Changeset 228963 in webkit

Timestamp:

Feb 23, 2018 1:40:30 PM (6 years ago)

Author:

jmarcell@apple.com

Message:

Apply patch. rdar://problem/37836719

Location:

branches/safari-605-branch/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/workers/service/context/ServiceWorkerThread.cpp (modified) (3 diffs)
• WebCore/workers/service/context/ServiceWorkerThreadProxy.h (modified) (1 diff)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp (modified) (1 diff)

branches/safari-605-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2018-02-23  Jason Marcell  <jmarcell@apple.com>
+
+        Apply patch. rdar://problem/37836719
+
+    2018-02-23  Chris Dumez  <cdumez@apple.com>
+
+            Add release asserts for service worker fetch and postMessage events
+            https://bugs.webkit.org/show_bug.cgi?id=183025
+            <rdar://problem/37765052>
+
+            Reviewed by Chris Dumez.
+
+            Moving from release assert to early exit with release logging.
+
+            * workers/service/context/ServiceWorkerThread.cpp:
+            (WebCore::ServiceWorkerThread::postMessageToServiceWorker):
+            * workers/service/context/ServiceWorkerThreadProxy.h:
+
 2018-02-23  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-605-branch/Source/WebCore/workers/service/context/ServiceWorkerThread.cpp

@@ -34 +34 @@
 #include "ExtendableMessageEvent.h"
 #include "JSDOMPromise.h"
+#include "Logging.h"
 #include "NetworkStateNotifier.h"
 #include "SecurityOrigin.h"
@@ -121 +122 @@
             RefPtr<ServiceWorkerClient> sourceClient = ServiceWorkerClient::getOrCreate(serviceWorkerGlobalScope, WTFMove(WTF::get<ServiceWorkerClientData>(sourceData)));
 
-            RELEASE_ASSERT(!sourceClient->url().protocolIsInHTTPFamily() || !serviceWorkerGlobalScope.url().protocolIsInHTTPFamily() || protocolHostAndPortAreEqual(serviceWorkerGlobalScope.url(), sourceClient->url()));
+            if (sourceClient->url().protocolIsInHTTPFamily() && serviceWorkerGlobalScope.url().protocolIsInHTTPFamily() && !protocolHostAndPortAreEqual(serviceWorkerGlobalScope.url(), sourceClient->url())) {
+                RELEASE_LOG_ERROR_IF(!context.sessionID().isEphemeral(), ServiceWorker, "ServiceWorkerThread::postMessageToServiceWorker - Received message from invalid service worker client due to origin - context is %p\n", &context);
+                ASSERT_NOT_REACHED();
+                return;
+            }
 
             sourceOrigin = SecurityOrigin::create(sourceClient->url());
@@ -128 +133 @@
             RefPtr<ServiceWorker> sourceWorker = ServiceWorker::getOrCreate(serviceWorkerGlobalScope, WTFMove(WTF::get<ServiceWorkerData>(sourceData)));
 
-            RELEASE_ASSERT(!sourceWorker->scriptURL().protocolIsInHTTPFamily() || !serviceWorkerGlobalScope.url().protocolIsInHTTPFamily() || protocolHostAndPortAreEqual(serviceWorkerGlobalScope.url(), sourceWorker->scriptURL()));
+            if (sourceWorker->scriptURL().protocolIsInHTTPFamily() && serviceWorkerGlobalScope.url().protocolIsInHTTPFamily() && !protocolHostAndPortAreEqual(serviceWorkerGlobalScope.url(), sourceWorker->scriptURL())) {
+                RELEASE_LOG_ERROR_IF(!context.sessionID().isEphemeral(), ServiceWorker, "ServiceWorkerThread::postMessageToServiceWorker - Received message from invalid service worker due to origin - context is %p\n", &context);
+                ASSERT_NOT_REACHED();
+                return;
+            }
 
             sourceOrigin = SecurityOrigin::create(sourceWorker->scriptURL());

branches/safari-605-branch/Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.h

@@ -67 +67 @@
 
     const URL& scriptURL() const { return m_document->url(); }
+    PAL::SessionID sessionID() const { return m_sessionID; }
 
     // Public only for testing purposes.

branches/safari-605-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2018-02-23  Jason Marcell  <jmarcell@apple.com>
+
+        Apply patch. rdar://problem/37836719
+
+    2018-02-23  Chris Dumez  <cdumez@apple.com>
+
+            Add release asserts for service worker fetch and postMessage events
+            https://bugs.webkit.org/show_bug.cgi?id=183025
+            <rdar://problem/37765052>
+
+            Reviewed by Chris Dumez.
+
+            Moving from release assert to early exit with release logging.
+
+            * WebProcess/Storage/WebSWContextManagerConnection.cpp:
+            (WebKit::WebSWContextManagerConnection::startFetch):
+
 2018-02-23  Jason Marcell  <jmarcell@apple.com>
 

branches/safari-605-branch/Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp

@@ -200 +200 @@
     }
 
-    RELEASE_ASSERT(isValidFetch(request, options, serviceWorkerThreadProxy->scriptURL(), referrer));
+    if (!isValidFetch(request, options, serviceWorkerThreadProxy->scriptURL(), referrer)) {
+        RELEASE_LOG_ERROR_IF(!serviceWorkerThreadProxy->sessionID().isEphemeral(), ServiceWorker, "%p - WebSWContextManagerConnection::startFetch - Service Worker received an invalid fetch due to origin", this);
+        m_connectionToStorageProcess->send(Messages::StorageProcess::DidNotHandleFetch(serverConnectionIdentifier, fetchIdentifier), 0);
+        ASSERT_NOT_REACHED();
+        return;
+    }
 
     auto client = WebServiceWorkerFetchTaskClient::create(m_connectionToStorageProcess.copyRef(), serviceWorkerIdentifier, serverConnectionIdentifier, fetchIdentifier);