Changeset 138517 in webkit


Ignore:
Timestamp:
Dec 27, 2012 4:39:48 PM (11 years ago)
Author:
mkwst@chromium.org
Message:

Add context to the console message generated by Document::printNavigationErrorMessage.
​https://bugs.webkit.org/show_bug.cgi?id=105774

Reviewed by Darin Adler.

Source/WebCore:

When blocking frame navigations, we should give developers more
contextual detail about why the navigation has been blocked. This patch
adds context specifically for sandboxed frames', and gives a slightly
more detailed generic response for all other blockages.

No new tests; the changes to the error message are covered via
rebaselines to existing navigation tests.

  • dom/Document.cpp:

(WebCore::printNavigationErrorMessage):
(WebCore::Document::canNavigate):

Pass in a 'reason' parameter when calling printNavigationErrorMessage
to report a blocked navigation.

LayoutTests:

  • fast/frames/sandboxed-iframe-close-top-noclose-expected.txt:
  • fast/frames/sandboxed-iframe-history-denied-expected.txt:
  • fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
  • fast/frames/sandboxed-iframe-navigation-targetlink-expected.txt:
  • fast/frames/sandboxed-iframe-navigation-top-by-name-denied-expected.txt:
  • fast/frames/sandboxed-iframe-navigation-top-denied-expected.txt:
  • fast/frames/seamless/seamless-window-location-sandbox-expected.txt:
  • http/tests/security/no-popup-from-sandbox-top-expected.txt:
  • http/tests/security/frameNavigation/not-opener-expected.txt:
  • http/tests/security/frameNavigation/xss-DENIED-plugin-navigation-expected.txt:
  • http/tests/security/frameNavigation/xss-DENIED-targeted-link-navigation-expected.txt:
  • platform/chromium/http/tests/security/frameNavigation/xss-DENIED-plugin-navigation-expected.txt:
  • platform/chromium/http/tests/security/no-popup-from-sandbox-top-expected.txt:

Update test expectations with new error message.

Location:
trunk
Files:
16 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r138506 r138517  
     12012-12-27  Mike West  <mkwst@chromium.org>
     2
     3        Add context to the console message generated by Document::printNavigationErrorMessage.
     4        https://bugs.webkit.org/show_bug.cgi?id=105774
     5
     6        Reviewed by Darin Adler.
     7
     8        * fast/frames/sandboxed-iframe-close-top-noclose-expected.txt:
     9        * fast/frames/sandboxed-iframe-history-denied-expected.txt:
     10        * fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
     11        * fast/frames/sandboxed-iframe-navigation-targetlink-expected.txt:
     12        * fast/frames/sandboxed-iframe-navigation-top-by-name-denied-expected.txt:
     13        * fast/frames/sandboxed-iframe-navigation-top-denied-expected.txt:
     14        * fast/frames/seamless/seamless-window-location-sandbox-expected.txt:
     15        * http/tests/security/no-popup-from-sandbox-top-expected.txt:
     16        * http/tests/security/frameNavigation/not-opener-expected.txt:
     17        * http/tests/security/frameNavigation/xss-DENIED-plugin-navigation-expected.txt:
     18        * http/tests/security/frameNavigation/xss-DENIED-targeted-link-navigation-expected.txt:
     19        * platform/chromium/http/tests/security/frameNavigation/xss-DENIED-plugin-navigation-expected.txt:
     20        * platform/chromium/http/tests/security/no-popup-from-sandbox-top-expected.txt:
     21            Update test expectations with new error message.
     22
    1232012-12-27  Vsevolod Vlasov  <vsevik@chromium.org>
    224

  • trunk/LayoutTests/fast/frames/sandboxed-iframe-close-top-noclose-expected.txt

    r112825 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL close-top.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'close-top.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    22
    33This test verifies that a sandboxed IFrame can close a top-level frame with allow-top-navigation.

  • trunk/LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt

    r112825 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL script>.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'script>'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    22
    33ALERT: PASS

  • trunk/LayoutTests/fast/frames/sandboxed-iframe-navigation-parent-expected.txt

    r112825 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL sandboxed-iframe-navigation-source.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'sandboxed-iframe-navigation-source.html'. The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.
    22
    33This test verifies that a sandboxed IFrame cannot navigate an ancestor in the frame tree by assigning the location attribute.

