Changeset 116695 in webkit

Timestamp:

May 10, 2012 3:45:41 PM (12 years ago)

Author:

andersca@apple.com

Message:

WebKit1: Add a way to blacklist specific plug-ins/plug-in versions
​https://bugs.webkit.org/show_bug.cgi?id=86150
<rdar://problem/9551196>

Reviewed by Sam Weinig.

Source/WebCore:

• English.lproj/Localizable.strings:

Update.

• loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::loadPlugin):
It is possible that the client has already set the unavailability reason so don't try to set it twice.

• platform/LocalizedStrings.cpp:

(WebCore::insecurePluginVersionText):

• platform/LocalizedStrings.h:

Add insecure plug-in version text.

• rendering/RenderEmbeddedObject.cpp:

(WebCore::RenderEmbeddedObject::unavailablePluginReplacementText):

• rendering/RenderEmbeddedObject.h:

Add InsecurePluginVersion unavailability reason.

Source/WebKit/mac:

• Misc/WebKitErrors.h:

Add WebKitErrorInsecurePlugInVersion enum.

• Plugins/WebBasePluginPackage.h:
• Plugins/WebBasePluginPackage.mm:

(-[WebBasePluginPackage bundleIdentifier]):
(-[WebBasePluginPackage bundleVersion]):
Add bundleIdentifier and bundleVersion getters.

• WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::createPlugin):
Check if the plug-in is blocked. If it is, set the unavailability reason and the error code.

WebKitLibraries:

Add WKShouldBlockPlugin.

• WebKitSystemInterface.h:
• libWebKitSystemInterfaceLion.a:
• libWebKitSystemInterfaceSnowLeopard.a:

Location:

trunk

Files:

• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/English.lproj/Localizable.strings (modified) (1 diff)
• Source/WebCore/loader/SubframeLoader.cpp (modified) (1 diff)
• Source/WebCore/platform/LocalizedStrings.cpp (modified) (1 diff)
• Source/WebCore/platform/LocalizedStrings.h (modified) (1 diff)
• Source/WebCore/rendering/RenderEmbeddedObject.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderEmbeddedObject.h (modified) (1 diff)
• Source/WebKit/mac/ChangeLog (modified) (1 diff)
• Source/WebKit/mac/Misc/WebKitErrors.h (modified) (1 diff)
• Source/WebKit/mac/Plugins/WebBasePluginPackage.h (modified) (1 diff)
• Source/WebKit/mac/Plugins/WebBasePluginPackage.mm (modified) (1 diff)
• Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm (modified) (1 diff)
• WebKitLibraries/ChangeLog (modified) (1 diff)
• WebKitLibraries/WebKitSystemInterface.h (modified) (1 diff)
• WebKitLibraries/libWebKitSystemInterfaceLion.a (modified) (previous)
• WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a (modified) (previous)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-10  Anders Carlsson  <andersca@apple.com>
+
+        WebKit1: Add a way to blacklist specific plug-ins/plug-in versions
+        https://bugs.webkit.org/show_bug.cgi?id=86150
+        <rdar://problem/9551196>
+
+        Reviewed by Sam Weinig.
+
+        * English.lproj/Localizable.strings:
+        Update.
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::loadPlugin):
+        It is possible that the client has already set the unavailability reason so don't try to set it twice.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::insecurePluginVersionText):
+        * platform/LocalizedStrings.h:
+        Add insecure plug-in version text.
+
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::unavailablePluginReplacementText):
+        * rendering/RenderEmbeddedObject.h:
+        Add InsecurePluginVersion unavailability reason.
+
 2012-05-10  Eric Seidel  <eric@webkit.org>
 

trunk/Source/WebCore/English.lproj/Localizable.strings

@@ -173 +173 @@
 "Indent (Undo action name)" = "Indent";
 
+/* Label text to be used when an insecure plug-in version was blocked from loading */
+"Insecure Plug-In Version" = "Insecure Plug-In Version";
+
 /* Undo action name */
 "Insert List (Undo action name)" = "Insert List";

trunk/Source/WebCore/loader/SubframeLoader.cpp

@@ -377 +377 @@
 
     if (!widget) {
-        renderer->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginMissing);
+        if (!renderer->showsUnavailablePluginIndicator())
+            renderer->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginMissing);
         return false;
     }

trunk/Source/WebCore/platform/LocalizedStrings.cpp

@@ -674 +674 @@
 }
 
+String insecurePluginVersionText()
+{
+    return WEB_UI_STRING("Insecure Plug-In Version", "Label text to be used when an insecure plug-in version was blocked from loading");
+}
+
 String multipleFileUploadText(unsigned numberOfFiles)
 {

trunk/Source/WebCore/platform/LocalizedStrings.h

@@ -168 +168 @@
     String missingPluginText();
     String crashedPluginText();
+    String insecurePluginVersionText();
     String multipleFileUploadText(unsigned numberOfFiles);
     String unknownFileSizeText();

trunk/Source/WebCore/rendering/RenderEmbeddedObject.cpp

@@ -215 +215 @@
     case PluginCrashed:
         return crashedPluginText();
+    case InsecurePluginVersion:
+        return insecurePluginVersionText();
     }
 

trunk/Source/WebCore/rendering/RenderEmbeddedObject.h

@@ -40 +40 @@
         PluginMissing,
         PluginCrashed,
+        InsecurePluginVersion
     };
     void setPluginUnavailabilityReason(PluginUnavailabilityReason);

