Changeset 145695 in webkit


Ignore:
Timestamp:
Mar 13, 2013 2:32:25 AM (11 years ago)
Author:
mkwst@chromium.org
Message:

Pass the XSSAuditor's report URL to the XSSAuditorDelegate on the main thread.
​https://bugs.webkit.org/show_bug.cgi?id=112179

Reviewed by Adam Barth.

Rather than relying on XSSInfo objects to move the XSSAuditor's report
URL into the XSSAuditorDelegate for reporting, we should be able to grab
the URL directly from XSSAuditor before it moves off the main thread,
and store it on the delegate.

This will enable us to drop the report URL properties from both
XSSAuditor and XSSInfo. Oh, happy day!

  • html/parser/BackgroundHTMLParser.cpp:

(WebCore::BackgroundHTMLParser::sendTokensToMainThread):

We no longer need to check whether XSSInfo objects are thread safe,
as we've dropped the only problematic bit.

  • html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::pumpTokenizer):
(WebCore::HTMLDocumentParser::startBackgroundParser):

  • html/parser/XSSAuditor.cpp:

(WebCore::XSSAuditor::init):

When initializing the XSSAuditor, pass in an XSSAuditorDelegate*
and assign the report URL directly onto that object.

(WebCore::XSSAuditor::filterToken):

Drop the report URL parameter from XSSInfo objects we create in the
Auditor, as they're now handled directly from the delegate.

(WebCore::XSSAuditor::isSafeToSendToAnotherThread):

Drop the report URL property from XSSAuditor's threadsafeness check,
as properties that do not exist are automatically thread-safe.

  • html/parser/XSSAuditorDelegate.cpp:

(WebCore::XSSAuditorDelegate::didBlockScript):

Use the delegate's own report URL rather than the XSSInfo objects'.

  • html/parser/XSSAuditorDelegate.h:

(WebCore::XSSInfo::create):
(WebCore::XSSInfo::XSSInfo):

Drop the report URL property from XSSInfo.

(WebCore::XSSAuditorDelegate::setReportURL):
(XSSAuditorDelegate):

Provide a public API for setting a delegate's report URL.

Location:
trunk/Source/WebCore
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r145692 r145695  
     12013-03-13  Mike West  <mkwst@chromium.org>
     2
     3        Pass the XSSAuditor's report URL to the XSSAuditorDelegate on the main thread.
     4        https://bugs.webkit.org/show_bug.cgi?id=112179
     5
     6        Reviewed by Adam Barth.
     7
     8        Rather than relying on XSSInfo objects to move the XSSAuditor's report
     9        URL into the XSSAuditorDelegate for reporting, we should be able to grab
     10        the URL directly from XSSAuditor before it moves off the main thread,
     11        and store it on the delegate.
     12
     13        This will enable us to drop the report URL properties from both
     14        XSSAuditor and XSSInfo. Oh, happy day!
     15
     16        * html/parser/BackgroundHTMLParser.cpp:
     17        (WebCore::BackgroundHTMLParser::sendTokensToMainThread):
     18            We no longer need to check whether XSSInfo objects are thread safe,
     19            as we've dropped the only problematic bit.
     20        * html/parser/HTMLDocumentParser.cpp:
     21        (WebCore::HTMLDocumentParser::pumpTokenizer):
     22        (WebCore::HTMLDocumentParser::startBackgroundParser):
     23        * html/parser/XSSAuditor.cpp:
     24        (WebCore::XSSAuditor::init):
     25            When initializing the XSSAuditor, pass in an XSSAuditorDelegate*
     26            and assign the report URL directly onto that object.
     27        (WebCore::XSSAuditor::filterToken):
     28            Drop the report URL parameter from XSSInfo objects we create in the
     29            Auditor, as they're now handled directly from the delegate.
     30        (WebCore::XSSAuditor::isSafeToSendToAnotherThread):
     31            Drop the report URL property from XSSAuditor's threadsafeness check,
     32            as properties that do not exist are automatically thread-safe.
     33        * html/parser/XSSAuditorDelegate.cpp:
     34        (WebCore::XSSAuditorDelegate::didBlockScript):
     35            Use the delegate's own report URL rather than the XSSInfo objects'.
     36        * html/parser/XSSAuditorDelegate.h:
     37        (WebCore::XSSInfo::create):
     38        (WebCore::XSSInfo::XSSInfo):
     39            Drop the report URL property from XSSInfo.
     40        (WebCore::XSSAuditorDelegate::setReportURL):
     41        (XSSAuditorDelegate):
     42            Provide a public API for setting a delegate's report URL.
     43
    1442013-03-13  Mike West  <mkwst@chromium.org>
    245

