Changeset 147402 in webkit


Ignore:
Timestamp:
Apr 2, 2013 1:28:07 AM (11 years ago)
Author:
mkwst@chromium.org
Message:

X-Frame-Options: Blocked frames should not inherit their parent's SecurityOrigin.
​https://bugs.webkit.org/show_bug.cgi?id=112903

Reviewed by Adam Barth.

Source/WebCore:

This change brings WebKit in line with IE and Gecko's behavior, both of
which treat the blocked frame as being cross-origin for the purposes of
access checks ('[frame].contentWindow.location.href' is inaccessible,
for example).

  • dom/Document.cpp:

(WebCore::Document::processHttpEquiv):

Rather than redirecting to 'about:blank', redirect to
'data:text/html,<p></p>' which does not inherit the SecurityOrigin
of the parent.

  • loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::responseReceived):

Before calling cancelMainResourceLoad, ensure that the frame's
document is sandboxed into a unique origin so that it doesn't
inherit the parent's SecurityOrigin.

LayoutTests:

  • http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html:
  • http/tests/security/XFrameOptions/x-frame-options-deny.html:
  • http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny-expected.txt:
  • http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny.html:
  • http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt:
  • http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html:
  • platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt:
  • platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt:
  • platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt:
  • platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt:
  • platform/chromium/http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny-expected.txt:
  • platform/chromium/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt:
Location:
trunk
Files:
22 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r147400 r147402  
     12013-04-02  Mike West  <mkwst@chromium.org>
     2
     3        X-Frame-Options: Blocked frames should not inherit their parent's SecurityOrigin.
     4        https://bugs.webkit.org/show_bug.cgi?id=112903
     5
     6        Reviewed by Adam Barth.
     7
     8        * http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt:
     9        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt:
     10        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt:
     11        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html:
     12        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt:
     13        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html:
     14        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html:
     15        * http/tests/security/XFrameOptions/x-frame-options-deny.html:
     16        * http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny-expected.txt:
     17        * http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny.html:
     18        * http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt:
     19        * http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html:
     20        * platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt:
     21        * platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt:
     22        * platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt:
     23        * platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt:
     24        * platform/chromium/http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny-expected.txt:
     25        * platform/chromium/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt:
     26
    1272013-04-02  Shinya Kawanaka  <shinyak@chromium.org>
    228

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt

    r147164 r147402  
    22<unknown> - didFinishLoading
    33CONSOLE MESSAGE: Refused to display 'http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi' in a frame because it set 'X-Frame-Options' to 'deny'.
    4 ALERT: PASS: onload fired.
     4CONSOLE MESSAGE: Sandbox access violation: Blocked a frame at "http://127.0.0.1:8000" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.
     5CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    56http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi">
    67There should be no content in the iframe below

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt

    r136031 r147402  
    44http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html">
    55CONSOLE MESSAGE: Refused to display 'http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html' in a frame because it set 'X-Frame-Options' to 'deny'.
     6data:text/html,%3Cp%3E%3C/p%3E - willSendRequest <NSURLRequest URL data:text/html,%3Cp%3E%3C/p%3E, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny-meta-tag.html, http method GET> redirectResponse (null)
     7data:text/html,%3Cp%3E%3C/p%3E - didReceiveResponse <NSURLResponse data:text/html,%3Cp%3E%3C/p%3E, http status code 0>
     8data:text/html,%3Cp%3E%3C/p%3E - didFinishLoading
     9CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "null".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.
     10
     11CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    612There should be no content in the iframe below
    713

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt

    r136031 r147402  
    44http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html">
    55CONSOLE MESSAGE: Refused to display 'http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html' in a frame because it set 'X-Frame-Options' to 'deny'.
     6data:text/html,%3Cp%3E%3C/p%3E - willSendRequest <NSURLRequest URL data:text/html,%3Cp%3E%3C/p%3E, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html, http method GET> redirectResponse (null)
     7data:text/html,%3Cp%3E%3C/p%3E - didReceiveResponse <NSURLResponse data:text/html,%3Cp%3E%3C/p%3E, http status code 0>
     8CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "null".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.
     9
     10CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    611There should be no content in the iframe below
    712

