Changeset 141336 in webkit

Timestamp:

Jan 30, 2013 4:03:07 PM (11 years ago)

Author:

commit-queue@webkit.org

Message:

[BlackBerry] Never store empty credentials in NetworkJob::storeCredentials
​https://bugs.webkit.org/show_bug.cgi?id=108387

Patch by Joe Mason <​jmason@rim.com> on 2013-01-30
Reviewed by Yong Li.

There is a code path that can cause NetworkJob::storeCredentials to be called with empty
credentials, causing the existing credentials to be overwritten even though authentication
succeeded. PR 287791 has been filed to investigate why this happens; in the meantime, ignore empty
credentials.

Internal PR: 281172
Internally Reviewed By: Leo Yang

• platform/network/blackberry/NetworkJob.cpp:

(WebCore::NetworkJob::storeCredentials):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/blackberry/NetworkJob.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-30  Joe Mason  <jmason@rim.com>
+
+        [BlackBerry] Never store empty credentials in NetworkJob::storeCredentials
+        https://bugs.webkit.org/show_bug.cgi?id=108387
+
+        Reviewed by Yong Li.
+
+        There is a code path that can cause NetworkJob::storeCredentials to be called with empty
+        credentials, causing the existing credentials to be overwritten even though authentication
+        succeeded.  PR 287791 has been filed to investigate why this happens; in the meantime, ignore empty
+        credentials.
+
+        Internal PR: 281172
+        Internally Reviewed By: Leo Yang
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::storeCredentials):
+
 2013-01-30  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebCore/platform/network/blackberry/NetworkJob.cpp

@@ -888 +888 @@
         return;
 
+    // Obviously we can't have successfully authenticated with empty credentials. (To store empty
+    // credentials, use purgeCredentials.)
+
+    // FIXME: We should assert here, but there is one path (when the credentials are read from the
+    // proxy config entirely in the platform layer) where storeCredentials is called with an empty
+    // challenge. The credentials should be passed back from the platform layer for storage in this
+    // case - see PR 287791.
+    if (challenge.proposedCredential().user().isEmpty() || challenge.proposedCredential().password().isEmpty())
+        return;
+
     CredentialStorage::set(challenge.proposedCredential(), challenge.protectionSpace(), m_response.url());
     challenge.setStored(true);