Changeset 30634 in webkit


Ignore:
Timestamp:
Feb 27, 2008 3:59:54 PM (16 years ago)
Author:
weinig@apple.com
Message:

WebCore:

Reviewed by Darin.

Fix for <rdar://problem/5768769>

  • Don't allow cross-origin calls using window.functionName.call(otherFrame) syntax.
  • bindings/js/JSLocation.cpp: (WebCore::jsLocationProtoFuncToString): Do same-origin check.
  • bindings/js/kjs_window.cpp: (KJS::windowProtoFuncAToB): Ditto. (KJS::windowProtoFuncBToA): Ditto. (KJS::windowProtoFuncOpen): Ditto. (KJS::windowProtoFuncClearTimeout): Ditto.
  • bindings/scripts/CodeGeneratorJS.pm: Ditto.

LayoutTests:

Reviewed by Darin.

Updates tests for <rdar://problem/5768769>

  • http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt:
  • http/tests/security/cross-frame-access-call-expected.txt:
  • http/tests/security/cross-frame-access-call.html:
Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r30632 r30634  
     12008-02-27  Sam Weinig  <sam@webkit.org>
     2
     3        Reviewed by Darin.
     4
     5        Updates tests for <rdar://problem/5768769>
     6
     7        * http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt:
     8        * http/tests/security/cross-frame-access-call-expected.txt:
     9        * http/tests/security/cross-frame-access-call.html:
     10
    1112008-02-27  Brady Eidson  <beidson@apple.com>
    212

  • trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt

    r29266 r30634  
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/innocent-victim.html from frame with URL http://127.0.0.1:8000/security/aboutBlank/xss-DENIED-set-opener.html. Domains, protocols and ports must match.
     2
    13CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/innocent-victim.html from frame with URL about:blank. Domains, protocols and ports must match.
    24

  • trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt

    r29008 r30634  
    77CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
    88
     9CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     10
     11CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     12
     13CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     14
     15CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     16
     17CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     18
     19CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     20
     21CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     22
     23CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     24
     25CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     26
     27CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     28
     29CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     30
     31CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     32
     33CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     34
     35CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     36
     37CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     38
     39CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     40
     41CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     42
     43CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     44
     45CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     46
     47CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     48
     49CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     50
     51CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-call.html. Domains, protocols and ports must match.
     52
     53CONSOLE MESSAGE: line 55: Undefined value
    954
    1055
    1156----- tests for calling methods of another frame using Function.call -----
    1257
    13 PASS: setTimeout.call(targetWindow, 'void(0);', 0) should be 'undefined' and is.
    14 PASS: setInterval.call(targetWindow, 'void(0);', 0) should be 'undefined' and is.
     58PASS: window.setTimeout.call(targetWindow, 'void(0);', 0) should be 'undefined' and is.
     59PASS: window.setInterval.call(targetWindow, 'void(0);', 0) should be 'undefined' and is.
     60PASS: window.getSelection.call(targetWindow) should be 'undefined' and is.
     61PASS: window.find.call(targetWindow, 'string', false, false, false, false, false, false) should be 'undefined' and is.
     62PASS: window.confirm.call(targetWindow, 'message') should be 'undefined' and is.
     63PASS: window.prompt.call(targetWindow, 'message', 'defaultValue') should be 'undefined' and is.
     64PASS: window.getComputedStyle.call(targetWindow, document.body, '') should be 'undefined' and is.
     65PASS: window.getMatchedCSSRules.call(targetWindow, document.body, '', false) should be 'undefined' and is.
     66PASS: window.openDatabase.call(targetWindow, 'name') should be 'undefined' and is.
     67PASS: window.atob.call(targetWindow, 'string') should be 'undefined' and is.
     68PASS: window.btoa.call(targetWindow, 'string') should be 'undefined' and is.
     69PASS: window.open.call(targetWindow, '') should be 'undefined' and is.
    1570