  • trunk/LayoutTests/fast/frames/sandboxed-iframe-navigation-targetlink-expected.txt

    r112825 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL about:blank from frame with URL sandboxed-iframe-navigation-targetlink.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'about:blank' from frame with URL 'sandboxed-iframe-navigation-targetlink.html'. The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.
    22
    3 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL about:blank from frame with URL sandboxed-iframe-navigation-targetlink.html.
     3CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'about:blank' from frame with URL 'sandboxed-iframe-navigation-targetlink.html'. The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.
    44
    55This test verifies that a sandboxed IFrame cannot open a link in another frame using the target attribute of a link.

  • trunk/LayoutTests/fast/frames/sandboxed-iframe-navigation-top-by-name-denied-expected.txt

    r136527 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL navigate-top-by-name-to-fail.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'navigate-top-by-name-to-fail.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    22
    33CONSOLE MESSAGE: Blocked opening 'fail-and-notify-done.html' in a new window because the request was made in a sandboxed frame whose 'allow-popups' permission is not set.
    4 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL navigate-top-by-name-to-fail.html.
     4CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'navigate-top-by-name-to-fail.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    55
    6 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL navigate-top-by-name-to-fail.html.
     6CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'navigate-top-by-name-to-fail.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    77
    88CONSOLE MESSAGE: Blocked opening 'fail-and-notify-done.html' in a new window because the request was made in a sandboxed frame whose 'allow-popups' permission is not set.

  • trunk/LayoutTests/fast/frames/sandboxed-iframe-navigation-top-denied-expected.txt

    r112825 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL navigate-top-to-fail.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'navigate-top-to-fail.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    22
    33This test verifies that a sandboxed IFrame cannot navigate the top-level frame without allow-top-navigation. This test passes if the navigation does not occur.

  • trunk/LayoutTests/fast/frames/seamless/seamless-window-location-sandbox-expected.txt

    r115796 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL about:srcdoc from frame with URL about:srcdoc.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'about:srcdoc' from frame with URL 'about:srcdoc'. The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.
    22
    33This test should not cause any navigation.

  • trunk/LayoutTests/http/tests/security/frameNavigation/not-opener-expected.txt

    r104803 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/frameNavigation/resources/ready.html from frame with URL http://localhost:8000/security/frameNavigation/resources/not-opener-helper.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/frameNavigation/resources/ready.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/not-opener-helper.html'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
    22
    33PASS

  • trunk/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-plugin-navigation-expected.txt

    r104803 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/resources/cross-frame-iframe.html from frame with URL http://localhost:8000/security/frameNavigation/resources/frame-with-plugin-to-navigate.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/resources/cross-frame-iframe.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/frame-with-plugin-to-navigate.html'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
    22
    33 

  • trunk/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-targeted-link-navigation-expected.txt

    r104803 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/resources/cross-frame-iframe.html from frame with URL http://localhost:8000/security/frameNavigation/resources/frame-with-link-to-navigate.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/resources/cross-frame-iframe.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/frame-with-link-to-navigate.html'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
    22
    3 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/resources/cross-frame-iframe.html from frame with URL http://localhost:8000/security/frameNavigation/resources/frame-with-link-to-navigate.html.
     3CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/resources/cross-frame-iframe.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/frame-with-link-to-navigate.html'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
    44
    55 

  • trunk/LayoutTests/http/tests/security/no-popup-from-sandbox-top-expected.txt

    r112835 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/no-popup-from-sandbox-top.html from frame with URL data:text/html,       <script>       var win = window.open('about:blank', '_top');       alert(win ?%20'FAIL'%20:%20'PASS');%20%20%20%20%20%20%20%3C/script%3E.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/no-popup-from-sandbox-top.html' from frame with URL 'data:text/html,       <script>       var win = window.open('about:blank', '_top');       alert(win ?%20'FAIL'%20:%20'PASS');%20%20%20%20%20%20%20%3C/script%3E'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    22
    33ALERT: PASS

