Changeset 127481 in webkit


Ignore:
Timestamp:
Sep 4, 2012 11:58:19 AM (12 years ago)
Author:
commit-queue@webkit.org
Message:

Automatic features should work in sandboxed iframes if "allow-scripts" flag is set
​https://bugs.webkit.org/show_bug.cgi?id=93961

Patch by Christophe Dumez <Christophe Dumez> on 2012-09-04
Reviewed by Adam Barth.

Source/WebCore:

Allow automatic features (video autoplay and form control
autofocus) in a sandboxed iframe that has "allow-scripts"
flag set. This behavior is according to the latest
specification at:
​http://dev.w3.org/html5/spec/browsers.html#attr-iframe-sandbox-allow-same-origin

This sandboxed automatic features browsing context flag is
relaxed by the same keyword as scripts, because when
scripts are enabled these features are trivially possible
anyway, and it would be unfortunate to force authors to
use script to do them when sandboxed rather than allowing
them to use the declarative features.

Tests: fast/forms/autofocus-in-sandbox-with-allow-scripts.html

media/auto-play-in-sandbox-with-allow-scripts.html

  • dom/SecurityContext.cpp:

(WebCore::SecurityContext::parseSandboxPolicy):

LayoutTests:

Add layout tests to check that automatic features (video
autoplay and form control autofocus) are allowed / working
in sandboxed iframes if the "allow-scripts" flag is set.
This behavior is according to the latest specification at:
​http://dev.w3.org/html5/spec/browsers.html#attr-iframe-sandbox-allow-same-origin

The tests to check that automatic features are blocked in
sandboxed iframes have been removed since they relied on
the "allow-scripts" flag to work.

  • fast/forms/autofocus-in-sandbox-with-allow-scripts-expected.txt: Added.
  • fast/forms/autofocus-in-sandbox-with-allow-scripts.html: Renamed from LayoutTests/fast/forms/no-autofocus-in-sandbox.html.
  • fast/forms/no-autofocus-in-sandbox-expected.txt: Removed.
  • media/auto-play-in-sandbox-with-allow-scripts-expected.txt: Added.
  • media/auto-play-in-sandbox-with-allow-scripts.html: Renamed from LayoutTests/media/no-auto-play-in-sandbox.html.
  • media/no-auto-play-in-sandbox-expected.txt: Removed.
  • media/resources/auto-play-in-sandbox-with-allow-scripts-iframe.html: Added.
  • media/resources/no-auto-play-in-sandbox-iframe.html: Removed.
Location:
trunk
Files:
3 added
3 deleted
3 edited
2 moved

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r127474 r127481  
     12012-09-04  Christophe Dumez  <christophe.dumez@intel.com>
     2
     3        Automatic features should work in sandboxed iframes if "allow-scripts" flag is set
     4        https://bugs.webkit.org/show_bug.cgi?id=93961
     5
     6        Reviewed by Adam Barth.
     7
     8        Add layout tests to check that automatic features (video
     9        autoplay and form control autofocus) are allowed / working
     10        in sandboxed iframes if the "allow-scripts" flag is set.
     11        This behavior is according to the latest specification at:
     12        http://dev.w3.org/html5/spec/browsers.html#attr-iframe-sandbox-allow-same-origin
     13
     14        The tests to check that automatic features are blocked in
     15        sandboxed iframes have been removed since they relied on
     16        the "allow-scripts" flag to work.
     17
     18        * fast/forms/autofocus-in-sandbox-with-allow-scripts-expected.txt: Added.
     19        * fast/forms/autofocus-in-sandbox-with-allow-scripts.html: Renamed from LayoutTests/fast/forms/no-autofocus-in-sandbox.html.
     20        * fast/forms/no-autofocus-in-sandbox-expected.txt: Removed.
     21        * media/auto-play-in-sandbox-with-allow-scripts-expected.txt: Added.
     22        * media/auto-play-in-sandbox-with-allow-scripts.html: Renamed from LayoutTests/media/no-auto-play-in-sandbox.html.
     23        * media/no-auto-play-in-sandbox-expected.txt: Removed.
     24        * media/resources/auto-play-in-sandbox-with-allow-scripts-iframe.html: Added.
     25        * media/resources/no-auto-play-in-sandbox-iframe.html: Removed.
     26
    1272012-09-04  Tim Horton  <timothy_horton@apple.com>
    228

  • trunk/LayoutTests/fast/forms/autofocus-in-sandbox-with-allow-scripts.html

    r127480 r127481  
    33    testRunner.dumpAsText();
    44</script>
    5 This test passes if the activeElement is the body rather than the input element
    6 (which it would be if the sandbox didn't succeed in blocking autofocus).
     5This test passes if the activeElement is the input element rather than the body
     6(which it would be if the sandbox didn't allow autofocus although allow-scripts flag is set).
    77<iframe sandbox="allow-scripts"
    88    src="data:text/html,<input autofocus onfocus><script>alert(document.activeElement.tagName)</script>"></iframe>

  • trunk/LayoutTests/media/auto-play-in-sandbox-with-allow-scripts.html

    r127480 r127481  
    88    style="width: 400px; height: 600px"
    99    sandbox="allow-scripts allow-same-origin"
    10     src="resources/no-auto-play-in-sandbox-iframe.html"></iframe>
     10    src="resources/auto-play-in-sandbox-with-allow-scripts-iframe.html"></iframe>

  • trunk/Source/WebCore/ChangeLog

    r127480 r127481  
     12012-09-04  Christophe Dumez  <christophe.dumez@intel.com>
     2
     3        Automatic features should work in sandboxed iframes if "allow-scripts" flag is set
     4        https://bugs.webkit.org/show_bug.cgi?id=93961
     5
     6        Reviewed by Adam Barth.
     7
     8        Allow automatic features (video autoplay and form control
     9        autofocus) in a sandboxed iframe that has "allow-scripts"
     10        flag set. This behavior is according to the latest
     11        specification at:
     12        http://dev.w3.org/html5/spec/browsers.html#attr-iframe-sandbox-allow-same-origin
     13
     14        This sandboxed automatic features browsing context flag is
     15        relaxed by the same keyword as scripts, because when
     16        scripts are enabled these features are trivially possible
     17        anyway, and it would be unfortunate to force authors to
     18        use script to do them when sandboxed rather than allowing
     19        them to use the declarative features.
     20
     21        Tests: fast/forms/autofocus-in-sandbox-with-allow-scripts.html
     22               media/auto-play-in-sandbox-with-allow-scripts.html
     23
     24        * dom/SecurityContext.cpp:
     25        (WebCore::SecurityContext::parseSandboxPolicy):
     26
    1272012-09-04  Sami Kyostila  <skyostil@google.com>
    228

  • trunk/Source/WebCore/dom/SecurityContext.cpp

    r126171 r127481  
    107107        else if (equalIgnoringCase(sandboxToken, "allow-forms"))
    108108            flags &= ~SandboxForms;
    109         else if (equalIgnoringCase(sandboxToken, "allow-scripts"))
     109        else if (equalIgnoringCase(sandboxToken, "allow-scripts")) {
    110110            flags &= ~SandboxScripts;
    111         else if (equalIgnoringCase(sandboxToken, "allow-top-navigation"))
     111            flags &= ~SandboxAutomaticFeatures;
     112        } else if (equalIgnoringCase(sandboxToken, "allow-top-navigation"))
    112113            flags &= ~SandboxTopNavigation;
    113114        else if (equalIgnoringCase(sandboxToken, "allow-popups"))
Note: See TracChangeset for help on using the changeset viewer.