Changeset 280870 in webkit


Ignore:
Timestamp:
Aug 10, 2021 4:19:03 PM (11 months ago)
Author:
Chris Dumez
Message:

Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
​https://bugs.webkit.org/show_bug.cgi?id=228965

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline WPT tests that are now passing.

  • web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt:
  • web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt:

Source/WebCore:

Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set:

Firefox and Chrome already behave this way.

No new tests, rebaselined existing tests.

  • dom/Document.cpp:

(WebCore::Document::processMetaHttpEquiv):

  • dom/Document.h:
  • html/HTMLMetaElement.cpp:

(WebCore::HTMLMetaElement::process):

  • loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::responseReceived):

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::receivedFirstData):
(WebCore::FrameLoader::scheduleRefreshIfNeeded):

  • loader/FrameLoader.h:
  • loader/FrameLoaderTypes.h:
  • loader/NavigationScheduler.cpp:

(WebCore::ScheduledRedirect::ScheduledRedirect):
(WebCore::NavigationScheduler::scheduleRedirect):

  • loader/NavigationScheduler.h:

LayoutTests:

Unskip tests that should no longer be flaky now that they are passing.

Location:
trunk
Files:
15 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r280862 r280870  
     12021-08-10  Chris Dumez  <cdumez@apple.com>
     2
     3        Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
     4        https://bugs.webkit.org/show_bug.cgi?id=228965
     5
     6        Reviewed by Darin Adler.
     7
     8        Unskip tests that should no longer be flaky now that they are passing.
     9
     10        * TestExpectations:
     11
    1122021-08-10  Ayumi Kojima  <ayumi_kojima@apple.com>
    213

  • trunk/LayoutTests/TestExpectations

    r280827 r280870  
    15051505# Flaky tests at import time
    15061506imported/w3c/web-platform-tests/css/css-scoping/css-scoping-shadow-host-namespace.html [ ImageOnlyFailure ]
    1507 
    1508 # Those WPT tests are flaky when failing.
    1509 imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1.html [ Pass Failure ]
    1510 imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2.html [ Pass Failure ]
    15111507
    15121508# WPT tests for custom elements

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r280855 r280870  
     12021-08-10  Chris Dumez  <cdumez@apple.com>
     2
     3        Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
     4        https://bugs.webkit.org/show_bug.cgi?id=228965
     5
     6        Reviewed by Darin Adler.
     7
     8        Rebaseline WPT tests that are now passing.
     9
     10        * web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt:
     11        * web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt:
     12
    1132021-08-10  Chris Dumez  <cdumez@apple.com>
    214

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt

    r259900 r280870  
    1 CONSOLE MESSAGE: TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
     1CONSOLE MESSAGE: Unable to do meta refresh due to sandboxing
    22
    3 FAIL Meta refresh is blocked by the allow-scripts sandbox flag at its creation time, not when refresh comes due TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
     3PASS Meta refresh is blocked by the allow-scripts sandbox flag at its creation time, not when refresh comes due
    44

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt

    r259900 r280870  
    1 CONSOLE MESSAGE: TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
     1CONSOLE MESSAGE: Unable to do meta refresh due to sandboxing
    22
    3 FAIL Meta refresh of the original iframe is not blocked if moved into a sandboxed iframe TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
     3PASS Meta refresh of the original iframe is not blocked if moved into a sandboxed iframe
    44

  • trunk/Source/WebCore/ChangeLog

    r280861 r280870  
     12021-08-10  Chris Dumez  <cdumez@apple.com>
     2
     3        Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
     4        https://bugs.webkit.org/show_bug.cgi?id=228965
     5
     6        Reviewed by Darin Adler.
     7
     8        Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set:
     9        - https://html.spec.whatwg.org/multipage/semantics.html#shared-declarative-refresh-steps (Step 13)
     10
     11        Firefox and Chrome already behave this way.
     12
     13        No new tests, rebaselined existing tests.
     14
     15        * dom/Document.cpp:
     16        (WebCore::Document::processMetaHttpEquiv):
     17        * dom/Document.h:
     18        * html/HTMLMetaElement.cpp:
     19        (WebCore::HTMLMetaElement::process):
     20        * loader/DocumentLoader.cpp:
     21        (WebCore::DocumentLoader::responseReceived):
     22        * loader/FrameLoader.cpp:
     23        (WebCore::FrameLoader::receivedFirstData):
     24        (WebCore::FrameLoader::scheduleRefreshIfNeeded):
     25        * loader/FrameLoader.h:
     26        * loader/FrameLoaderTypes.h:
     27        * loader/NavigationScheduler.cpp:
     28        (WebCore::ScheduledRedirect::ScheduledRedirect):
     29        (WebCore::NavigationScheduler::scheduleRedirect):
     30        * loader/NavigationScheduler.h:
     31
    1322021-08-10  Ryosuke Niwa  <rniwa@webkit.org>
    233