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html

    r120174 r147402  
    77    }
    88
    9     function checkIfDone()
    10     {
    11         if (document.getElementsByTagName("iframe")[0].contentWindow.location == "about:blank")
    12             testRunner.notifyDone();
     9    function checkIfDone() {
     10        var url = document.querySelector('iframe').contentWindow.location.href;
     11
     12        if (!url)
     13            console.log("PASS: Could not read contentWindow.location.href");
     14        else
     15            console.log("FAIL: Could read contentWindow.location.href");
     16        testRunner.notifyDone();
    1317    }
    1418</script>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt

    r136031 r147402  
    44http://localhost:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://localhost:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html">
    55CONSOLE MESSAGE: Refused to display 'http://localhost:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
     6data:text/html,%3Cp%3E%3C/p%3E - willSendRequest <NSURLRequest URL data:text/html,%3Cp%3E%3C/p%3E, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html, http method GET> redirectResponse (null)
     7data:text/html,%3Cp%3E%3C/p%3E - didReceiveResponse <NSURLResponse data:text/html,%3Cp%3E%3C/p%3E, http status code 0>
     8data:text/html,%3Cp%3E%3C/p%3E - didFinishLoading
     9CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "null".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.
     10
     11CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    612There should be no content in the iframe below
    713

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html

    r120174 r147402  
    77    }
    88
    9     function checkIfDone()
    10     {
    11         if (document.getElementsByTagName("iframe")[0].contentWindow.location == "about:blank")
    12             testRunner.notifyDone();
     9    function checkIfDone() {
     10        var url = document.querySelector('iframe').contentWindow.location.href;
     11
     12        if (!url)
     13            console.log("PASS: Could not read contentWindow.location.href");
     14        else
     15            console.log("FAIL: Could read contentWindow.location.href");
     16        testRunner.notifyDone();
    1317    }
    1418</script>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html

    r120174 r147402  
    77    }
    88
     9    function checkIfDone() {
     10        var url = document.querySelector('iframe').contentWindow.location.href;
    911
    10     function checkIfDone()
    11     {
    12         if (document.getElementsByTagName("iframe")[0].contentWindow.location == "about:blank")
    13             testRunner.notifyDone();
     12        if (!url)
     13            console.log("PASS: Could not read contentWindow.location.href");
     14        else
     15            console.log("FAIL: Could read contentWindow.location.href");
     16        testRunner.notifyDone();
    1417    }
    1518</script>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny.html

    r147164 r147402  
    44        testRunner.dumpChildFramesAsText();
    55        testRunner.dumpResourceLoadCallbacks();
     6        testRunner.waitUntilDone();
     7    }
     8
     9    function checkIfDone() {
     10        var url = document.querySelector('iframe').contentWindow.location.href;
     11
     12        if (!url)
     13            console.log("PASS: Could not read contentWindow.location.href");
     14        else
     15            console.log("FAIL: Could read contentWindow.location.href");
     16        testRunner.notifyDone();
    617    }
    718</script>
    819
    920<p>There should be no content in the iframe below</p>
    10 <iframe style="width:500px; height:500px" src="http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi" onload="alert('PASS: onload fired.');"></iframe>
     21<iframe style="width:500px; height:500px" src="http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi" onload="checkIfDone()"></iframe>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny-expected.txt

    r147086 r147402  
    22<unknown> - didFinishLoading
    33CONSOLE MESSAGE: Refused to display 'http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN, SAMEORIGIN'.
     4CONSOLE MESSAGE: Sandbox access violation: Blocked a frame at "http://127.0.0.1:8000" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.
     5CONSOLE MESSAGE: line 16: PASS: Could not read contentWindow.location.href
    46http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi">
    57The frame below should not load, proving that 'sameorigin, sameorigin' === 'sameorigin'.

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny.html

    r147086 r147402  
    77            testRunner.dumpChildFramesAsText();
    88            testRunner.dumpResourceLoadCallbacks();
     9            testRunner.waitUntilDone();
     10        }
     11
     12        function checkIfDone() {
     13            var url = document.querySelector('iframe').contentWindow.location.href;
     14
     15            if (!url)
     16                console.log("PASS: Could not read contentWindow.location.href");
     17            else
     18                console.log("FAIL: Could read contentWindow.location.href");
     19            testRunner.notifyDone();
    920        }
    1021    </script>
    … …  
    1223<body>
    1324    <p>The frame below should not load, proving that 'sameorigin, sameorigin' === 'sameorigin'.</p>
    14     <iframe style="width:500px; height:500px" src="http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi"></iframe>
     25    <iframe style="width:500px; height:500px" src="http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi" onload="checkIfDone()"></iframe>
    1526</body>
    1627</html>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt

    r147164 r147402  
    22<unknown> - didFinishLoading
    33CONSOLE MESSAGE: Refused to display 'http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
    4 ALERT: PASS: onload fired.
     4CONSOLE MESSAGE: Sandbox access violation: Blocked a frame at "http://127.0.0.1:8000" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.
     5CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    56http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi">
    67There should be no content in the iframe below

