        setHaveFiredLoadEvent(true);
    126         element()->dispatchHTMLEvent(image()->isErrorImage() ? errorEvent : loadEvent, false, false);
     126        element()->dispatchHTMLEvent(image()->errorOccurred() ? errorEvent : loadEvent, false, false);
    127127    }
    128128}

  • trunk/WebCore/html/HTMLLinkElement.cpp

    r18233 r19952  
    180180            if (!isAlternate())
    181181                document()->addPendingSheet();
    182            
     182
    183183            String chset = getAttribute(charsetAttr);
    184184            if (chset.isEmpty() && document()->frame())
    … …  
    195195            if (m_cachedSheet)
    196196                m_cachedSheet->ref(this);
     197            else if (!isAlternate()) { // request may have been denied if stylesheet is local and document is remote.
     198                m_loading = false;
     199                document()->stylesheetLoaded();
     200            }
    197201        }
    198202    } else if (m_sheet) {

  • trunk/WebCore/ksvg2/misc/SVGImageLoader.cpp

    r19855 r19952  
    7171    if (!haveFiredLoadEvent() && image()) {
    7272        setHaveFiredLoadEvent(true);
    73         if (image()->isErrorImage()) {
     73        if (image()->errorOccurred()) {
    7474            // FIXME: We're supposed to put the document in an "error state" per the spec.
    7575        } else

  • trunk/WebCore/loader/Cache.cpp

    r19855 r19952  
    3535#include "DocLoader.h"
    3636#include "Document.h"
     37#include "FrameLoader.h"
    3738#include "Image.h"
    3839#include "ResourceHandle.h"
    … …  
    8889    CachedResource* resource = m_resources.get(url.url());
    8990
    90     if (!resource) {
     91    if (resource) {
     92        if (FrameLoader::restrictAccessToLocal()
     93         && !FrameLoader::canLoad(*resource, docLoader->doc()))
     94            return 0;
     95    } else {
     96        if (FrameLoader::restrictAccessToLocal()
     97         && !FrameLoader::canLoad(url, docLoader->doc()))
     98            return 0;
     99
    91100        // The resource does not exist.  Create it.
    92101        resource = createResource(type, docLoader, url, expireDate, charset);

  • trunk/WebCore/loader/CachedCSSStyleSheet.cpp

    r18969 r19952  
    6060
    6161    if (!m_loading)
    62         c->setCSSStyleSheet(m_url, m_decoder->encoding().name(), m_sheet);
     62        c->setCSSStyleSheet(m_url, m_decoder->encoding().name(), errorOccurred() ? "" : m_sheet);
    6363}
    6464
    … …  
    9393{
    9494    m_loading = false;
     95    m_errorOccurred = true;
    9596    checkNotify();
    9697}

  • trunk/WebCore/loader/CachedImage.cpp

    r19855 r19952  
    5757{
    5858    m_image = 0;
    59     m_errorOccurred = false;
    6059    m_status = Unknown;
    6160    if (!docLoader || docLoader->autoLoadImages())  {
    … …  
    7170{
    7271    m_image = image;
    73     m_errorOccurred = false;
    7472    m_status = Cached;
    7573    m_loading = false;

  • trunk/WebCore/loader/CachedImage.h

    r19590 r19952  
    4848    Image* image() const;
    4949
    50     bool canRender() const { return !isErrorImage() && imageSize().width() > 0 && imageSize().height() > 0; }
     50    bool canRender() const { return !errorOccurred() && imageSize().width() > 0 && imageSize().height() > 0; }
    5151
    5252    IntSize imageSize() const;  // returns the size of the complete image
    … …  
    5858    virtual void data(Vector<char>&, bool allDataReceived);
    5959    virtual void error();
    60 
    61     bool isErrorImage() const { return m_errorOccurred; }
    6260
    6361    virtual bool schedule() const { return true; }
    … …  
    8179    Image* m_image;
    8280    int m_dataSize;
    83    
    84     bool m_errorOccurred : 1;
    8581
    8682    friend class Cache;

  • trunk/WebCore/loader/CachedResource.cpp

    r19218 r19952  
    3131
    3232#include "Cache.h"
     33#include "FrameLoader.h"
    3334#include "Request.h"
    3435#include <KURL.h>
    … …  
    5556    m_lruIndex = 0;
    5657#endif
     58    m_errorOccurred = false;
     59    m_shouldTreatAsLocal = FrameLoader::shouldTreatURLAsLocal(m_url);
    5760}
    5861

