Changeset 228919 in webkit

Timestamp:

Feb 22, 2018 8:55:53 AM (6 years ago)

Author:

Chris Dumez

Message:

Add release asserts for service worker fetch and postMessage events
​https://bugs.webkit.org/show_bug.cgi?id=183025
rdar://problem/37765052

Patch by Youenn Fablet <​youenn@apple.com> on 2018-02-22
Reviewed by Daniel Bates.

Source/WebCore:

Add release assertion so that a service worker will only dispatch a message event
for clients and service workers with the same origin.
No change of behavior.

• platform/network/ResourceRequestBase.h:
• workers/service/context/ServiceWorkerThread.cpp:

(WebCore::ServiceWorkerThread::postMessageToServiceWorker):

• workers/service/context/ServiceWorkerThreadProxy.h:

Source/WebKit:

Add assertion to protect interception of a fetch load by a service worker with
a different origin from the page.

• WebProcess/Storage/WebSWContextManagerConnection.cpp:

(WebKit::WebSWContextManagerConnection::startFetch):

Location:

trunk/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/platform/network/ResourceRequestBase.h (modified) (1 diff)
• WebCore/workers/service/context/ServiceWorkerThread.cpp (modified) (1 diff)
• WebCore/workers/service/context/ServiceWorkerThreadProxy.h (modified) (1 diff)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-02-22  Youenn Fablet  <youenn@apple.com>
+
+        Add release asserts for service worker fetch and postMessage events
+        https://bugs.webkit.org/show_bug.cgi?id=183025
+        rdar://problem/37765052
+
+        Reviewed by Daniel Bates.
+
+        Add release assertion so that a service worker will only dispatch a message event
+        for clients and service workers with the same origin.
+        No change of behavior.
+
+        * platform/network/ResourceRequestBase.h:
+        * workers/service/context/ServiceWorkerThread.cpp:
+        (WebCore::ServiceWorkerThread::postMessageToServiceWorker):
+        * workers/service/context/ServiceWorkerThreadProxy.h:
+
 2018-02-22  Miguel Gomez  <magomez@igalia.com>
 

trunk/Source/WebCore/platform/network/ResourceRequestBase.h

@@ -114 +114 @@
     WEBCORE_EXPORT void clearHTTPReferrer();
 
-    String httpOrigin() const;
+    WEBCORE_EXPORT String httpOrigin() const;
     bool hasHTTPOrigin() const;
     void setHTTPOrigin(const String&);

trunk/Source/WebCore/workers/service/context/ServiceWorkerThread.cpp

@@ -120 +120 @@
         if (WTF::holds_alternative<ServiceWorkerClientData>(sourceData)) {
             RefPtr<ServiceWorkerClient> sourceClient = ServiceWorkerClient::getOrCreate(serviceWorkerGlobalScope, WTFMove(WTF::get<ServiceWorkerClientData>(sourceData)));
+
+            RELEASE_ASSERT(!sourceClient->url().protocolIsInHTTPFamily() || !serviceWorkerGlobalScope.url().protocolIsInHTTPFamily() || protocolHostAndPortAreEqual(serviceWorkerGlobalScope.url(), sourceClient->url()));
+
             sourceOrigin = SecurityOrigin::create(sourceClient->url());
             source = WTFMove(sourceClient);
         } else {
             RefPtr<ServiceWorker> sourceWorker = ServiceWorker::getOrCreate(serviceWorkerGlobalScope, WTFMove(WTF::get<ServiceWorkerData>(sourceData)));
+
+            RELEASE_ASSERT(!sourceWorker->scriptURL().protocolIsInHTTPFamily() || !serviceWorkerGlobalScope.url().protocolIsInHTTPFamily() || protocolHostAndPortAreEqual(serviceWorkerGlobalScope.url(), sourceWorker->scriptURL()));
+
             sourceOrigin = SecurityOrigin::create(sourceWorker->scriptURL());
             source = WTFMove(sourceWorker);

trunk/Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.h

@@ -66 +66 @@
     WEBCORE_EXPORT std::unique_ptr<FetchLoader> createBlobLoader(FetchLoaderClient&, const URL&);
 
+    const URL& scriptURL() const { return m_document->url(); }
+
     // Public only for testing purposes.
     WEBCORE_TESTSUPPORT_EXPORT void notifyNetworkStateChange(bool isOnline);

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-02-22  Youenn Fablet  <youenn@apple.com>
+
+        Add release asserts for service worker fetch and postMessage events
+        https://bugs.webkit.org/show_bug.cgi?id=183025
+        rdar://problem/37765052
+
+        Reviewed by Daniel Bates.
+
+        Add assertion to protect interception of a fetch load by a service worker with
+        a different origin from the page.
+
+        * WebProcess/Storage/WebSWContextManagerConnection.cpp:
+        (WebKit::WebSWContextManagerConnection::startFetch):
+
 2018-02-22  Ms2ger  <Ms2ger@igalia.com>
 

trunk/Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp

@@ -189 +189 @@
     }
 
+    String origin = request.httpOrigin();
+    URL url { URL(), origin.isEmpty() ? referrer : origin };
+    URL serviceWorkerURL = serviceWorkerThreadProxy->scriptURL();
+    RELEASE_ASSERT(!url.protocolIsInHTTPFamily() || !serviceWorkerURL.protocolIsInHTTPFamily() || protocolHostAndPortAreEqual(url, serviceWorkerURL));
+
     auto client = WebServiceWorkerFetchTaskClient::create(m_connectionToStorageProcess.copyRef(), serviceWorkerIdentifier, serverConnectionIdentifier, fetchIdentifier);
     std::optional<ServiceWorkerClientIdentifier> clientId;