trunk/Source/WebKit/mac/ChangeLog

@@ +1 @@
+2012-05-10  Anders Carlsson  <andersca@apple.com>
+
+        WebKit1: Add a way to blacklist specific plug-ins/plug-in versions
+        https://bugs.webkit.org/show_bug.cgi?id=86150
+        <rdar://problem/9551196>
+
+        Reviewed by Sam Weinig.
+
+        * Misc/WebKitErrors.h:
+        Add WebKitErrorInsecurePlugInVersion enum.
+
+        * Plugins/WebBasePluginPackage.h:
+        * Plugins/WebBasePluginPackage.mm:
+        (-[WebBasePluginPackage bundleIdentifier]):
+        (-[WebBasePluginPackage bundleVersion]):
+        Add bundleIdentifier and bundleVersion getters.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::createPlugin):
+        Check if the plug-in is blocked. If it is, set the unavailability reason and the error code.
+
 2012-05-10  Anders Carlsson  <andersca@apple.com>
 

trunk/Source/WebKit/mac/Misc/WebKitErrors.h

@@ -57 +57 @@
     WebKitErrorCannotLoadPlugIn =                               201,
     WebKitErrorJavaUnavailable =                                202,
+    WebKitErrorInsecurePlugInVersion =                          203,
 };

trunk/Source/WebKit/mac/Plugins/WebBasePluginPackage.h

@@ -78 +78 @@
 - (const WebCore::PluginInfo&)pluginInfo;
 
-- (WTF::String)bundleIdentifier;
+- (String)bundleIdentifier;
+- (String)bundleVersion;
 
 - (BOOL)supportsExtension:(const WTF::String&)extension;

trunk/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm

@@ -464 +464 @@
 }
 
-- (WTF::String)bundleIdentifier
+- (String)bundleIdentifier
 {
     return CFBundleGetIdentifier(cfBundle.get());
+}
+
+- (String)bundleVersion
+{
+    CFDictionaryRef infoDictionary = CFBundleGetInfoDictionary(cfBundle.get());
+    if (!infoDictionary)
+        return String();
+
+    CFTypeRef bundleVersionString = CFDictionaryGetValue(infoDictionary, kCFBundleVersionKey);
+    if (!bundleVersionString || CFGetTypeID(bundleVersionString) != CFStringGetTypeID())
+        return String();
+
+    return reinterpret_cast<CFStringRef>(bundleVersionString);
 }
 

trunk/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm

@@ -1666 +1666 @@
 
     if (pluginPackage) {
-        if ([pluginPackage isKindOfClass:[WebPluginPackage class]])
-            view = pluginView(m_webFrame.get(), (WebPluginPackage *)pluginPackage, attributeKeys, kit(paramValues), baseURL, kit(element), loadManually);
-            
+        if (!WKShouldBlockPlugin([pluginPackage bundleIdentifier], [pluginPackage bundleVersion])) {
+            if ([pluginPackage isKindOfClass:[WebPluginPackage class]])
+                view = pluginView(m_webFrame.get(), (WebPluginPackage *)pluginPackage, attributeKeys, kit(paramValues), baseURL, kit(element), loadManually);
+
 #if ENABLE(NETSCAPE_PLUGIN_API)
-        else if ([pluginPackage isKindOfClass:[WebNetscapePluginPackage class]]) {
-            WebBaseNetscapePluginView *pluginView = [[[NETSCAPE_PLUGIN_VIEW alloc]
-                initWithFrame:NSMakeRect(0, 0, size.width(), size.height())
-                pluginPackage:(WebNetscapePluginPackage *)pluginPackage
-                URL:pluginURL
-                baseURL:baseURL
-                MIMEType:MIMEType
-                attributeKeys:attributeKeys
-                attributeValues:kit(paramValues)
-                loadManually:loadManually
-                element:element] autorelease];
-            
-            return adoptRef(new NetscapePluginWidget(pluginView));
-        } 
+            else if ([pluginPackage isKindOfClass:[WebNetscapePluginPackage class]]) {
+                WebBaseNetscapePluginView *pluginView = [[[NETSCAPE_PLUGIN_VIEW alloc]
+                    initWithFrame:NSMakeRect(0, 0, size.width(), size.height())
+                    pluginPackage:(WebNetscapePluginPackage *)pluginPackage
+                    URL:pluginURL
+                    baseURL:baseURL
+                    MIMEType:MIMEType
+                    attributeKeys:attributeKeys
+                    attributeValues:kit(paramValues)
+                    loadManually:loadManually
+                    element:element] autorelease];
+
+                return adoptRef(new NetscapePluginWidget(pluginView));
+            }
 #endif
+        } else {
+            errorCode = WebKitErrorInsecurePlugInVersion;
+            if (element->renderer()->isEmbeddedObject())
+                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
+        }
     } else
         errorCode = WebKitErrorCannotFindPlugIn;

trunk/WebKitLibraries/ChangeLog

@@ +1 @@
+2012-05-10  Anders Carlsson  <andersca@apple.com>
+
+        WebKit1: Add a way to blacklist specific plug-ins/plug-in versions
+        https://bugs.webkit.org/show_bug.cgi?id=86150
+        <rdar://problem/9551196>
+
+        Reviewed by Sam Weinig.
+
+        Add WKShouldBlockPlugin.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLion.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
 2012-05-08  Jon Lee  <jonlee@apple.com>
 

trunk/WebKitLibraries/WebKitSystemInterface.h

@@ -93 +93 @@
 void WKUnregisterUniqueIdForElement(id element);
 
+BOOL WKShouldBlockPlugin(NSString *bundleIdentifier, NSString *bundleVersionString);
 
 #if MAC_OS_X_VERSION_MIN_REQUIRED >= 1060