⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 210531 in webkit


Ignore:
Timestamp:
Jan 9, 2017, 4:32:24 PM (10 years ago)
Author:
Brent Fulgham
Message:

File scheme should not allow access of a resource on a different volume.
​https://bugs.webkit.org/show_bug.cgi?id=158552
<rdar://problem/15307582>

Reviewed by Alex Christensen.

Source/WebCore:

Revise SecurityOrigin to prevent files from one storage device (volume) from accessing content
on a different storage device (volume) unless universal access is enabled.

Pass the current file device as part of the NSURLRequest so that CFNetwork can reject loads
where the device changes in the midst of a load.

Also properly reflect that SecurityOrigin is never null by passing as a reference,
rather than as a pointer.

Tests: Tools/TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.mm

  • page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::canAccess): Pass argument as reference.
(WebCore::SecurityOrigin::passesFileCheck): Add check that file URLs refer to files in
the same storage volume.
(WebCore::SecurityOrigin::canDisplay): Add check that files share the same volume.
(WebCore::SecurityOrigin::isSameSchemeHostPort): Pass argument as reference.

  • page/SecurityOrigin.h:
  • platform/FileSystem.cpp:

(WebCore::filesHaveSameVolume): Added.

  • platform/FileSystem.h:
  • platform/network/cocoa/ResourceRequestCocoa.mm:

(WebCore::ResourceRequest::doUpdatePlatformRequest): If loading a file URL, tell CFNetwork
the storage device at the time of the start of the load so we can trigger a failure if this
changes during the load operation.

  • platform/posix/FileSystemPOSIX.cpp:

(WebCore::getFileDeviceId): Added.

  • platform/win/FileSystemWin.cpp:

(WebCore::getFileDeviceId): Added.

Tools:

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Add new files.
  • TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.html: Added.
  • TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.mm: Added.
Location:
trunk
Files:
2 added
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r210524 r210531  
     12017-01-09  Brent Fulgham  <bfulgham@apple.com>
     2
     3        File scheme should not allow access of a resource on a different volume.
     4        https://bugs.webkit.org/show_bug.cgi?id=158552
     5        <rdar://problem/15307582>
     6
     7        Reviewed by Alex Christensen.
     8
     9        Revise SecurityOrigin to prevent files from one storage device (volume) from accessing content
     10        on a different storage device (volume) unless universal access is enabled.
     11
     12        Pass the current file device as part of the NSURLRequest so that CFNetwork can reject loads
     13        where the device changes in the midst of a load.
     14
     15        Also properly reflect that SecurityOrigin is never null by passing as a reference,
     16        rather than as a pointer.
     17
     18        Tests: Tools/TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.mm
     19
     20        * page/SecurityOrigin.cpp:
     21        (WebCore::SecurityOrigin::canAccess): Pass argument as reference.
     22        (WebCore::SecurityOrigin::passesFileCheck): Add check that file URLs refer to files in
     23        the same storage volume.
     24        (WebCore::SecurityOrigin::canDisplay): Add check that files share the same volume.
     25        (WebCore::SecurityOrigin::isSameSchemeHostPort): Pass argument as reference.
     26        * page/SecurityOrigin.h:
     27        * platform/FileSystem.cpp:
     28        (WebCore::filesHaveSameVolume): Added.
     29        * platform/FileSystem.h:
     30        * platform/network/cocoa/ResourceRequestCocoa.mm:
     31        (WebCore::ResourceRequest::doUpdatePlatformRequest): If loading a file URL, tell CFNetwork
     32        the storage device at the time of the start of the load so we can trigger a failure if this
     33        changes during the load operation.
     34        * platform/posix/FileSystemPOSIX.cpp:
     35        (WebCore::getFileDeviceId): Added.
     36        * platform/win/FileSystemWin.cpp:
     37        (WebCore::getFileDeviceId): Added.
     38
    1392017-01-09  Tim Horton  <timothy_horton@apple.com>
    240