  • trunk/LayoutTests/platform/chromium/http/tests/security/frameNavigation/xss-DENIED-plugin-navigation-expected.txt

    r104803 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/resources/cross-frame-iframe.html from frame with URL http://localhost:8000/security/frameNavigation/resources/frame-with-plugin-to-navigate.html.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/resources/cross-frame-iframe.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/frame-with-plugin-to-navigate.html'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
    22
    3 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/resources/cross-frame-iframe.html from frame with URL http://localhost:8000/security/frameNavigation/resources/frame-with-plugin-to-navigate.html.
     3CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/resources/cross-frame-iframe.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/frame-with-plugin-to-navigate.html'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
    44
    55 

  • trunk/LayoutTests/platform/chromium/http/tests/security/no-popup-from-sandbox-top-expected.txt

    r112835 r138517  
    1 CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate a navigation change for frame with URL http://127.0.0.1:8000/security/no-popup-from-sandbox-top.html from frame with URL data:text/html,       <script>       var win = window.open('about:blank', '_top');       alert(win ? 'FAIL' : 'PASS');       </script>.
     1CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/no-popup-from-sandbox-top.html' from frame with URL 'data:text/html,       <script>       var win = window.open('about:blank', '_top');       alert(win ? 'FAIL' : 'PASS');       </script>'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.
    22
    33ALERT: PASS

  • trunk/Source/WebCore/ChangeLog

    r138515 r138517  
     12012-12-27  Mike West  <mkwst@chromium.org>
     2
     3        Add context to the console message generated by Document::printNavigationErrorMessage.
     4        https://bugs.webkit.org/show_bug.cgi?id=105774
     5
     6        Reviewed by Darin Adler.
     7
     8        When blocking frame navigations, we should give developers more
     9        contextual detail about why the navigation has been blocked. This patch
     10        adds context specifically for sandboxed frames', and gives a slightly
     11        more detailed generic response for all other blockages.
     12
     13        No new tests; the changes to the error message are covered via
     14        rebaselines to existing navigation tests.
     15
     16        * dom/Document.cpp:
     17        (WebCore::printNavigationErrorMessage):
     18        (WebCore::Document::canNavigate):
     19            Pass in a 'reason' parameter when calling printNavigationErrorMessage
     20            to report a blocked navigation.
     21
    1222012-12-27  Dimitri Glazkov  <dglazkov@chromium.org>
    223

  • trunk/Source/WebCore/dom/Document.cpp

    r138515 r138517  
    394394}
    395395
    396 static void printNavigationErrorMessage(Frame* frame, const KURL& activeURL)
    397 {
    398     // FIXME: this error message should contain more specifics of why the navigation change is not allowed.
    399     String message = "Unsafe JavaScript attempt to initiate a navigation change for frame with URL " +
    400                      frame->document()->url().string() + " from frame with URL " + activeURL.string() + ".\n";
     396static void printNavigationErrorMessage(Frame* frame, const KURL& activeURL, const char* reason)
     397{
     398    String message = "Unsafe JavaScript attempt to initiate navigation for frame with URL '" + frame->document()->url().string() + "' from frame with URL '" + activeURL.string() + "'. " + reason + "\n";
    401399
    402400    // FIXME: should we print to the console of the document performing the navigation instead?
    … …  
    27122710        return true;
    27132711
    2714     // Frame-busting is generally allowed (unless we're sandboxed and prevent from frame-busting).
     2712    // Frame-busting is generally allowed, but blocked for sandboxed frames lacking the 'allow-top-navigation' flag.
    27152713    if (!isSandboxed(SandboxTopNavigation) && targetFrame == m_frame->tree()->top())
    27162714        return true;
    … …  
    27202718            return true;
    27212719
    2722         printNavigationErrorMessage(targetFrame, url());
     2720        const char* reason = "The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.";
     2721        if (isSandboxed(SandboxTopNavigation) && targetFrame == m_frame->tree()->top())
     2722            reason = "The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.";
     2723
     2724        printNavigationErrorMessage(targetFrame, url(), reason);
    27232725        return false;
    27242726    }
    … …  
    27532755    }
    27542756
    2755     printNavigationErrorMessage(targetFrame, url());
     2757    printNavigationErrorMessage(targetFrame, url(), "The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.");
    27562758    return false;
    27572759}
Note: See TracChangeset for help on using the changeset viewer.