  • trunk/WebCore/loader/CachedResource.h

    r19855 r19952  
    128128    void setAccept(const String& accept) { m_accept = accept; }
    129129
     130    bool errorOccurred() const { return m_errorOccurred; }
     131    bool treatAsLocal() const { return m_shouldTreatAsLocal; }
     132
    130133protected:
    131134    void setSize(unsigned size);
    … …  
    142145    Type m_type;
    143146    Status m_status;
     147
     148    bool m_errorOccurred;
    144149
    145150private:
    … …  
    161166    CachedResource* m_prevInLRUList;
    162167    friend class Cache;
     168   
     169    bool m_shouldTreatAsLocal;
    163170};
    164171

  • trunk/WebCore/loader/CachedScript.cpp

    r17133 r19952  
    4646    // and refuse to serve them if we only accept application/x-javascript.
    4747    setAccept("*/*");
    48     m_errorOccurred = false;
    4948    // load the file
    5049    cache()->loader()->load(dl, this, false);

  • trunk/WebCore/loader/CachedScript.h

    r19590 r19952  
    5050
    5151        virtual bool schedule() const { return false; }
    52        
    53         bool errorOccurred() const { return m_errorOccurred; }
    5452
    5553        void checkNotify();
    … …  
    5856        String m_script;
    5957        TextEncoding m_encoding;
    60         bool m_errorOccurred;
    6158    };
    6259}

  • trunk/WebCore/loader/CachedXBLDocument.cpp

    r19855 r19952  
    104104{
    105105    m_loading = false;
     106    m_errorOccurred = true;
    106107    checkNotify();
    107108}

  • trunk/WebCore/loader/CachedXSLStyleSheet.cpp

    r19855 r19952  
    9393{
    9494    m_loading = false;
     95    m_errorOccurred = true;
    9596    checkNotify();
    9697}

  • trunk/WebCore/loader/FrameLoader.cpp

    r19940 r19952  
    8383#include <kjs/object.h>
    8484
    85 using namespace KJS;
     85using KJS::UString;
     86using KJS::JSLock;
     87using KJS::JSValue;
    8688
    8789namespace WebCore {
    … …  
    156158
    157159static double storedTimeOfLastCompletedLoad;
     160static bool m_restrictAccessToLocal = false;
    158161
    159162static bool getString(JSValue* result, String& string)
    … …  
    953956}
    954957
     958bool FrameLoader::restrictAccessToLocal()
     959{
     960    return m_restrictAccessToLocal;
     961}
     962
     963void FrameLoader::setRestrictAccessToLocal(bool access)
     964{
     965    m_restrictAccessToLocal = access;
     966}
     967
     968static HashSet<String, CaseInsensitiveHash<String> >& localSchemes()
     969{
     970    static HashSet<String, CaseInsensitiveHash<String> > localSchemes;
     971
     972    if (localSchemes.isEmpty()) {
     973        localSchemes.add("file");
     974        localSchemes.add("applewebdata");
     975    }
     976
     977    return localSchemes;
     978}
     979
    955980void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
    956981{
    … …  
    13481373            pluginElement = static_cast<Element*>(renderer->node());
    13491374
    1350         bool hideReferrer;
    1351         if (!canLoad(url, outgoingReferrer(), hideReferrer))
     1375        if (!canLoad(url, frame()->document()))
    13521376            return false;
    13531377
    … …  
    18641888bool FrameLoader::canLoad(const KURL& url, const String& referrer, bool& hideReferrer)
    18651889{
    1866     bool referrerIsWebURL = referrer.startsWith("http:", false) || referrer.startsWith("https:", false);
    1867     bool referrerIsLocalURL = referrer.startsWith("file:", false) || referrer.startsWith("applewebdata:");
    1868     bool URLIsFileURL = url.protocol().startsWith("file", false);
     1890    hideReferrer = shouldHideReferrer(url, referrer);
     1891
     1892    if (!shouldTreatURLAsLocal(url.url()))
     1893        return true;
     1894
     1895    return shouldTreatURLAsLocal(referrer);
     1896}
     1897
     1898bool FrameLoader::canLoad(const KURL& url, const Document* doc)
     1899{
     1900    if (!shouldTreatURLAsLocal(url.url()))
     1901        return true;
     1902
     1903    return doc && doc->isAllowedToLoadLocalResources();
     1904}
     1905
     1906bool FrameLoader::canLoad(const CachedResource& resource, const Document* doc)
     1907{
     1908    if (!resource.treatAsLocal())
     1909        return true;
     1910
     1911    return doc && doc->isAllowedToLoadLocalResources();
     1912}
     1913
     1914bool FrameLoader::shouldHideReferrer(const KURL& url, const String& referrer)
     1915{
    18691916    bool referrerIsSecureURL = referrer.startsWith("https:", false);
    1870     bool URLIsSecureURL = url.protocol().startsWith("https", false);
    1871    
    1872     hideReferrer = !referrerIsWebURL || (referrerIsSecureURL && !URLIsSecureURL);
    1873     return !URLIsFileURL || referrerIsLocalURL;
     1917    bool referrerIsWebURL = referrerIsSecureURL || referrer.startsWith("http:", false);
     1918
     1919    if (!referrerIsWebURL)
     1920        return true;
     1921
     1922    if (!referrerIsSecureURL)
     1923        return false;
     1924
     1925    bool URLIsSecureURL = url.url().startsWith("https:", false);
     1926
     1927    return !URLIsSecureURL;
    18741928}
    18751929
    … …  
    29262980    // But we still want to know whether we should hide the referrer or not, so we call the canLoad method.
    29272981    String referrer = m_outgoingReferrer;
    2928     bool hideReferrer;
    2929     canLoad(request.url(), referrer, hideReferrer);
    2930     if (hideReferrer)
     2982    if (shouldHideReferrer(request.url(), referrer))
    29312983        referrer = String();
    29322984   
    … …  
    42474299}
    42484300
     4301void FrameLoader::registerSchemeAsLocal(const String& scheme)
     4302{
     4303    localSchemes().add(scheme);
     4304}
     4305
     4306bool FrameLoader::shouldTreatURLAsLocal(const String& url)
     4307{
     4308    // This avoids an allocation of another String and the HashSet containts()
     4309    // call for the file: and http: schemes.
     4310    if (url.length() >= 5) {
     4311        const UChar* s = url.characters();
     4312        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p' && s[4] == ':')
     4313            return false;
     4314        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e' && s[4] == ':')
     4315            return true;
     4316    }
     4317
     4318    int loc = url.find(':');
     4319    if (loc == -1)
     4320        return false;
     4321
     4322    String scheme = url.left(loc);
     4323    return localSchemes().contains(scheme);
     4324}
     4325
    42494326} // namespace WebCore

