Changeset 276012 in webkit

Timestamp:

Apr 15, 2021, 2:07:44 AM (5 years ago)

Author:

youenn@apple.com

Message:

REGRESSION(Safari 14): iframe with blob url does not work with sandboxing
​https://bugs.webkit.org/show_bug.cgi?id=222312
<rdar://problem/74927624>

Reviewed by Chris Dumez.

Source/WebCore:

In ​https://trac.webkit.org/r275884, we correctly compute whether a blob is to be considered secure or not.
For that, we need to have the blob URL registered with its document origin.
Update PolicyChecker to properly register the temporoary blob URL with its document origin.

Test: http/tests/security/sandbox-iframe-and-blob.https.html

• loader/PolicyChecker.cpp:

(WebCore::FrameLoader::PolicyChecker::extendBlobURLLifetimeIfNecessary const):

LayoutTests:

• http/tests/security/resources/sandbox-iframe-and-blob-frame.html: Added.
• http/tests/security/sandbox-iframe-and-blob.https-expected.txt: Added.
• http/tests/security/sandbox-iframe-and-blob.https.html: Added.
• platform/win/TestExpectations:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/resources/sandbox-iframe-and-blob-frame.html (added)
• LayoutTests/http/tests/security/sandbox-iframe-and-blob.https-expected.txt (added)
• LayoutTests/http/tests/security/sandbox-iframe-and-blob.https.html (added)
• LayoutTests/platform/win/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/PolicyChecker.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-15  Youenn Fablet  <youenn@apple.com>
+
+        REGRESSION(Safari 14): iframe with blob url does not work with sandboxing
+        https://bugs.webkit.org/show_bug.cgi?id=222312
+        <rdar://problem/74927624>
+
+        Reviewed by Chris Dumez.
+
+        * http/tests/security/resources/sandbox-iframe-and-blob-frame.html: Added.
+        * http/tests/security/sandbox-iframe-and-blob.https-expected.txt: Added.
+        * http/tests/security/sandbox-iframe-and-blob.https.html: Added.
+        * platform/win/TestExpectations:
+
 2021-04-15  Diego Pino Garcia  <dpino@igalia.com>
 

trunk/LayoutTests/platform/win/TestExpectations

@@ -2263 +2263 @@
 http/tests/security/contentSecurityPolicy/report-document-uri-blob.html [ Skip ]
 fast/frames/restoring-page-cache-should-not-run-scripts-via-style-update.html [ Skip ]
+http/tests/security/sandbox-iframe-and-blob.https.html [ Skip ]
 
 # Clear Key not implemented

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-15  Youenn Fablet  <youenn@apple.com>
+
+        REGRESSION(Safari 14): iframe with blob url does not work with sandboxing
+        https://bugs.webkit.org/show_bug.cgi?id=222312
+        <rdar://problem/74927624>
+
+        Reviewed by Chris Dumez.
+
+        In https://trac.webkit.org/r275884, we correctly compute whether a blob is to be considered secure or not.
+        For that, we need to have the blob URL registered with its document origin.
+        Update PolicyChecker to properly register the temporoary blob URL with its document origin.
+
+        Test: http/tests/security/sandbox-iframe-and-blob.https.html
+
+        * loader/PolicyChecker.cpp:
+        (WebCore::FrameLoader::PolicyChecker::extendBlobURLLifetimeIfNecessary const):
+
 2021-04-15  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/loader/PolicyChecker.cpp

@@ -48 +48 @@
 #include "HTMLPlugInElement.h"
 #include "Logging.h"
+#include "ThreadableBlobRegistry.h"
 #include <wtf/CompletionHandler.h>
 
@@ -112 +113 @@
     // Create a new temporary blobURL in case this one gets revoked during the asynchronous navigation policy decision.
     URL temporaryBlobURL = BlobURL::createPublicURL(&m_frame.document()->securityOrigin());
-    blobRegistry().registerBlobURL(temporaryBlobURL, request.url());
+    ThreadableBlobRegistry::registerBlobURL(&m_frame.document()->securityOrigin(), temporaryBlobURL, request.url());
     request.setURL(temporaryBlobURL);
     if (loader)
         loader->request().setURL(temporaryBlobURL);
     return CompletionHandler<void()>([temporaryBlobURL = WTFMove(temporaryBlobURL)] {
-        blobRegistry().unregisterBlobURL(temporaryBlobURL);
+        ThreadableBlobRegistry::unregisterBlobURL(temporaryBlobURL);
     });
 }