  • trunk/LayoutTests/http/tests/security/cross-frame-access-call.html

    r29008 r30634  
    1717    log("\n----- tests for calling methods of another frame using Function.call -----\n");
    1818
     19    // Allowed
     20    // void focus();
     21    // void blur();
     22    // void close();
     23    // void postMessage(in DOMString message);
     24
     25    // - Tests for the Window object -
    1926    // undefined value indicates failure
    20     shouldBe("setTimeout.call(targetWindow, 'void(0);', 0)", undefined);
    21     shouldBe("setInterval.call(targetWindow, 'void(0);', 0)", undefined);
     27    shouldBe("window.setTimeout.call(targetWindow, 'void(0);', 0)", "undefined");
     28    shouldBe("window.setInterval.call(targetWindow, 'void(0);', 0)", "undefined");
     29    shouldBe("window.getSelection.call(targetWindow)", "undefined");
     30    shouldBe("window.find.call(targetWindow, 'string', false, false, false, false, false, false)", "undefined");
     31    shouldBe("window.confirm.call(targetWindow, 'message')", "undefined");
     32    shouldBe("window.prompt.call(targetWindow, 'message', 'defaultValue')", "undefined");
     33    shouldBe("window.getComputedStyle.call(targetWindow, document.body, '')", "undefined");
     34    shouldBe("window.getMatchedCSSRules.call(targetWindow, document.body, '', false)", "undefined");
     35    shouldBe("window.openDatabase.call(targetWindow, 'name')", "undefined");
     36    shouldBe("window.atob.call(targetWindow, 'string')", "undefined");
     37    shouldBe("window.btoa.call(targetWindow, 'string')", "undefined");
     38    shouldBe("window.open.call(targetWindow, '')", "undefined");
    2239
    23     // these always return undefined so we use the error console to detect failure
    24     addEventListener.call(targetWindow, "load", null, false);
    25     removeEventListener.call(targetWindow, "load", null, false);
     40    // These always return undefined so we use the error console to detect failure
     41    window.addEventListener.call(targetWindow, "load", null, false);
     42    window.removeEventListener.call(targetWindow, "load", null, false);
     43    window.clearTimeout.call(targetWindow, 0);
     44    window.clearInterval.call(targetWindow, 0);
     45    window.print.call(targetWindow);
     46    window.stop.call(targetWindow);
     47    window.alert.call(targetWindow, 'message');
     48    window.scrollBy.call(targetWindow, 0, 0);
     49    window.scrollTo.call(targetWindow, 0, 0);
     50    window.scroll.call(targetWindow, 0, 0);
     51    window.moveBy.call(targetWindow, 0, 0);
     52    window.moveTo.call(targetWindow, 0, 0);
     53    window.resizeBy.call(targetWindow, 0, 0);
     54    window.resizeTo.call(targetWindow, 0, 0);
     55    window.showModalDialog.call(targetWindow);
     56
     57    // - Tests for the Location object -
     58    // undefined value indicates failure
     59    shouldBe("window.location.toString.call(targetWindow.location)", "undefined");
    2660
    2761    // Work around DRT bug that causes subsequent tests to fail.

  • trunk/WebCore/ChangeLog

    r30633 r30634  
     12008-02-27  Sam Weinig  <sam@webkit.org>
     2
     3        Reviewed by Darin.
     4
     5        Fix for <rdar://problem/5768769>
     6
     7        - Don't allow cross-origin calls using window.functionName.call(otherFrame)
     8          syntax.
     9
     10        * bindings/js/JSLocation.cpp:
     11        (WebCore::jsLocationProtoFuncToString): Do same-origin check.
     12        * bindings/js/kjs_window.cpp:
     13        (KJS::windowProtoFuncAToB): Ditto.
     14        (KJS::windowProtoFuncBToA): Ditto.
     15        (KJS::windowProtoFuncOpen): Ditto.
     16        (KJS::windowProtoFuncClearTimeout): Ditto.
     17        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
     18
    1192008-02-27  David Hyatt  <hyatt@apple.com>
    220

  • trunk/WebCore/bindings/js/JSLocation.cpp

    r30534 r30634  
    302302    if (!frame)
    303303        return jsUndefined();
     304    if (!allowsAccessFromFrame(exec, frame))
     305        return jsUndefined();
    304306
    305307    const KURL& url = frame->loader()->url();

  • trunk/WebCore/bindings/js/kjs_window.cpp

    r30617 r30634  
    10741074    if (!thisObj->inherits(&Window::info))
    10751075        return throwError(exec, TypeError);
     1076    if (!static_cast<Window*>(thisObj)->allowsAccessFrom(exec))
     1077        return jsUndefined();
    10761078
    10771079    if (args.size() < 1)
    … …  
    11031105    if (!thisObj->inherits(&Window::info))
    11041106        return throwError(exec, TypeError);
     1107    if (!static_cast<Window*>(thisObj)->allowsAccessFrom(exec))
     1108        return jsUndefined();
    11051109
    11061110    if (args.size() < 1)
    … …  
    11321136        return throwError(exec, TypeError);
    11331137    Window* window = static_cast<Window*>(thisObj);
     1138    if (!window->allowsAccessFrom(exec))
     1139        return jsUndefined();
     1140
    11341141    Frame* frame = window->impl()->frame();
    11351142    if (!frame)
    … …  
    12211228        return throwError(exec, TypeError);
    12221229    Window* window = static_cast<Window*>(thisObj);
     1230    if (!window->allowsAccessFrom(exec))
     1231        return jsUndefined();
    12231232
    12241233    window->clearTimeout(args[0]->toInt32(exec));

  • trunk/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r30534 r30634  
    11501150            push(@implContent, "    $className* castedThisObj = static_cast<$className*>(thisObj);\n");
    11511151
     1152            if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} &&
     1153                !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
     1154                push(@implContent, "    if (!castedThisObj->allowsAccessFrom(exec))\n");
     1155                push(@implContent, "        return jsUndefined();\n");
     1156            }
     1157
    11521158            if ($function->signature->extendedAttributes->{"Custom"}) {
    1153                 push(@implContent, "        return castedThisObj->" . $codeGenerator->WK_lcfirst($function->signature->name) . "(exec, args);\n");
     1159                push(@implContent, "    return castedThisObj->" . $codeGenerator->WK_lcfirst($function->signature->name) . "(exec, args);\n");
    11541160            } else {
    11551161                if ($podType) {
Note: See TracChangeset for help on using the changeset viewer.