  • trunk/Source/WebCore/dom/Document.cpp

    r280855 r280870  
    37373737}
    37383738
    3739 void Document::processHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead)
     3739void Document::processMetaHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead)
    37403740{
    37413741    ASSERT(!equiv.isNull());
    … …  
    37823782    case HTTPHeaderName::Refresh:
    37833783        if (frame)
    3784             frame->loader().scheduleRefreshIfNeeded(*this, content);
     3784            frame->loader().scheduleRefreshIfNeeded(*this, content, IsMetaRefresh::Yes);
    37853785        break;
    37863786

  • trunk/Source/WebCore/dom/Document.h

    r280855 r280870  
    893893    // tag. This enables scripts to use meta tags to perform refreshes and set expiry dates in addition to them being
    894894    // specified in an HTML file.
    895     void processHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead);
     895    void processMetaHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead);
    896896
    897897#if PLATFORM(IOS_FAMILY)

  • trunk/Source/WebCore/html/HTMLMetaElement.cpp

    r278340 r280870  
    182182    const AtomString& httpEquivValue = attributeWithoutSynchronization(http_equivAttr);
    183183    if (!httpEquivValue.isNull())
    184         document().processHttpEquiv(httpEquivValue, contentValue, isDescendantOf(document().head()));
     184        document().processMetaHttpEquiv(httpEquivValue, contentValue, isDescendantOf(document().head()));
    185185}
    186186

  • trunk/Source/WebCore/loader/DocumentLoader.cpp

    r280504 r280870  
    928928            if (auto loginDomains = NetworkStorageSession::subResourceDomainsInNeedOfStorageAccessForFirstParty(firstPartyDomain)) {
    929929                if (!Quirks::hasStorageAccessForAllLoginDomains(*loginDomains, firstPartyDomain)) {
    930                     m_frame->navigationScheduler().scheduleRedirect(document, 0, microsoftTeamsRedirectURL());
     930                    m_frame->navigationScheduler().scheduleRedirect(document, 0, microsoftTeamsRedirectURL(), IsMetaRefresh::No);
    931931                    return;
    932932                }

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r280859 r280870  
    714714    LinkLoader::loadLinksFromHeader(documentLoader.response().httpHeaderField(HTTPHeaderName::Link), document.url(), document, LinkLoader::MediaAttributeCheck::MediaAttributeEmpty);
    715715
    716     scheduleRefreshIfNeeded(document, documentLoader.response().httpHeaderField(HTTPHeaderName::Refresh));
     716    scheduleRefreshIfNeeded(document, documentLoader.response().httpHeaderField(HTTPHeaderName::Refresh), IsMetaRefresh::No);
    717717}
    718718
    … …  
    29692969}
    29702970
    2971 void FrameLoader::scheduleRefreshIfNeeded(Document& document, const String& content)
     2971void FrameLoader::scheduleRefreshIfNeeded(Document& document, const String& content, IsMetaRefresh isMetaRefresh)
    29722972{
    29732973    double delay = 0;
    … …  
    29762976        auto completedURL = urlString.isEmpty() ? document.url() : document.completeURL(urlString);
    29772977        if (!completedURL.protocolIsJavaScript())
    2978             m_frame.navigationScheduler().scheduleRedirect(document, delay, completedURL);
     2978            m_frame.navigationScheduler().scheduleRedirect(document, delay, completedURL, isMetaRefresh);
    29792979        else {
    29802980            String message = "Refused to refresh " + document.url().stringCenterEllipsizedToLength() + " to a javascript: URL";