  • trunk/WebCore/loader/FrameLoader.h

    r19940 r19952  
    3030#define FrameLoader_h
    3131
     32#include "CachedResource.h"
    3233#include "CachePolicy.h"
    3334#include "FormState.h"
    … …  
    5152
    5253    class AuthenticationChallenge;
     54    class Document;
    5355    class DocumentLoader;
    5456    class Element;
    … …  
    149151        void load(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>);
    150152
    151         bool canLoad(const KURL&, const String& referrer, bool& hideReferrer);
     153        static bool canLoad(const KURL&, const String& referrer, bool& hideReferrer);
     154        static bool canLoad(const KURL&, const Document*);
     155        static bool canLoad(const CachedResource&, const Document*);
     156
     157        static bool shouldHideReferrer(const KURL& url, const String& referrer);
    152158
    153159        Frame* createWindow(const FrameLoadRequest&, const WindowFeatures&);
    … …  
    391397        bool shouldGoToHistoryItem(HistoryItem*) const;
    392398        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
    393        
     399
    394400        void commitProvisionalLoad(PassRefPtr<PageCache>);
    395401
    … …  
    406412        void setPreviousHistoryItem(PassRefPtr<HistoryItem>);
    407413        void setProvisionalHistoryItem(PassRefPtr<HistoryItem>);
    408        
     414
    409415        void continueLoadWithData(SharedBuffer*, const String& mimeType, const String& textEncoding, const KURL&);
     416
     417        static void registerSchemeAsLocal(const String& scheme);
     418        static bool restrictAccessToLocal();
     419        static void setRestrictAccessToLocal(bool);
     420        static bool shouldTreatURLAsLocal(const String& url);
     421
    410422    private:       
    411423        PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);