  • trunk/Source/WebCore/html/parser/BackgroundHTMLParser.cpp

    r145567 r145695  
    5252    for (size_t i = 0; i < preloads.size(); ++i)
    5353        ASSERT(preloads[i]->isSafeToSendToAnotherThread());
    54 }
    55 
    56 static void checkThatXSSInfosAreSafeToSendToAnotherThread(const XSSInfoStream& xssInfos)
    57 {
    58     for (size_t i = 0; i < xssInfos.size(); ++i)
    59         ASSERT(xssInfos[i]->isSafeToSendToAnotherThread());
    6054}
    6155
    … …  
    161155    checkThatTokensAreSafeToSendToAnotherThread(m_pendingTokens.get());
    162156    checkThatPreloadsAreSafeToSendToAnotherThread(m_pendingPreloads);
    163     checkThatXSSInfosAreSafeToSendToAnotherThread(m_pendingXSSInfos);
    164157#endif
    165158

  • trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp

    r145567 r145695  
    522522    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willWriteHTML(document(), m_input.current().currentLine().zeroBasedInt());
    523523
    524     m_xssAuditor.init(document());
     524    m_xssAuditor.init(document(), &m_xssAuditorDelegate);
    525525
    526526    while (canTakeNextToken(mode, session) && !session.needsYield) {
    … …  
    663663    config->parser = m_weakFactory.createWeakPtr();
    664664    config->xssAuditor = adoptPtr(new XSSAuditor);
    665     config->xssAuditor->init(document());
     665    config->xssAuditor->init(document(), &m_xssAuditorDelegate);
    666666    config->preloadScanner = adoptPtr(new TokenPreloadScanner(document()->url().copy()));
    667667

  • trunk/Source/WebCore/html/parser/XSSAuditor.cpp

    r145503 r145695  
    5252#include "TextResourceDecoder.h"
    5353#include "XLinkNames.h"
     54#include "XSSAuditorDelegate.h"
    5455
    5556#if ENABLE(SVG)
    … …  
    227228}
    228229
    229 void XSSAuditor::init(Document* document)
     230void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate)
    230231{
    231232    const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter.
    … …  
    299300
    300301        m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader, cspHeader);
    301         m_reportURL = xssProtectionReportURL; // FIXME: Combine the two report URLs in some reasonable way.
     302        // FIXME: Combine the two report URLs in some reasonable way.
     303        if (auditorDelegate)
     304            auditorDelegate->setReportURL(xssProtectionReportURL.copy());
    302305        FormData* httpBody = documentLoader->originalRequest().httpBody();
    303306        if (httpBody && !httpBody->isEmpty()) {
    … …  
    337340    if (didBlockScript) {
    338341        bool didBlockEntirePage = (m_xssProtection == ContentSecurityPolicy::BlockReflectedXSS);
    339         OwnPtr<XSSInfo> xssInfo = XSSInfo::create(m_reportURL, didBlockEntirePage, m_didSendValidXSSProtectionHeader, m_didSendValidCSPHeader);
    340         m_reportURL = KURL();
     342        OwnPtr<XSSInfo> xssInfo = XSSInfo::create(didBlockEntirePage, m_didSendValidXSSProtectionHeader, m_didSendValidCSPHeader);
    341343        return xssInfo.release();
    342344    }
    … …  
    729731        && m_decodedURL.isSafeToSendToAnotherThread()
    730732        && m_decodedHTTPBody.isSafeToSendToAnotherThread()
    731         && m_cachedDecodedSnippet.isSafeToSendToAnotherThread()
    732         && m_reportURL.isSafeToSendToAnotherThread();
     733        && m_cachedDecodedSnippet.isSafeToSendToAnotherThread();
    733734}
    734735