  • trunk/Source/WebCore/loader/FrameLoader.h

    r280504 r280870  
    320320    void updateRequestAndAddExtraFields(ResourceRequest&, IsMainResource, FrameLoadType = FrameLoadType::Standard, ShouldUpdateAppInitiatedValue = ShouldUpdateAppInitiatedValue::Yes);
    321321
    322     void scheduleRefreshIfNeeded(Document&, const String& content);
     322    void scheduleRefreshIfNeeded(Document&, const String& content, IsMetaRefresh);
    323323
    324324    void switchBrowsingContextsGroup();

  • trunk/Source/WebCore/loader/FrameLoaderTypes.h

    r278253 r280870  
    7070};
    7171
     72enum class IsMetaRefresh : bool { No, Yes };
    7273enum class WillContinueLoading : bool { No, Yes };
    7374

  • trunk/Source/WebCore/loader/NavigationScheduler.cpp

    r271124 r280870  
    168168class ScheduledRedirect : public ScheduledURLNavigation {
    169169public:
    170     ScheduledRedirect(Document& initiatingDocument, double delay, SecurityOrigin* securityOrigin, const URL& url, LockHistory lockHistory, LockBackForwardList lockBackForwardList)
     170    ScheduledRedirect(Document& initiatingDocument, double delay, SecurityOrigin* securityOrigin, const URL& url, LockHistory lockHistory, LockBackForwardList lockBackForwardList, IsMetaRefresh isMetaRefresh)
    171171        : ScheduledURLNavigation(initiatingDocument, delay, securityOrigin, url, String(), lockHistory, lockBackForwardList, false, false)
     172        , m_isMetaRefresh(isMetaRefresh)
    172173    {
    173174        clearUserGesture();
    … …  
    181182    void fire(Frame& frame) override
    182183    {
     184        if (m_isMetaRefresh == IsMetaRefresh::Yes) {
     185            if (auto document = frame.document(); document && document->isSandboxed(SandboxAutomaticFeatures)) {
     186                document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, "Unable to do meta refresh due to sandboxing"_s);
     187                return;
     188            }
     189        }
     190
    183191        UserGestureIndicator gestureIndicator { userGestureToForward() };
    184192
    … …  
    195203        frame.loader().changeLocation(WTFMove(frameLoadRequest));
    196204    }
     205
     206private:
     207    IsMetaRefresh m_isMetaRefresh;
    197208};
    198209
    … …  
    408419}
    409420
    410 void NavigationScheduler::scheduleRedirect(Document& initiatingDocument, double delay, const URL& url)
     421void NavigationScheduler::scheduleRedirect(Document& initiatingDocument, double delay, const URL& url, IsMetaRefresh isMetaRefresh)
    411422{
    412423    if (!shouldScheduleNavigation(url))
    … …  
    420431    if (!m_redirect || delay <= m_redirect->delay()) {
    421432        auto lockBackForwardList = delay <= 1 ? LockBackForwardList::Yes : LockBackForwardList::No;
    422         schedule(makeUnique<ScheduledRedirect>(initiatingDocument, delay, &m_frame.document()->securityOrigin(), url, LockHistory::Yes, lockBackForwardList));
     433        schedule(makeUnique<ScheduledRedirect>(initiatingDocument, delay, &m_frame.document()->securityOrigin(), url, LockHistory::Yes, lockBackForwardList, isMetaRefresh));
    423434    }
    424435}

  • trunk/Source/WebCore/loader/NavigationScheduler.h

    r248762 r280870  
    5555    bool locationChangePending();
    5656
    57     void scheduleRedirect(Document& initiatingDocument, double delay, const URL&);
     57    void scheduleRedirect(Document& initiatingDocument, double delay, const URL&, IsMetaRefresh);
    5858    void scheduleLocationChange(Document& initiatingDocument, SecurityOrigin&, const URL&, const String& referrer, LockHistory = LockHistory::Yes, LockBackForwardList = LockBackForwardList::Yes, CompletionHandler<void()>&& = [] { });
    5959    void scheduleFormSubmission(Ref<FormSubmission>&&);
Note: See TracChangeset for help on using the changeset viewer.