  • trunk/WebCore/loader/MainResourceLoader.cpp

    r19902 r19952  
    182182    case PolicyUse: {
    183183        // Prevent remote web archives from loading because they can claim to be from any domain and thus avoid cross-domain security checks (4120255).
    184         bool isRemote = !url.isLocalFile();
    185         isRemote = isRemote && !m_substituteData.isValid();
    186         bool isRemoteWebArchive = isRemote && equalIgnoringCase("application/x-webarchive", mimeType);
     184        bool isRemoteWebArchive = equalIgnoringCase("application/x-webarchive", mimeType) && !m_substituteData.isValid() && !url.isLocalFile();
    187185        if (!frameLoader()->canShowMIMEType(mimeType) || isRemoteWebArchive) {
    188186            frameLoader()->cannotShowMIMEType(r);

  • trunk/WebCore/loader/SubresourceLoader.cpp

    r19553 r19952  
    9292
    9393    ResourceRequest newRequest = request;
    94    
    95     // Since this is a subresource, we can load any URL (we ignore the return value).
    96     // But we still want to know whether we should hide the referrer or not, so we call the canLoadURL method.
    97     // FIXME: is that really the rule we want for subresources?
    98     bool hideReferrer;
    99     fl->canLoad(request.url(), fl->outgoingReferrer(), hideReferrer);
    100     if (hideReferrer)
     94
     95    // If linked-on-or-after check canLoad
     96    if (FrameLoader::restrictAccessToLocal()
     97    && !FrameLoader::canLoad(request.url(), frame->document()))
     98        return 0;
     99   
     100    if (FrameLoader::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
    101101        newRequest.clearHTTPReferrer();
    102102    else if (!request.httpReferrer())

  • trunk/WebCore/page/DragController.cpp

    r19808 r19952  
    478478   
    479479    RenderImage* image = static_cast<RenderImage*>(renderer);
    480     if (image->cachedImage() && !image->cachedImage()->isErrorImage())
     480    if (image->cachedImage() && !image->cachedImage()->errorOccurred())
    481481        return image->cachedImage()->image();
    482482    return 0;

  • trunk/WebCore/page/EventHandler.cpp

    r19940 r19952  
    646646            if (cimage->image()->isNull())
    647647                break;
    648             if (!cimage->isErrorImage()) {
     648            if (!cimage->errorOccurred())
    649649                return Cursor(cimage->image(), hotSpot);
    650 }
    651650        }
    652651    }

  • trunk/WebCore/platform/KURL.cpp

    r19159 r19952  
    793793bool KURL::isLocalFile() const
    794794{
    795     // FIXME - include feed: here too?
     795    // Including feed here might be a bad idea since drag and drop uses this check
     796    // and including feed would allow feeds to potentially let someone's blog
     797    // read the contents of the clipboard on a drag, even without a drop.
     798    // Likewise with using the FrameLoader::shouldTreatURLAsLocal() function.
    796799    return protocol() == "file";
    797800}

  • trunk/WebCore/rendering/HitTestResult.cpp

    r19855 r19952  
    198198    if (renderer && renderer->isImage()) {
    199199        RenderImage* image = static_cast<WebCore::RenderImage*>(renderer);
    200         if (image->cachedImage() && !image->cachedImage()->isErrorImage())
     200        if (image->cachedImage() && !image->cachedImage()->errorOccurred())
    201201            return image->cachedImage()->image();
    202202    }