  • trunk/Source/WebCore/html/parser/XSSAuditor.h

    r145503 r145695  
    4040class HTMLSourceTracker;
    4141class XSSInfo;
     42class XSSAuditorDelegate;
    4243
    4344struct FilterTokenRequest {
    … …  
    5859    XSSAuditor();
    5960
    60     void init(Document*);
     61    void init(Document*, XSSAuditorDelegate*);
    6162    PassOwnPtr<XSSInfo> filterToken(const FilterTokenRequest&);
    6263    bool isSafeToSendToAnotherThread() const;
    … …  
    116117    String m_cachedDecodedSnippet;
    117118    unsigned m_scriptTagNestingLevel;
    118     KURL m_reportURL;
    119119    TextEncoding m_encoding;
    120120};

  • trunk/Source/WebCore/html/parser/XSSAuditorDelegate.cpp

    r145503 r145695  
    4141
    4242namespace WebCore {
    43 
    44 bool XSSInfo::isSafeToSendToAnotherThread() const
    45 {
    46     return m_reportURL.isSafeToSendToAnotherThread();
    47 }
    4843
    4944XSSAuditorDelegate::XSSAuditorDelegate(Document* document)
    … …  
    9287    }
    9388
    94     if (!xssInfo.m_reportURL.isEmpty()) {
     89    if (!m_reportURL.isEmpty()) {
    9590        RefPtr<InspectorObject> reportDetails = InspectorObject::create();
    9691        reportDetails->setString("request-url", m_document->url().string());
    … …  
    107102
    108103        RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8().data());
    109         PingLoader::sendViolationReport(m_document->frame(), xssInfo.m_reportURL, report);
     104        PingLoader::sendViolationReport(m_document->frame(), m_reportURL, report);
    110105    }
    111106

  • trunk/Source/WebCore/html/parser/XSSAuditorDelegate.h

    r145503 r145695  
    4040class XSSInfo {
    4141public:
    42     static PassOwnPtr<XSSInfo> create(const KURL& reportURL, bool didBlockEntirePage, bool didSendXSSProtectionHeader, bool didSendCSPHeader)
     42    static PassOwnPtr<XSSInfo> create(bool didBlockEntirePage, bool didSendXSSProtectionHeader, bool didSendCSPHeader)
    4343    {
    44         return adoptPtr(new XSSInfo(reportURL, didBlockEntirePage, didSendXSSProtectionHeader, didSendCSPHeader));
     44        return adoptPtr(new XSSInfo(didBlockEntirePage, didSendXSSProtectionHeader, didSendCSPHeader));
    4545    }
    4646
    47     bool isSafeToSendToAnotherThread() const;
    48 
    49     KURL m_reportURL;
    5047    bool m_didBlockEntirePage;
    5148    bool m_didSendXSSProtectionHeader;
    … …  
    5451
    5552private:
    56     XSSInfo(const KURL& reportURL, bool didBlockEntirePage, bool didSendXSSProtectionHeader, bool didSendCSPHeader)
    57         : m_reportURL(reportURL)
    58         , m_didBlockEntirePage(didBlockEntirePage)
     53    XSSInfo(bool didBlockEntirePage, bool didSendXSSProtectionHeader, bool didSendCSPHeader)
     54        : m_didBlockEntirePage(didBlockEntirePage)
    5955        , m_didSendXSSProtectionHeader(didSendXSSProtectionHeader)
    6056        , m_didSendCSPHeader(didSendCSPHeader)
    … …  
    6864
    6965    void didBlockScript(const XSSInfo&);
     66    void setReportURL(const KURL& url) { m_reportURL = url; }
    7067
    7168private:
    7269    Document* m_document;
    7370    bool m_didNotifyClient;
     71    KURL m_reportURL;
    7472};
    7573
Note: See TracChangeset for help on using the changeset viewer.