Changeset 116608 in webkit

Timestamp:

May 9, 2012 10:31:29 PM (12 years ago)

Author:

creis@chromium.org

Message:

Source/WebCore: Add dispatchMessageEventWithOriginCheck to DOMWindow
​https://bugs.webkit.org/show_bug.cgi?id=85815

Reviewed by Adam Barth.

Useful for ports that support cross-process postMessage.
No new tests, since covered by existing postMessage tests.

• page/DOMWindow.cpp:

(WebCore::DOMWindow::postMessageTimerFired):
(WebCore):
(WebCore::DOMWindow::dispatchMessageEventWithOriginCheck):

• page/DOMWindow.h:

(WebCore):
(DOMWindow):

Source/WebKit/chromium: Add dispatchMessageEventWithOriginCheck to WebFrame
​https://bugs.webkit.org/show_bug.cgi?id=85815

Reviewed by Adam Barth.

Tested by WebFrameTest.DispatchMessageEventWithOriginCheck.
Also fixes source frame bug in willCheckAndDispatchMessageEvent.

• public/WebFrame.h:

(WebFrame):

• src/FrameLoaderClientImpl.cpp:

(WebKit::FrameLoaderClientImpl::willCheckAndDispatchMessageEvent):

• src/WebFrameImpl.cpp:

(WebKit::WebFrameImpl::checkAndDispatchMessageEvent):
(WebKit):

• src/WebFrameImpl.h:

(WebFrameImpl):

Location:

trunk/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/page/DOMWindow.cpp (modified) (1 diff)
• WebCore/page/DOMWindow.h (modified) (3 diffs)
• WebKit/chromium/ChangeLog (modified) (1 diff)
• WebKit/chromium/public/WebFrame.h (modified) (1 diff)
• WebKit/chromium/src/FrameLoaderClientImpl.cpp (modified) (1 diff)
• WebKit/chromium/src/WebFrameImpl.cpp (modified) (2 diffs)
• WebKit/chromium/src/WebFrameImpl.h (modified) (1 diff)
• WebKit/chromium/tests/WebFrameTest.cpp (modified) (2 diffs)
• WebKit/chromium/tests/data/postmessage_test.html (added)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-09  Charlie Reis  <creis@chromium.org>
+
+        Add dispatchMessageEventWithOriginCheck to DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=85815
+
+        Reviewed by Adam Barth.
+
+        Useful for ports that support cross-process postMessage.
+        No new tests, since covered by existing postMessage tests.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore):
+        (WebCore::DOMWindow::dispatchMessageEventWithOriginCheck):
+        * page/DOMWindow.h:
+        (WebCore):
+        (DOMWindow):
+
 2012-05-09  Jason Liu  <jason.liu@torchmobile.com.cn>
 

trunk/Source/WebCore/page/DOMWindow.cpp

@@ -867 +867 @@
         return;
 
-    if (timer->targetOrigin()) {
+    dispatchMessageEventWithOriginCheck(timer->targetOrigin(), event, timer->stackTrace());
+}
+
+void DOMWindow::dispatchMessageEventWithOriginCheck(SecurityOrigin* intendedTargetOrigin, PassRefPtr<Event> event, PassRefPtr<ScriptCallStack> stackTrace)
+{
+    if (intendedTargetOrigin) {
         // Check target origin now since the target document may have changed since the timer was scheduled.
-        if (!timer->targetOrigin()->isSameSchemeHostPort(document()->securityOrigin())) {
-            String message = "Unable to post message to " + timer->targetOrigin()->toString() +
+        if (!intendedTargetOrigin->isSameSchemeHostPort(document()->securityOrigin())) {
+            String message = "Unable to post message to " + intendedTargetOrigin->toString() +
                              ". Recipient has origin " + document()->securityOrigin()->toString() + ".\n";
-            console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, timer->stackTrace());
+            console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, stackTrace);
             return;
         }

trunk/Source/WebCore/page/DOMWindow.h

@@ -55 +55 @@
     class Location;
     class MediaQueryList;
+    class MessageEvent;
     class Navigator;
     class Node;
@@ -62 +63 @@
     class ScheduledAction;
     class Screen;
+    class ScriptCallStack;
     class SecurityOrigin;
     class SerializedScriptValue;
@@ -234 +236 @@
         void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         void postMessageTimerFired(PassOwnPtr<PostMessageTimer>);
+        void dispatchMessageEventWithOriginCheck(SecurityOrigin* intendedTargetOrigin, PassRefPtr<Event>, PassRefPtr<ScriptCallStack>);
 
         void scrollBy(int x, int y) const;

