Changeset 243434 in webkit


Ignore:
Timestamp:
Mar 25, 2019 2:11:58 AM (4 years ago)
Author:
Carlos Garcia Campos
Message:

[GTK][WPE] Do not allow changes in active URI before provisional load starts for non-API requests
https://bugs.webkit.org/show_bug.cgi?id=194208

Reviewed by Michael Catanzaro.

  • UIProcess/API/glib/WebKitWebView.cpp:

(webkitWebViewWillStartLoad): Block updates of active URL.
(webkitWebViewLoadChanged): Unblock updates of active URL on WEBKIT_LOAD_STARTED.

Location:
trunk/Source/WebKit
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/WebKit/ChangeLog

    r243433 r243434  
     12019-03-25  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        [GTK][WPE] Do not allow changes in active URI before provisional load starts for non-API requests
     4        https://bugs.webkit.org/show_bug.cgi?id=194208
     5
     6        Reviewed by Michael Catanzaro.
     7
     8        * UIProcess/API/glib/WebKitWebView.cpp:
     9        (webkitWebViewWillStartLoad): Block updates of active URL.
     10        (webkitWebViewLoadChanged): Unblock updates of active URL on WEBKIT_LOAD_STARTED.
     11
    1122019-03-25  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
    213
  • trunk/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp

    r242788 r243434  
    247247    CString customTextEncoding;
    248248    CString activeURI;
     249    bool isActiveURIChangeBlocked;
    249250    bool isLoading;
    250251    bool isEphemeral;
     
    356357    void willChangeActiveURL() override
    357358    {
     359        if (m_webView->priv->isActiveURIChangeBlocked)
     360            return;
    358361        g_object_freeze_notify(G_OBJECT(m_webView));
    359362    }
    360363    void didChangeActiveURL() override
    361364    {
     365        if (m_webView->priv->isActiveURIChangeBlocked)
     366            return;
    362367        m_webView->priv->activeURI = getPage(m_webView).pageLoadState().activeURL().utf8();
    363368        g_object_notify(G_OBJECT(m_webView), "uri");
     
    20782083void webkitWebViewWillStartLoad(WebKitWebView* webView)
    20792084{
     2085    // Ignore the active URI changes happening before WEBKIT_LOAD_STARTED. If they are not user-initiated,
     2086    // they could be a malicious attempt to trick users by loading an invalid URI on a trusted host, with the load
     2087    // intended to stall, or perhaps be repeated. If we trust the URI here and display it to the user, then the user's
     2088    // only indication that something is wrong would be a page loading indicator. If the load request is not
     2089    // user-initiated, we must not trust it until WEBKIT_LOAD_COMMITTED. If the load is triggered by API
     2090    // request, then the active URI is already the pending API request URL, so the blocking is harmless and the
     2091    // client application will still see the URI update immediately. Otherwise, the URI update will be delayed a bit.
     2092    webView->priv->isActiveURIChangeBlocked = true;
     2093
    20802094    // This is called before NavigationClient::didStartProvisionalNavigation(), the page load state hasn't been committed yet.
    20812095    auto& pageLoadState = getPage(webView).pageLoadState();
     
    21002114        priv->loadingResourcesMap.clear();
    21012115        priv->mainResource = nullptr;
     2116        webView->priv->isActiveURIChangeBlocked = false;
    21022117        break;
     2118    case WEBKIT_LOAD_COMMITTED: {
     2119        auto activeURL = getPage(webView).pageLoadState().activeURL().utf8();
     2120        // Active URL is trusted now. If it's different to our active URI, due to the
     2121        // update block before WEBKIT_LOAD_STARTED, we update it here to be in sync
     2122        // again with the page load state.
     2123        if (activeURL != priv->activeURI) {
     2124            priv->activeURI = activeURL;
     2125            g_object_notify(G_OBJECT(webView), "uri");
     2126        }
    21032127#if PLATFORM(GTK)
    2104     case WEBKIT_LOAD_COMMITTED: {
    21052128        WebKitFaviconDatabase* database = webkit_web_context_get_favicon_database(priv->context.get());
    21062129        GUniquePtr<char> faviconURI(webkit_favicon_database_get_favicon_uri(database, priv->activeURI.data()));
    21072130        webkitWebViewUpdateFaviconURI(webView, faviconURI.get());
     2131#endif
    21082132        break;
    21092133    }
    2110 #endif
    21112134    case WEBKIT_LOAD_FINISHED:
    21122135        webkitWebViewCancelAuthenticationRequest(webView);
Note: See TracChangeset for help on using the changeset viewer.