Changeset 206233 in webkit

Timestamp:

Sep 21, 2016 1:47:00 PM (8 years ago)

Author:

Chris Dumez

Message:

Fix enumeration of properties cross origin
​https://bugs.webkit.org/show_bug.cgi?id=162328

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline W3C test now that one more check is passing.

• web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt:

Source/WebCore:

All cross origin properties for Window / Location are supposed to be not enumerable:

• ​https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-)

Therefore, there should be no properties to iterate on for cross origin Window /
Location objects.

No new tests, rebaselined existing test.

• bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::getOwnPropertyNames):

• bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertyNames):

Location:

trunk

Files:

• LayoutTests/imported/w3c/ChangeLog (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (modified) (1 diff)
• Source/WebCore/bindings/js/JSLocationCustom.cpp (modified) (1 diff)

trunk/LayoutTests/imported/w3c/ChangeLog

@@ +1 @@
+2016-09-21  Chris Dumez  <cdumez@apple.com>
+
+        Fix enumeration of properties cross origin
+        https://bugs.webkit.org/show_bug.cgi?id=162328
+
+        Reviewed by Darin Adler.
+
+        Rebaseline W3C test now that one more check is passing.
+
+        * web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt:
+
 2016-09-21  Chris Dumez  <cdumez@apple.com>
 

trunk/LayoutTests/imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt

@@ -12 +12 @@
 PASS [[Delete]] Should throw on cross-origin objects 
 PASS [[DefineOwnProperty]] Should throw for cross-origin objects 
-FAIL [[Enumerate]] should return an empty iterator assert_unreached: Shouldn't have been able to enumerate href on cross-origin Location Reached unreachable code
+PASS [[Enumerate]] should return an empty iterator 
 PASS [[OwnPropertyKeys]] should return all properties from cross-origin objects 
 PASS A and B jointly observe the same identity for cross-origin Window and Location 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-09-21  Chris Dumez  <cdumez@apple.com>
+
+        Fix enumeration of properties cross origin
+        https://bugs.webkit.org/show_bug.cgi?id=162328
+
+        Reviewed by Darin Adler.
+
+        All cross origin properties for Window / Location are supposed to be not enumerable:
+        - https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-)
+
+        Therefore, there should be no properties to iterate on for cross origin Window /
+        Location objects.
+
+        No new tests, rebaselined existing test.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+
 2016-09-21  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

@@ -340 +340 @@
     JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(object);
     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), DoNotReportSecurityError)) {
-        addCrossOriginWindowPropertyNames(*exec, propertyNames);
+        if (mode.includeDontEnumProperties())
+            addCrossOriginWindowPropertyNames(*exec, propertyNames);
         return;
     }

trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp

@@ -129 +129 @@
     JSLocation* thisObject = jsCast<JSLocation*>(object);
     if (!BindingSecurity::shouldAllowAccessToFrame(exec, thisObject->wrapped().frame(), DoNotReportSecurityError)) {
-        addCrossOriginLocationPropertyNames(*exec, propertyNames);
+        if (mode.includeDontEnumProperties())
+            addCrossOriginLocationPropertyNames(*exec, propertyNames);
         return;
     }