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2012-05-09  Charlie Reis  <creis@chromium.org>
+
+        Add dispatchMessageEventWithOriginCheck to WebFrame
+        https://bugs.webkit.org/show_bug.cgi?id=85815
+
+        Reviewed by Adam Barth.
+
+        Tested by WebFrameTest.DispatchMessageEventWithOriginCheck.
+        Also fixes source frame bug in willCheckAndDispatchMessageEvent.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::willCheckAndDispatchMessageEvent):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::checkAndDispatchMessageEvent):
+        (WebKit):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
 2012-05-09  Hironori Bono  <hbono@chromium.org>
 

trunk/Source/WebKit/chromium/public/WebFrame.h

@@ -582 +582 @@
                                      WebDOMEventListener*, bool useCapture) = 0;
     virtual bool dispatchEvent(const WebDOMEvent&) = 0;
+    virtual void dispatchMessageEventWithOriginCheck(
+        const WebSecurityOrigin& intendedTargetOrigin,
+        const WebDOMEvent&) = 0;
 
 

trunk/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp

@@ -1599 +1599 @@
         return false;
 
+    WebFrame* source = 0;
+    if (event && event->source() && event->source()->document())
+        source = WebFrameImpl::fromFrame(event->source()->document()->frame());
     return m_webFrame->client()->willCheckAndDispatchMessageEvent(
-        m_webFrame, WebSecurityOrigin(target), WebDOMMessageEvent(event));
+        source, WebSecurityOrigin(target), WebDOMMessageEvent(event));
 }
 

trunk/Source/WebKit/chromium/src/WebFrameImpl.cpp

@@ -123 +123 @@
 #include "ResourceRequest.h"
 #include "SchemeRegistry.h"
+#include "ScriptCallStack.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
@@ -1894 +1895 @@
 }
 
+void WebFrameImpl::dispatchMessageEventWithOriginCheck(const WebSecurityOrigin& intendedTargetOrigin, const WebDOMEvent& event)
+{
+    ASSERT(!event.isNull());
+    // Pass an empty call stack, since we don't have the one from the other process.
+    m_frame->domWindow()->dispatchMessageEventWithOriginCheck(intendedTargetOrigin.get(), event, 0);
+}
+
 WebString WebFrameImpl::contentAsText(size_t maxChars) const
 {

trunk/Source/WebKit/chromium/src/WebFrameImpl.h

@@ -215 +215 @@
                                      WebDOMEventListener*, bool useCapture);
     virtual bool dispatchEvent(const WebDOMEvent&);
+    virtual void dispatchMessageEventWithOriginCheck(
+        const WebSecurityOrigin& intendedTargetOrigin,
+        const WebDOMEvent&);
 
     virtual WebString contentAsText(size_t maxChars) const;

trunk/Source/WebKit/chromium/tests/WebFrameTest.cpp

@@ -41 +41 @@
 #include "WebScriptSource.h"
 #include "WebSearchableFormData.h"
+#include "WebSecurityOrigin.h"
 #include "WebSecurityPolicy.h"
 #include "WebSettings.h"
@@ -151 +152 @@
     EXPECT_NE(std::string::npos, content.find("Simulated Chromium History Page"));
     EXPECT_EQ(std::string::npos, content.find("Clobbered"));
+}
+
+TEST_F(WebFrameTest, DispatchMessageEventWithOriginCheck)
+{
+    registerMockedHttpURLLoad("postmessage_test.html");
+
+    // Pass true to enable JavaScript.
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "postmessage_test.html", true);
+    
+    // Send a message with the correct origin.
+    WebSecurityOrigin correctOrigin(WebSecurityOrigin::create(GURL(m_baseURL)));
+    WebDOMEvent event = webView->mainFrame()->document().createEvent("MessageEvent");
+    WebDOMMessageEvent message = event.to<WebDOMMessageEvent>();
+    WebSerializedScriptValue data(WebSerializedScriptValue::fromString("foo"));
+    message.initMessageEvent("message", false, false, data, "http://origin.com", 0, "");
+    webView->mainFrame()->dispatchMessageEventWithOriginCheck(correctOrigin, message);
+
+    // Send another message with incorrect origin.
+    WebSecurityOrigin incorrectOrigin(WebSecurityOrigin::create(GURL(m_chromeURL)));
+    webView->mainFrame()->dispatchMessageEventWithOriginCheck(incorrectOrigin, message);
+
+    // Required to see any updates in contentAsText.
+    webView->layout();
+
+    // Verify that only the first addition is in the body of the page.
+    std::string content = webView->mainFrame()->contentAsText(1024).utf8();
+    EXPECT_NE(std::string::npos, content.find("Message 1."));
+    EXPECT_EQ(std::string::npos, content.find("Message 2."));
 }