  • trunk/WebCore/rendering/RenderImage.cpp

    r19696 r19952  
    7171    if (m_cachedImage) {
    7272        m_cachedImage->ref(this);
    73         if (m_cachedImage->isErrorImage())
     73        if (m_cachedImage->errorOccurred())
    7474            imageChanged(m_cachedImage);
    7575    }
    … …  
    137137
    138138    // Set image dimensions, taking into account the size of the alt text.
    139     if (newImage->isErrorImage())
     139    if (newImage->errorOccurred())
    140140        imageSizeChanged = setImageSizeForAltText(newImage);
    141141   
    … …  
    144144    // Image dimensions have been changed, see what needs to be done
    145145    if (newImage->imageSize().width() != intrinsicWidth() || newImage->imageSize().height() != intrinsicHeight() || imageSizeChanged) {
    146         if (!newImage->isErrorImage()) {
     146        if (!newImage->errorOccurred()) {
    147147            setIntrinsicWidth(newImage->imageSize().width());
    148148            setIntrinsicHeight(newImage->imageSize().height());
    … …  
    227227        return;
    228228
    229     if (!m_cachedImage || image()->isNull() || isErrorImage()) {
     229    if (!m_cachedImage || image()->isNull() || errorOccurred()) {
    230230        if (paintInfo.phase == PaintPhaseSelection)
    231231            return;
    232232
    233233        if (cWidth > 2 && cHeight > 2) {
    234             if (!isErrorImage()) {
     234            if (!errorOccurred()) {
    235235                context->setStrokeStyle(SolidStroke);
    236236                context->setStrokeColor(Color::lightGray);
    … …  
    245245            int usableHeight = cHeight;
    246246
    247             if (isErrorImage() && !image()->isNull() && (usableWidth >= image()->width()) && (usableHeight >= image()->height())) {
     247            if (errorOccurred() && !image()->isNull() && (usableWidth >= image()->width()) && (usableHeight >= image()->height())) {
    248248                // Center the error image, accounting for border and padding.
    249249                int centerX = (usableWidth - image()->width()) / 2;
    … …  
    311311
    312312    // minimum height
    313     m_height = m_cachedImage && m_cachedImage->isErrorImage() ? intrinsicHeight() : 0;
     313    m_height = m_cachedImage && m_cachedImage->errorOccurred() ? intrinsicHeight() : 0;
    314314
    315315    calcWidth();
    … …  
    416416    if (!intrinsicHeight())
    417417        return 0;
    418     if (!m_cachedImage || m_cachedImage->isErrorImage())
     418    if (!m_cachedImage || m_cachedImage->errorOccurred())
    419419        return intrinsicWidth(); // Don't bother scaling.
    420420    return RenderReplaced::calcReplacedHeight() * intrinsicWidth() / intrinsicHeight();
    … …  
    425425    if (!intrinsicWidth())
    426426        return 0;
    427     if (!m_cachedImage || m_cachedImage->isErrorImage())
     427    if (!m_cachedImage || m_cachedImage->errorOccurred())
    428428        return intrinsicHeight(); // Don't bother scaling.
    429429    return RenderReplaced::calcReplacedWidth() * intrinsicHeight() / intrinsicWidth();

  • trunk/WebCore/rendering/RenderImage.h

    r19590 r19952  
    7979    bool isHeightSpecified() const;
    8080
    81     bool isErrorImage() const { return m_cachedImage && m_cachedImage->isErrorImage(); }
     81    bool errorOccurred() const { return m_cachedImage && m_cachedImage->errorOccurred(); }
    8282
    8383    // The image we are rendering.

  • trunk/WebCore/rendering/RenderListItem.cpp

    r19899 r19952  
    5353
    5454    if (style()->listStyleType() != LNONE ||
    55         (style()->listStyleImage() && !style()->listStyleImage()->isErrorImage())) {
     55        (style()->listStyleImage() && !style()->listStyleImage()->errorOccurred())) {
    5656        RenderStyle* newStyle = new (renderArena()) RenderStyle;
    5757        newStyle->ref();

  • trunk/WebCore/rendering/RenderListMarker.cpp

    r19875 r19952  
    507507bool RenderListMarker::isImage() const
    508508{
    509     return m_image && !m_image->isErrorImage();
     509    return m_image && !m_image->errorOccurred();
    510510}
    511511

  • trunk/WebCore/xml/xmlhttprequest.cpp

    r18863 r19952  
    326326bool XMLHttpRequest::urlMatchesDocumentDomain(const KURL& url) const
    327327{
    328     KURL documentURL(m_doc->URL());
    329 
    330328    // a local file can load anything
    331     if (documentURL.protocol().lower() == "file" || documentURL.protocol().lower() == "applewebdata")
     329    if (m_doc->isAllowedToLoadLocalResources())
    332330        return true;
    333331
    334332    // but a remote document can only load from the same port on the server
     333    KURL documentURL = m_doc->URL();
    335334    if (documentURL.protocol().lower() == url.protocol().lower()
    336335            && documentURL.host().lower() == url.host().lower()

  • trunk/WebKit/ChangeLog

    r19929 r19952  
     12007-03-02  Kevin McCullough  <kmccullough@apple.com>
     2
     3        Reviewed by Geoff.
     4
     5        - rdar://problem/4922454
     6        - This fixes a security issue by making remote referrers not able to access local
     7        resources, unless they register their schemes to be treated as local. The result is
     8        that those schemes can access local resources and cannot be accessed by remote
     9        referrers.
     10        Because this behavior is new a link-on-or-after check is made to determine if the
     11        app should use the older, less safe, behavior.
     12
     13        * Misc/WebKitVersionChecks.h: added linked-on-or-after check
     14        * Misc/WebNSAttributedStringExtras.mm: Moved functionalit into the base class.
     15        (fileWrapperForElement):
     16        * Plugins/WebNetscapePluginStream.mm: uses new canLoad functions
     17        * Plugins/WebPluginContainerCheck.mm: uses new canLoad functions
     18        (-[WebPluginContainerCheck _isForbiddenFileLoad]):
     19        * WebView/WebView.mm: make linked-on-or-after check and cache value, exposes SPI
     20        for registering a scheme as local.
     21        (-[WebView _commonInitializationWithFrameName:groupName:]):
     22        (+[WebView registerSchemeAsLocal:]):
     23        * WebView/WebViewPrivate.h: exposes SPI for registering a scheme as local.
     24
    1252007-03-01  Justin Garcia  <justin.garcia@apple.com>
    226