  • trunk/Source/WebCore/page/SecurityOrigin.cpp

    r210218 r210531  
    11/*
    2  * Copyright (C) 2007-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    230230
    231231    if (canAccess && isLocal())
    232        canAccess = passesFileCheck(other);
     232        canAccess = passesFileCheck(*other);
    233233
    234234    return canAccess;
    235235}
    236236
    237 bool SecurityOrigin::passesFileCheck(const SecurityOrigin* other) const
    238 {
    239     ASSERT(isLocal() && other->isLocal());
    240 
    241     if (!m_enforceFilePathSeparation && !other->m_enforceFilePathSeparation)
    242         return true;
    243 
    244     return (m_filePath == other->m_filePath);
     237bool SecurityOrigin::passesFileCheck(const SecurityOrigin& other) const
     238{
     239    ASSERT(isLocal() && other.isLocal());
     240
     241    if (!filesHaveSameVolume(m_filePath, other.m_filePath))
     242        return false;
     243
     244    if (!m_enforceFilePathSeparation && !other.m_enforceFilePathSeparation)
     245        return true;
     246
     247    return (m_filePath == other.m_filePath);
    245248}
    246249
    … …  
    305308        return true;
    306309
     310    if (isLocal() && url.isLocalFile()) {
     311        if (!filesHaveSameVolume(m_filePath, url.path()))
     312            return false;
     313    }
     314
    307315    if (isFeedWithNestedProtocolInHTTPFamily(url))
    308316        return true;
    … …  
    524532        return false;
    525533
    526     if (isLocal() && !passesFileCheck(other))
     534    if (isLocal() && !passesFileCheck(*other))
    527535        return false;
    528536

  • trunk/Source/WebCore/page/SecurityOrigin.h

    r210218 r210531  
    11/*
    2  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    209209
    210210    // FIXME: Rename this function to something more semantic.
    211     bool passesFileCheck(const SecurityOrigin*) const;
     211    bool passesFileCheck(const SecurityOrigin&) const;
    212212
    213213    // This method checks that the scheme for this origin is an HTTP-family

  • trunk/Source/WebCore/platform/FileSystem.cpp

    r209399 r210531  
    11/*
    2  * Copyright (C) 2007, 2011 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 * Copyright (C) 2015 Canon Inc. All rights reserved.
    44 *
    … …  
    234234}
    235235
     236   
     237bool filesHaveSameVolume(const String& fileA, const String& fileB)
     238{
     239    auto fsRepFileA = fileSystemRepresentation(fileA);
     240    auto fsRepFileB = fileSystemRepresentation(fileB);
     241   
     242    if (fsRepFileA.isNull() || fsRepFileB.isNull())
     243        return false;
     244
     245    auto handleA = openFile(fsRepFileA.data(), OpenForRead);
     246    if (!isHandleValid(handleA))
     247        return false;
     248
     249    auto handleB = openFile(fsRepFileB.data(), OpenForRead);
     250    if (!isHandleValid(handleB)) {
     251        closeFile(handleA);
     252        return false;
     253    }
     254
     255    bool result = false;
     256
     257    auto fileADev = getFileDeviceId(handleA);
     258    auto fileBDev = getFileDeviceId(handleB);
     259
     260    if (fileADev && fileBDev)
     261        result = (fileADev == fileBDev);
     262   
     263    closeFile(handleA);
     264    closeFile(handleB);
     265   
     266    return result;
     267}
     268
    236269#if !PLATFORM(MAC)
    237270

  • trunk/Source/WebCore/platform/FileSystem.h

    r208278 r210531  
    11/*
    2  * Copyright (C) 2007, 2008, 2011 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Collabora, Ltd. All rights reserved.
    44 * Copyright (C) 2015 Canon Inc. All rights reserved.
    … …  
    147147WEBCORE_EXPORT String directoryName(const String&);
    148148WEBCORE_EXPORT bool getVolumeFreeSpace(const String&, uint64_t&);
     149WEBCORE_EXPORT std::optional<int32_t> getFileDeviceId(PlatformFileHandle);
    149150
    150151WEBCORE_EXPORT void setMetadataURL(String& URLString, const String& referrer, const String& path);
    … …  
    194195String decodeFromFilename(const String&);
    195196
     197bool filesHaveSameVolume(const String&, const String&);
     198
    196199#if USE(CF)
    197200RetainPtr<CFURLRef> pathAsURL(const String&);

