Changeset 118105 in webkit


Ignore:
Timestamp:
May 22, 2012 7:49:58 PM (12 years ago)
Author:
commit-queue@webkit.org
Message:

[BlackBerry] Possible to clobber httponly cookie.
​https://bugs.webkit.org/show_bug.cgi?id=86067

Patch by Jason Liu <​jason.liu@torchmobile.com.cn> on 2012-05-22
Reviewed by Rob Buis.

Source/WebCore:

If a cookie is set by javaScript and there is already a same httpOnly cookie in cookieManager,
we should reject it. If it has a httpOnly property, we reject it, too.

Test: http/tests/cookies/js-get-and-set-http-only-cookie.php

  • platform/blackberry/CookieJarBlackBerry.cpp:

(WebCore::setCookies):

  • platform/blackberry/CookieManager.cpp:

(WebCore::CookieManager::setCookies):
(WebCore::CookieManager::shouldRejectNotHttpCookie):
(WebCore):

  • platform/blackberry/CookieManager.h:

LayoutTests:

  • http/tests/cookies/js-get-and-set-http-only-cookie-expected.txt: Added.
  • http/tests/cookies/js-get-and-set-http-only-cookie.php: Added.
  • http/tests/cookies/script-tests/js-get-and-set-http-only-cookie.js: Added.
Location:
trunk
Files:
3 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r118103 r118105  
     12012-05-22  Jason Liu  <jason.liu@torchmobile.com.cn>
     2
     3        [BlackBerry] Possible to clobber httponly cookie.
     4        https://bugs.webkit.org/show_bug.cgi?id=86067
     5
     6        Reviewed by Rob Buis.
     7
     8        * http/tests/cookies/js-get-and-set-http-only-cookie-expected.txt: Added.
     9        * http/tests/cookies/js-get-and-set-http-only-cookie.php: Added.
     10        * http/tests/cookies/script-tests/js-get-and-set-http-only-cookie.js: Added.
     11
    1122012-05-22  Kangil Han  <kangil.han@samsung.com>
    213

  • trunk/Source/WebCore/ChangeLog

    r118104 r118105  
     12012-05-22  Jason Liu  <jason.liu@torchmobile.com.cn>
     2
     3        [BlackBerry] Possible to clobber httponly cookie.
     4        https://bugs.webkit.org/show_bug.cgi?id=86067
     5
     6        Reviewed by Rob Buis.
     7
     8        If a cookie is set by javaScript and there is already a same httpOnly cookie in cookieManager,
     9        we should reject it. If it has a httpOnly property, we reject it, too.
     10
     11        Test: http/tests/cookies/js-get-and-set-http-only-cookie.php
     12
     13        * platform/blackberry/CookieJarBlackBerry.cpp:
     14        (WebCore::setCookies):
     15        * platform/blackberry/CookieManager.cpp:
     16        (WebCore::CookieManager::setCookies):
     17        (WebCore::CookieManager::shouldRejectNotHttpCookie):
     18        (WebCore):
     19        * platform/blackberry/CookieManager.h:
     20
    1212012-05-22  Dana Jansens  <danakj@chromium.org>
    222

  • trunk/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp

    r108722 r118105  
    7070
    7171    ASSERT(document && url == document->cookieURL());
    72     cookieManager().setCookies(url, value);
     72    cookieManager().setCookies(url, value, NoHttpOnlyCookie);
    7373}
    7474