  • trunk/WebKit/Misc/WebKitVersionChecks.h

    r19704 r19952  
    3636#define WEBKIT_FIRST_VERSION_WITH_3_0_CONTEXT_MENU_TAGS 0x00020000
    3737#define WEBKIT_FIRST_VERSION_WITHOUT_ACROBAT_QUIRK 0x00020000
     38#define WEBKIT_FIRST_VERSION_WITH_LOCAL_RESOURCE_SECURITY_RESTRICTION 0x00020000
    3839#define WEBKIT_FIRST_VERSION_WITHOUT_APERTURE_QUIRK 0x00020000
    3940

  • trunk/WebKit/Misc/WebNSAttributedStringExtras.mm

    r19702 r19952  
    9999    if (!wrapper) {
    100100        RenderImage* renderer = static_cast<RenderImage*>(e->renderer());
    101         if (renderer->cachedImage() && !renderer->cachedImage()->isErrorImage()) {
     101        if (renderer->cachedImage() && !renderer->cachedImage()->errorOccurred()) {
    102102            wrapper = [[NSFileWrapper alloc] initRegularFileWithContents:(NSData *)(renderer->cachedImage()->image()->getTIFFRepresentation())];
    103103            [wrapper setPreferredFilename:@"image.tiff"];

  • trunk/WebKit/Plugins/WebNetscapePluginStream.mm

    r19747 r19952  
    6464    WebBaseNetscapePluginView *view = (WebBaseNetscapePluginView *)thePlugin->ndata;
    6565
    66     bool hideReferrer;
    67     if (!core([view webFrame])->loader()->canLoad([theRequest URL], core([view webFrame])->loader()->outgoingReferrer(), hideReferrer))
     66    if (!core([view webFrame])->loader()->canLoad([theRequest URL], core([view webFrame])->document()))
    6867        return nil;
    6968
    … …  
    7978   
    8079    request = [theRequest mutableCopy];
    81     if (hideReferrer)
     80    if (core([view webFrame])->loader()->shouldHideReferrer([theRequest URL], core([view webFrame])->loader()->outgoingReferrer()))
    8281        [(NSMutableURLRequest *)request _web_setHTTPReferrer:nil];
    8382

  • trunk/WebKit/Plugins/WebPluginContainerCheck.mm

    r19702 r19952  
    9696- (BOOL)_isForbiddenFileLoad
    9797{
    98    bool ignore;
    9998   WebFrameBridge *bridge = [_controller bridge];
    10099   ASSERT(bridge);
    101    if (![bridge _frame]->loader()->canLoad([_request URL], [_controller URLPolicyCheckReferrer], ignore)) {
     100   if (![bridge _frame]->loader()->canLoad([_request URL], [bridge _frame]->document())) {
    102101       [self _continueWithPolicy:PolicyIgnore];
    103102       return YES;

  • trunk/WebKit/WebView/WebView.mm

    r19752 r19952  
    16511651    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesChangedNotification:)
    16521652                                                 name:WebPreferencesChangedNotification object:[self preferences]];
     1653
     1654    if (WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_LOCAL_RESOURCE_SECURITY_RESTRICTION))
     1655        FrameLoader::setRestrictAccessToLocal(true);
    16531656}
    16541657
    … …  
    28172820}
    28182821
     2822+ (void)registerSchemeAsLocal:(NSString *)protocol
     2823{
     2824    FrameLoader::registerSchemeAsLocal(protocol);
     2825}
     2826
    28192827@end
    28202828

  • trunk/WebKit/WebView/WebViewPrivate.h

    r19292 r19952  
    172172- (void)setAllowsUndo:(BOOL)flag;
    173173
     174+ (void)registerSchemeAsLocal:(NSString *)protocol;
     175
    174176@end
    175177
Note: See TracChangeset for help on using the changeset viewer.