Changeset 97270 in webkit

Timestamp:

Oct 12, 2011, 10:05:41 AM (15 years ago)

Author:

abarth@webkit.org

Message:

ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads
​https://bugs.webkit.org/show_bug.cgi?id=69777

Patch by Sergey Glazunov <​serg.glazunov@gmail.com> on 2011-10-12
Reviewed by Adam Barth.

Source/WebCore:

Test: http/tests/security/xss-DENIED-synchronous-frame-load-in-javascript-url.html

• bindings/ScriptControllerBase.cpp:

(WebCore::ScriptController::executeIfJavaScriptURL):

• loader/DocumentWriter.cpp:

(WebCore::DocumentWriter::replaceDocument):
(WebCore::DocumentWriter::begin):

• loader/DocumentWriter.h:

Source/WebKit/chromium:

• src/WebFrameImpl.cpp:

(WebKit::WebFrameImpl::loadJavaScriptURL):

Location:

trunk/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/bindings/ScriptControllerBase.cpp (modified) (2 diffs)
• WebCore/loader/DocumentWriter.cpp (modified) (3 diffs)
• WebCore/loader/DocumentWriter.h (modified) (1 diff)
• WebKit/chromium/ChangeLog (modified) (1 diff)
• WebKit/chromium/src/WebFrameImpl.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-10-12  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads
+        https://bugs.webkit.org/show_bug.cgi?id=69777
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xss-DENIED-synchronous-frame-load-in-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::replaceDocument):
+        (WebCore::DocumentWriter::begin):
+        * loader/DocumentWriter.h:
+
 2011-10-12  Vsevolod Vlasov  <vsevik@chromium.org>
 

trunk/Source/WebCore/bindings/ScriptControllerBase.cpp

@@ -94 +94 @@
     // destroy the frame.
     RefPtr<Frame> protector(m_frame);
+    RefPtr<Document> ownerDocument(m_frame->document());
 
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
@@ -126 +127 @@
         // so protect it with a RefPtr.
         if (RefPtr<DocumentLoader> loader = m_frame->document()->loader())
-            loader->writer()->replaceDocument(scriptResult);
+            loader->writer()->replaceDocument(scriptResult, ownerDocument.get());
     }
     return true;

trunk/Source/WebCore/loader/DocumentWriter.cpp

@@ -65 +65 @@
 // and always contains the result of evaluating a javascript: url.
 // This is the <iframe src="javascript:'html'"> case.
-void DocumentWriter::replaceDocument(const String& source)
+void DocumentWriter::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader()->stopAllLoaders();
-    begin(m_frame->document()->url(), true, InheritSecurityOrigin);
+    begin(m_frame->document()->url(), true, ownerDocument);
 
     if (!source.isNull()) {
@@ -107 +107 @@
 }
 
-void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOriginSource originSource)
-{
-    RefPtr<Document> oldDocument = m_frame->document();
-
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, Document* ownerDocument)
+{
     // We grab a local copy of the URL because it's easy for callers to supply
     // a URL that will be deallocated during the execution of this function.
@@ -138 +136 @@
     if (m_decoder)
         document->setDecoder(m_decoder.get());
-    if (originSource == InheritSecurityOrigin) {
-        document->setCookieURL(oldDocument->cookieURL());
-        document->setSecurityOrigin(oldDocument->securityOrigin());
+    if (ownerDocument) {
+        document->setCookieURL(ownerDocument->cookieURL());
+        document->setSecurityOrigin(ownerDocument->securityOrigin());
     }
 

trunk/Source/WebCore/loader/DocumentWriter.h

@@ -48 +48 @@
     // This is only called by ScriptController::executeIfJavaScriptURL
     // and always contains the result of evaluating a javascript: url.
-    void replaceDocument(const String&);
-
-    enum SecurityOriginSource { CreateNewSecurityOrigin, InheritSecurityOrigin };
+    void replaceDocument(const String&, Document* ownerDocument);
 
     void begin();
-    void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOriginSource = CreateNewSecurityOrigin);
+    void begin(const KURL&, bool dispatchWindowObjectAvailable = true, Document* ownerDocument = 0);
     void addData(const char* bytes, size_t length);
     void end();

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2011-10-12  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads
+        https://bugs.webkit.org/show_bug.cgi?id=69777
+
+        Reviewed by Adam Barth.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadJavaScriptURL):
+
 2011-10-12  Yury Semikhatsky  <yurys@chromium.org>
 

trunk/Source/WebKit/chromium/src/WebFrameImpl.cpp

@@ -2274 +2274 @@
         return;
 
+    RefPtr<Document> ownerDocument(m_frame->document());
+
     // Protect privileged pages against bookmarklets and other javascript manipulations.
     if (SchemeRegistry::shouldTreatURLSchemeAsNotAllowingJavascriptURLs(m_frame->document()->url().protocol()))
@@ -2286 +2288 @@
 
     if (!m_frame->navigationScheduler()->locationChangePending())
-        m_frame->document()->loader()->writer()->replaceDocument(scriptResult);
+        m_frame->document()->loader()->writer()->replaceDocument(scriptResult, ownerDocument.get());
 }