  • trunk/Source/WebCore/platform/blackberry/CookieManager.cpp

    r117261 r118105  
    132132}
    133133
    134 void CookieManager::setCookies(const KURL& url, const String& value)
     134void CookieManager::setCookies(const KURL& url, const String& value, CookieFilter filter)
    135135{
    136136    CookieLog("CookieManager - Setting cookies");
    … …  
    140140    for (size_t i = 0; i < cookies.size(); ++i) {
    141141        BackingStoreRemovalPolicy treatment = m_privateMode ? DoNotRemoveFromBackingStore : RemoveFromBackingStore;
    142         checkAndTreatCookie(cookies[i], treatment);
     142        checkAndTreatCookie(cookies[i], treatment, filter);
    143143    }
    144144}
    … …  
    307307}
    308308
    309 void CookieManager::checkAndTreatCookie(ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
     309void CookieManager::checkAndTreatCookie(ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore, CookieFilter filter)
    310310{
    311311    CookieLog("CookieManager - checkAndTreatCookie - processing url with domain - %s & protocol %s\n", candidateCookie->domain().utf8().data(), candidateCookie->protocol().utf8().data());
     312
     313    // A cookie which is not from http shouldn't have a httpOnly property.
     314    if (filter == NoHttpOnlyCookie && candidateCookie->isHttpOnly()) {
     315        delete candidateCookie;
     316        return;
     317    }
    312318
    313319    const bool ignoreDomain = shouldIgnoreDomain(candidateCookie->protocol());
    … …  
    357363        else if (curMap) {
    358364            // RemoveCookie will return 0 if the cookie doesn't exist.
    359             ParsedCookie* expired = curMap->removeCookie(candidateCookie);
     365            ParsedCookie* expired = curMap->removeCookie(candidateCookie, filter);
    360366            // Cookie is useless, Remove the cookie from the backingstore if it exists.
    361367            // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum.
    … …  
    370376    } else {
    371377        ASSERT(curMap);
    372         addCookieToMap(curMap, candidateCookie, postToBackingStore);
    373     }
    374 }
    375 
    376 void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
    377 {
    378     ParsedCookie* prevCookie = targetMap->addOrReplaceCookie(candidateCookie);
    379     if (prevCookie) {
     378        addCookieToMap(curMap, candidateCookie, postToBackingStore, filter);
     379    }
     380}
     381
     382void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore, CookieFilter filter)
     383{
     384    ParsedCookie* replacedCookie = 0;
     385
     386    if (!targetMap->addOrReplaceCookie(candidateCookie, &replacedCookie, filter)) {
     387
     388        CookieLog("CookieManager - rejecting new cookie - %s.\n", candidateCookie->toString().utf8().data());
     389
     390        delete candidateCookie;
     391        return;
     392    }
     393 
     394    if (replacedCookie) {
    380395
    381396        CookieLog("CookieManager - updating new cookie - %s.\n", candidateCookie->toString().utf8().data());
    … …  
    386401        // If both sessions are non-session, then we update it in the backingstore
    387402        bool newIsSession = candidateCookie->isSession();
    388         bool oldIsSession = prevCookie->isSession();
     403        bool oldIsSession = replacedCookie->isSession();
    389404
    390405        if (postToBackingStore == RemoveFromBackingStore) {
    … …  
    395410                // the cookie was removed in cookieVector.
    396411                removedCookie();
    397                 m_cookieBackingStore->remove(prevCookie);
     412                m_cookieBackingStore->remove(replacedCookie);
    398413            } else if (!newIsSession && oldIsSession) {
    399414                // Must manually increase the counter because it was not counted when
    … …  
    403418            }
    404419        }
    405         delete prevCookie;
     420        delete replacedCookie;
    406421        return;
    407422    }
    … …  
    457472}
    458473
    459 void CookieManager::setPrivateMode(const bool mode)
     474void CookieManager::setPrivateMode(bool mode)
    460475{
    461476    if (m_privateMode == mode)
    … …  
    501516}
    502517
    503 
    504518void CookieManager::removeCookieWithName(const KURL& url, const String& cookieName)
    505519{

  • trunk/Source/WebCore/platform/blackberry/CookieManager.h

    r117261 r118105  
    5050};
    5151
    52 enum CookieFilter {
    53     NoHttpOnlyCookie,
    54     WithHttpOnlyCookies,
    55 };
    56 
    5752enum CookieStorageAcceptPolicy {
    5853    CookieStorageAcceptPolicyAlways,
    … …  
    8075    void setCanLocalAccessAllCookies(bool enabled) { m_shouldDumpAllCookies = enabled; }
    8176
    82     void setCookies(const KURL&, const String& value);
     77    void setCookies(const KURL&, const String& value, CookieFilter = WithHttpOnlyCookies);
    8378
    8479    void removeAllCookies(BackingStoreRemovalPolicy);
    … …  
    10297    void setCookiePolicy(CookieStorageAcceptPolicy policy) { m_policy = policy; }
    10398    CookieStorageAcceptPolicy cookiePolicy() const { return m_policy; }
    104     void setPrivateMode(const bool);
     99    void setPrivateMode(bool);
    105100
    106101    String generateHtmlFragmentForCookies();
    … …  
    118113    virtual ~CookieManager();
    119114
    120     void checkAndTreatCookie(ParsedCookie*, BackingStoreRemovalPolicy);
     115    void checkAndTreatCookie(ParsedCookie*, BackingStoreRemovalPolicy, CookieFilter = WithHttpOnlyCookies);
    121116
    122     void addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore);
     117    void addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore, CookieFilter = WithHttpOnlyCookies);
    123118
    124119    CookieMap* findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly);

