Changeset 92027 in webkit

Timestamp:

Jul 29, 2011, 4:00:58 PM (15 years ago)

Author:

cevans@google.com

Message:

Merge 91957
BUG=89453
Review URL: ​http://codereview.chromium.org/7540005

Location:

branches/chromium/835

Files:

• LayoutTests/http/tests/security/inactive-document-with-empty-security-origin-expected.txt (copied) (copied from trunk/LayoutTests/http/tests/security/inactive-document-with-empty-security-origin-expected.txt )
• LayoutTests/http/tests/security/inactive-document-with-empty-security-origin.html (copied) (copied from trunk/LayoutTests/http/tests/security/inactive-document-with-empty-security-origin.html )
• LayoutTests/http/tests/security/resources/post-done-to-opener.html (copied) (copied from trunk/LayoutTests/http/tests/security/resources/post-done-to-opener.html )
• LayoutTests/platform/chromium/http/tests/security/inactive-document-with-empty-security-origin-expected.txt (copied) (copied from trunk/LayoutTests/platform/chromium/http/tests/security/inactive-document-with-empty-security-origin-expected.txt )
• Source/WebCore/bindings/generic/BindingSecurityBase.cpp (modified) (3 diffs)
• Source/WebCore/page/SecurityOrigin.cpp (modified) (4 diffs)

branches/chromium/835/Source/WebCore/bindings/generic/BindingSecurityBase.cpp

@@ -49 +49 @@
 }
 
-// Same origin policy implementation:
-//
-// Same origin policy prevents JS code from domain A from accessing JS & DOM
-// objects in a different domain B. There are exceptions and several objects
-// are accessible by cross-domain code. For example, the window.frames object
-// is accessible by code from a different domain, but window.document is not.
-//
-// The JS binding code sets security check callbacks on a function template,
-// and accessing instances of the template calls the callback function.
-// The callback function enforces the same origin policy.
-//
-// Callback functions are expensive. Binding code should use a security token
-// string to do fast access checks for the common case where source and target
-// are in the same domain. A security token is a string object that represents
-// the protocol/url/port of a domain.
-//
-// There are special cases where security token matching is not enough.
-// For example, JS can set its domain to a super domain by calling
-// document.setDomain(...). In these cases, the binding code can reset
-// a context's security token to its global object so that the fast access
-// check will always fail.
-
-// Helper to check if the current execution context can access a target frame.
-// First it checks same domain policy using the lexical context.
-//
-// This is equivalent to KJS::Window::allowsAccessFrom(ExecState*).
-bool BindingSecurityBase::canAccess(DOMWindow* activeWindow,
-                                    DOMWindow* targetWindow)
+bool BindingSecurityBase::canAccess(DOMWindow* activeWindow, DOMWindow* targetWindow)
 {
     ASSERT(targetWindow);
-
-    String message;
-
     if (activeWindow == targetWindow)
         return true;
@@ -88 +58 @@
         return false;
 
-    const SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
-    const SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
+    SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
+    SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
 
     // We have seen crashes were the security origin of the target has not been
@@ -99 +69 @@
         return true;
 
-    // Allow access to a "about:blank" page if the dynamic context is a
-    // detached context of the same frame as the blank page.
-    if (targetSecurityOrigin->isEmpty() && activeWindow->frame() == targetWindow->frame())
-        return true;
-
     return false;
 }
 
-} // namespace WebCore
+}

branches/chromium/835/Source/WebCore/page/SecurityOrigin.cpp

@@ -148 +148 @@
 bool SecurityOrigin::isEmpty() const
 {
+    ASSERT(!m_protocol.isEmpty() || m_isUnique);
     return m_protocol.isEmpty();
 }
@@ -174 +175 @@
 }
 
+// FIXME: This should move to SchemeRegistry!
 static HashSet<String>& schemesForbiddenFromDomainRelaxation()
 {
@@ -374 +376 @@
 
 bool SecurityOrigin::isSecureTransitionTo(const KURL& url) const
-{ 
-    // New window created by the application
+{
+    // This origin represents a new window created by the application.
     if (isEmpty())
         return true;
@@ -385 +387 @@
 String SecurityOrigin::toString() const
 {
-    if (isEmpty())
-        return "null";
-
     if (isUnique())
         return "null";