⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245925 in webkit


Ignore:
Timestamp:
May 30, 2019, 5:30:13 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r245538. rdar://problem/50753927

Fix security check in ScriptController::canAccessFromCurrentOrigin()
​https://bugs.webkit.org/show_bug.cgi?id=196730
<rdar://problem/49731231>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
current JS exec state. Instead of returning true unconditionally, we now fall back to
using the accessing document's origin for the security check. The new behavior is
aligned with Blink:
​https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62

This fix is based on a patch from Sergei Glazunov <​glazunov@google.com>.

Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html

  • bindings/js/ScriptController.cpp: (WebCore::ScriptController::canAccessFromCurrentOrigin):
  • bindings/js/ScriptController.h:
  • html/HTMLFrameElementBase.cpp: (WebCore::HTMLFrameElementBase::isURLAllowed const):

LayoutTests:

Add layout test coverage.

  • http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
  • http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245538 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/LayoutTests/ChangeLog

    r245924 r245925  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245538. rdar://problem/50753927
     4
     5    Fix security check in ScriptController::canAccessFromCurrentOrigin()
     6    https://bugs.webkit.org/show_bug.cgi?id=196730
     7    <rdar://problem/49731231>
     8   
     9    Reviewed by Ryosuke Niwa.
     10   
     11    Source/WebCore:
     12   
     13    Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
     14    current JS exec state. Instead of returning true unconditionally, we now fall back to
     15    using the accessing document's origin for the security check. The new behavior is
     16    aligned with Blink:
     17    https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
     18   
     19    This fix is based on a patch from Sergei Glazunov <glazunov@google.com>.
     20   
     21    Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
     22   
     23    * bindings/js/ScriptController.cpp:
     24    (WebCore::ScriptController::canAccessFromCurrentOrigin):
     25    * bindings/js/ScriptController.h:
     26    * html/HTMLFrameElementBase.cpp:
     27    (WebCore::HTMLFrameElementBase::isURLAllowed const):
     28   
     29    LayoutTests:
     30   
     31    Add layout test coverage.
     32   
     33    * http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
     34    * http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
     35   
     36    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     37
     38    2019-05-20  Chris Dumez  <cdumez@apple.com>
     39
     40            Fix security check in ScriptController::canAccessFromCurrentOrigin()
     41            https://bugs.webkit.org/show_bug.cgi?id=196730
     42            <rdar://problem/49731231>
     43
     44            Reviewed by Ryosuke Niwa.
     45
     46            Add layout test coverage.
     47
     48            * http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
     49            * http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
     50
    1512019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    252

  • branches/safari-607-branch/Source/WebCore/ChangeLog

    r245924 r245925  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245538. rdar://problem/50753927
     4
     5    Fix security check in ScriptController::canAccessFromCurrentOrigin()
     6    https://bugs.webkit.org/show_bug.cgi?id=196730
     7    <rdar://problem/49731231>
     8   
     9    Reviewed by Ryosuke Niwa.
     10   
     11    Source/WebCore:
     12   
     13    Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
     14    current JS exec state. Instead of returning true unconditionally, we now fall back to
     15    using the accessing document's origin for the security check. The new behavior is
     16    aligned with Blink:
     17    https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
     18   
     19    This fix is based on a patch from Sergei Glazunov <glazunov@google.com>.
     20   
     21    Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
     22   
     23    * bindings/js/ScriptController.cpp:
     24    (WebCore::ScriptController::canAccessFromCurrentOrigin):
     25    * bindings/js/ScriptController.h:
     26    * html/HTMLFrameElementBase.cpp:
     27    (WebCore::HTMLFrameElementBase::isURLAllowed const):
     28   
     29    LayoutTests:
     30   
     31    Add layout test coverage.
     32   
     33    * http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
     34    * http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
     35   
     36    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     37
     38    2019-05-20  Chris Dumez  <cdumez@apple.com>
     39
     40            Fix security check in ScriptController::canAccessFromCurrentOrigin()
     41            https://bugs.webkit.org/show_bug.cgi?id=196730
     42            <rdar://problem/49731231>
     43
     44            Reviewed by Ryosuke Niwa.
     45
     46            Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
     47            current JS exec state. Instead of returning true unconditionally, we now fall back to
     48            using the accessing document's origin for the security check. The new behavior is
     49            aligned with Blink:
     50            https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
     51
     52            This fix is based on a patch from Sergei Glazunov <glazunov@google.com>.
     53
     54            Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
     55
     56            * bindings/js/ScriptController.cpp:
     57            (WebCore::ScriptController::canAccessFromCurrentOrigin):
     58            * bindings/js/ScriptController.h:
     59            * html/HTMLFrameElementBase.cpp:
     60            (WebCore::HTMLFrameElementBase::isURLAllowed const):
     61
    1622019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    263

  • branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.cpp

    r239569 r245925  
    379379}
    380380
    381 bool ScriptController::canAccessFromCurrentOrigin(Frame* frame)
     381bool ScriptController::canAccessFromCurrentOrigin(Frame* frame, Document& accessingDocument)
    382382{
    383383    auto* state = JSExecState::currentState();
    384384
    385     // If the current state is null we're in a call path where the DOM security check doesn't apply (eg. parser).
    386     if (!state)
    387         return true;
     385    // If the current state is null we should use the accessing document for the security check.
     386    if (!state) {
     387        auto* targetDocument = frame ? frame->document() : nullptr;
     388        return targetDocument && accessingDocument.securityOrigin().canAccess(targetDocument->securityOrigin());
     389    }
    388390
    389391    return BindingSecurity::shouldAllowAccessToFrame(state, frame);

  • branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.h

    r238771 r245925  
    120120    void disableWebAssembly(const String& errorMessage);
    121121
    122     static bool canAccessFromCurrentOrigin(Frame*);
     122    static bool canAccessFromCurrentOrigin(Frame*, Document& accessingDocument);
    123123    WEBCORE_EXPORT bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
    124124

  • branches/safari-607-branch/Source/WebCore/html/HTMLFrameElementBase.cpp

    r238771 r245925  
    7474    if (WTF::protocolIsJavaScript(completeURL)) {
    7575        RefPtr<Document> contentDoc = this->contentDocument();
    76         if (contentDoc && !ScriptController::canAccessFromCurrentOrigin(contentDoc->frame()))
     76        if (contentDoc && !ScriptController::canAccessFromCurrentOrigin(contentDoc->frame(), document()))
    7777            return false;
    7878    }
Note: See TracChangeset for help on using the changeset viewer.