  • trunk/Source/WebCore/platform/blackberry/CookieMap.cpp

    r114230 r118105  
    5555}
    5656
    57 ParsedCookie* CookieMap::addOrReplaceCookie(ParsedCookie* cookie)
     57bool CookieMap::addOrReplaceCookie(ParsedCookie* candidateCookie, ParsedCookie** replacedCookie, CookieFilter filter)
    5858{
    5959    CookieLog("CookieMap - Attempting to add cookie - %s", cookie->name().utf8().data());
    6060
    61     ParsedCookie* prevCookie = 0;
    6261    size_t cookieCount = m_cookieVector.size();
    6362    for (size_t i = 0; i < cookieCount; i++) {
    64         if (m_cookieVector[i]->name() == cookie->name() && m_cookieVector[i]->path() == cookie->path()) {
    65             prevCookie = m_cookieVector[i];
    66             m_cookieVector[i] = cookie;
    67             if (prevCookie == m_oldestCookie)
     63        if (m_cookieVector[i]->name() == candidateCookie->name() && m_cookieVector[i]->path() == candidateCookie->path()) {
     64
     65            if (filter == NoHttpOnlyCookie && m_cookieVector[i]->isHttpOnly())
     66                return false;
     67
     68            *replacedCookie = m_cookieVector[i];
     69            m_cookieVector[i] = candidateCookie;
     70            if (*replacedCookie == m_oldestCookie)
    6871                updateOldestCookie();
    69             return prevCookie;
    70         }
    71     }
    72 
    73     m_cookieVector.append(cookie);
    74     if (!cookie->isSession())
     72            return true;
     73        }
     74    }
     75
     76    m_cookieVector.append(candidateCookie);
     77    if (!candidateCookie->isSession())
    7578        cookieManager().addedCookie();
    76     if (!m_oldestCookie || m_oldestCookie->lastAccessed() > cookie->lastAccessed())
    77         m_oldestCookie = cookie;
    78     return 0;
     79    if (!m_oldestCookie || m_oldestCookie->lastAccessed() > candidateCookie->lastAccessed())
     80        m_oldestCookie = candidateCookie;
     81    return true;
    7982}
    8083
    … …  
    100103}
    101104
    102 ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
     105ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie, CookieFilter filter)
    103106{
    104107    size_t cookieCount = m_cookieVector.size();
    105108    for (size_t position = 0; position < cookieCount; ++position) {
    106         if (m_cookieVector[position]->name() == cookie->name() && m_cookieVector[position]->path() == cookie->path())
     109        if (m_cookieVector[position]->name() == cookie->name() && m_cookieVector[position]->path() == cookie->path()) {
     110            if (filter == NoHttpOnlyCookie && m_cookieVector[position]->isHttpOnly())
     111                return 0;
    107112            return removeCookieAtIndex(position, cookie);
     113        }
    108114    }
    109115    return 0;

  • trunk/Source/WebCore/platform/blackberry/CookieMap.h

    r111258 r118105  
    3535namespace WebCore {
    3636
     37enum CookieFilter {
     38    NoHttpOnlyCookie,
     39    WithHttpOnlyCookies,
     40};
     41
    3742class ParsedCookie;
    3843
    … …  
    5560    const String& getName() const { return m_name; }
    5661
    57     // Returning the original cookie object so manager can keep a reference to the updates in the database queue.
    58     ParsedCookie* addOrReplaceCookie(ParsedCookie*);
     62    // Return false if the candidateCookie is rejected.
     63    bool addOrReplaceCookie(ParsedCookie* candidateCookie, ParsedCookie** replacedCookie, CookieFilter = WithHttpOnlyCookies);
    5964
    6065    // Need to return the reference to the removed cookie so manager can deal with it (garbage collect).
    61     ParsedCookie* removeCookie(const ParsedCookie*);
     66    ParsedCookie* removeCookie(const ParsedCookie*, CookieFilter = WithHttpOnlyCookies);
    6267
    6368    // Returns a map with that given subdomain.
Note: See TracChangeset for help on using the changeset viewer.