  • trunk/Source/WebCore/platform/network/cocoa/ResourceRequestCocoa.mm

    r207585 r210531  
    11/*
    2  * Copyright (C) 2014 Apple, Inc.  All rights reserved.
     2 * Copyright (C) 2014-2017 Apple, Inc.  All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2929#if PLATFORM(COCOA)
    3030
     31#import "FileSystem.h"
    3132#import "FormDataStreamMac.h"
    3233#import "HTTPHeaderNames.h"
    … …  
    204205#endif
    205206
     207#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200)
     208    if (m_url.isLocalFile()) {
     209        auto fsRepFile = fileSystemRepresentation(m_url.fileSystemPath());
     210        if (!fsRepFile.isNull()) {
     211            auto handle = openFile(fsRepFile.data(), OpenForRead);
     212            if (isHandleValid(handle)) {
     213                auto fileDevice = getFileDeviceId(handle);
     214                if (fileDevice && fileDevice.value())
     215                    [nsRequest _setProperty:[NSNumber numberWithInteger:fileDevice.value()] forKey:@"NSURLRequestFileProtocolExpectedDevice"];
     216            }
     217        }
     218    }
     219#endif
     220
    206221    m_nsRequest = adoptNS(nsRequest);
    207222}

  • trunk/Source/WebCore/platform/posix/FileSystemPOSIX.cpp

    r200163 r210531  
    11/*
    2  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    384384}
    385385
     386std::optional<int32_t> getFileDeviceId(PlatformFileHandle handle)
     387{
     388    struct stat fileStat;
     389    if (fstat(handle, &fileStat))
     390        return std::nullopt;
     391
     392    return fileStat.st_dev;
     393}
     394
    386395} // namespace WebCore

  • trunk/Source/WebCore/platform/win/FileSystemWin.cpp

    r206196 r210531  
    11/*
    2  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Collabora, Ltd. All rights reserved.
    44 *
    … …  
    3434#include "NotImplemented.h"
    3535#include "PathWalker.h"
     36#include <io.h>
     37#include <shlobj.h>
     38#include <shlwapi.h>
     39#include <sys/stat.h>
     40#include <windows.h>
    3641#include <wtf/CryptographicallyRandomNumber.h>
    3742#include <wtf/HashMap.h>
    3843#include <wtf/text/CString.h>
    3944
    40 #include <windows.h>
    41 #include <shlobj.h>
    42 #include <shlwapi.h>
    4345
    4446namespace WebCore {
    … …  
    453455}
    454456
     457std::optional<int32_t> getFileDeviceId(PlatformFileHandle handle)
     458{
     459    BY_HANDLE_FILE_INFORMATION fileInformation = { };
     460    if (!::GetFileInformationByHandle(handle, &fileInformation))
     461        return std::nullopt;
     462
     463    return fileInformation.dwVolumeSerialNumber;
     464}
     465
    455466} // namespace WebCore

  • trunk/Tools/ChangeLog

    r210523 r210531  
     12017-01-09  Brent Fulgham  <bfulgham@apple.com>
     2
     3        File scheme should not allow access of a resource on a different volume.
     4        https://bugs.webkit.org/show_bug.cgi?id=158552
     5        <rdar://problem/15307582>
     6
     7        Reviewed by Alex Christensen.
     8
     9        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Add new files.
     10        * TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.html: Added.
     11        * TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.mm: Added.
     12
    1132017-01-09  Carlos Alberto Lopez Perez  <clopez@igalia.com>
    214

  • trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

    r210320 r210531  
    198198                7AD3FE8E1D76131200B169A4 /* TransformationMatrix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AD3FE8D1D75FB8D00B169A4 /* TransformationMatrix.cpp */; };
    199199                7AE9E5091AE5AE8B00CF874B /* test.pdf in Copy Resources */ = {isa = PBXBuildFile; fileRef = 7AE9E5081AE5AE8B00CF874B /* test.pdf */; };
     200                7AEAD47F1E20116C00416EFE /* CrossPartitionFileSchemeAccess.mm in Sources */ = {isa = PBXBuildFile; fileRef = 7AEAD47C1E20113800416EFE /* CrossPartitionFileSchemeAccess.mm */; };
     201                7AEAD4811E20122700416EFE /* CrossPartitionFileSchemeAccess.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 7AEAD47D1E20114E00416EFE /* CrossPartitionFileSchemeAccess.html */; };
    200202                7C3965061CDD74F90094DBB8 /* Color.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C3965051CDD74F90094DBB8 /* Color.cpp */; };
    201203                7C3DB8E41D12129B00AE8CC3 /* CommandBackForward.mm in Sources */ = {isa = PBXBuildFile; fileRef = 7C3DB8E21D12129B00AE8CC3 /* CommandBackForward.mm */; };
    … …  
    602604                        dstSubfolderSpec = 7;
    603605                        files = (
     606                                7AEAD4811E20122700416EFE /* CrossPartitionFileSchemeAccess.html in Copy Resources */,
    604607                                CDB4115A1E0B00DB00EAD352 /* video-with-muted-audio.html in Copy Resources */,
    605608                                9BD4239C1E04C01C00200395 /* chinese-character-with-image.html in Copy Resources */,
    … …  
    10411044                7AD3FE8D1D75FB8D00B169A4 /* TransformationMatrix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TransformationMatrix.cpp; sourceTree = "<group>"; };
    10421045                7AE9E5081AE5AE8B00CF874B /* test.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = test.pdf; sourceTree = "<group>"; };
     1046                7AEAD47C1E20113800416EFE /* CrossPartitionFileSchemeAccess.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CrossPartitionFileSchemeAccess.mm; sourceTree = "<group>"; };
     1047                7AEAD47D1E20114E00416EFE /* CrossPartitionFileSchemeAccess.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; name = CrossPartitionFileSchemeAccess.html; path = Tests/mac/CrossPartitionFileSchemeAccess.html; sourceTree = SOURCE_ROOT; };
    10431048                7C3965051CDD74F90094DBB8 /* Color.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Color.cpp; sourceTree = "<group>"; };
    10441049                7C3DB8E21D12129B00AE8CC3 /* CommandBackForward.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CommandBackForward.mm; sourceTree = "<group>"; };
    … …  
    20302035                        isa = PBXGroup;
    20312036                        children = (
     2037                                7AEAD47C1E20113800416EFE /* CrossPartitionFileSchemeAccess.mm */,
    20322038                                5C0BF88F1DD5999B00B00328 /* WebViewCanPasteZeroPng.mm */,
    20332039                                5C0BF88C1DD5957400B00328 /* MemoryPressureHandler.mm */,
    … …  
    20942100                        isa = PBXGroup;
    20952101                        children = (
     2102                                7AEAD47D1E20114E00416EFE /* CrossPartitionFileSchemeAccess.html */,
    20962103                                F42DA5151D8CEFDB00336F40 /* large-input-field-focus-onload.html */,
    20972104                                379028B814FABE49007E6B43 /* acceptsFirstMouse.html */,
    … …  
    24982505                                2D1646E21D1862CD00015A1A /* DeferredViewInWindowStateChange.mm in Sources */,
    24992506                                7CCE7EB91A411A7E00447C4C /* DeviceScaleFactorInDashboardRegions.mm in Sources */,
     2507                                7AEAD47F1E20116C00416EFE /* CrossPartitionFileSchemeAccess.mm in Sources */,
    25002508                                7CCE7EBA1A411A7E00447C4C /* DeviceScaleFactorOnBack.mm in Sources */,
    25012509                                7C83E04D1D0A641800FEBCF3 /* DFACombiner.cpp in Sources */,
Note: See TracChangeset for help on using the changeset viewer.