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html

    r147164 r147402  
    44        testRunner.dumpChildFramesAsText();
    55        testRunner.dumpResourceLoadCallbacks();
     6        testRunner.waitUntilDone();
     7    }
     8
     9    function checkIfDone() {
     10        var url = document.querySelector('iframe').contentWindow.location.href;
     11
     12        if (!url)
     13            console.log("PASS: Could not read contentWindow.location.href");
     14        else
     15            console.log("FAIL: Could read contentWindow.location.href");
     16        testRunner.notifyDone();
    617    }
    718</script>
    819
    920<p>There should be no content in the iframe below</p>
    10 <iframe style="width:500px; height:500px" src="http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi" onload="alert('PASS: onload fired.');"></iframe>
     21<iframe style="width:500px; height:500px" src="http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi" onload="checkIfDone()"></iframe>

  • trunk/LayoutTests/platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt

    r147164 r147402  
    11http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny.html, http method GET> redirectResponse (null)
    22CONSOLE MESSAGE: Refused to display 'http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi' in a frame because it set 'X-Frame-Options' to 'deny'.
    3 ALERT: PASS: onload fired.
     3CONSOLE MESSAGE: Sandbox access violation: Blocked a frame at "http://127.0.0.1:8000" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.
     4CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    45http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny.cgi">
    56There should be no content in the iframe below

  • trunk/LayoutTests/platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt

    r144262 r147402  
    33http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html - didFinishLoading
    44CONSOLE MESSAGE: Refused to display 'http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html' in a frame because it set 'X-Frame-Options' to 'deny'.
     5data:text/html,<p></p> - willSendRequest <NSURLRequest URL data:text/html,<p></p>, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny-meta-tag.html, http method GET> redirectResponse (null)
     6data:text/html,<p></p> - didReceiveResponse <NSURLResponse data:text/html,<p></p>, http status code 0>
     7CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "null".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.
     8
     9CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    510There should be no content in the iframe below
    611

  • trunk/LayoutTests/platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt

    r144262 r147402  
    33http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html - didFinishLoading
    44CONSOLE MESSAGE: Refused to display 'http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html' in a frame because it set 'X-Frame-Options' to 'deny'.
     5data:text/html,<p></p> - willSendRequest <NSURLRequest URL data:text/html,<p></p>, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html, http method GET> redirectResponse (null)
     6data:text/html,<p></p> - didReceiveResponse <NSURLResponse data:text/html,<p></p>, http status code 0>
     7CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "null".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.
     8
     9CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    510There should be no content in the iframe below
    611

  • trunk/LayoutTests/platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt

    r144262 r147402  
    33http://localhost:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html - didFinishLoading
    44CONSOLE MESSAGE: Refused to display 'http://localhost:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
     5data:text/html,<p></p> - willSendRequest <NSURLRequest URL data:text/html,<p></p>, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html, http method GET> redirectResponse (null)
     6data:text/html,<p></p> - didReceiveResponse <NSURLResponse data:text/html,<p></p>, http status code 0>
     7CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "null".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "data". Protocols must match.
     8
     9CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    510There should be no content in the iframe below
    611

  • trunk/LayoutTests/platform/chromium/http/tests/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny-expected.txt

    r147086 r147402  
    11http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi - willSendRequest <NSURLRequest URL http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-multiple-headers-sameorigin-deny.html, http method GET> redirectResponse (null)
    22CONSOLE MESSAGE: Refused to display 'http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN, SAMEORIGIN'.
     3CONSOLE MESSAGE: Sandbox access violation: Blocked a frame at "http://127.0.0.1:8000" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.
     4CONSOLE MESSAGE: line 16: PASS: Could not read contentWindow.location.href
    35http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://localhost:8000/security/XFrameOptions/resources/x-frame-options-multiple-headers-sameorigin.cgi">
    46The frame below should not load, proving that 'sameorigin, sameorigin' === 'sameorigin'.

  • trunk/LayoutTests/platform/chromium/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt

    r147164 r147402  
    11http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi - willSendRequest <NSURLRequest URL http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi, main document URL http://127.0.0.1:8000/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html, http method GET> redirectResponse (null)
    22CONSOLE MESSAGE: Refused to display 'http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
    3 ALERT: PASS: onload fired.
     3CONSOLE MESSAGE: Sandbox access violation: Blocked a frame at "http://127.0.0.1:8000" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.
     4CONSOLE MESSAGE: line 13: PASS: Could not read contentWindow.location.href
    45http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi - didFailLoadingWithError: <NSError domain NSURLErrorDomain, code -999, failing URL "http://localhost:8000/security/XFrameOptions/resources/x-frame-options-parent-same-origin-allow.cgi">
    56There should be no content in the iframe below

  • trunk/Source/WebCore/ChangeLog

    r147395 r147402  
     12013-04-02  Mike West  <mkwst@chromium.org>
     2
     3        X-Frame-Options: Blocked frames should not inherit their parent's SecurityOrigin.
     4        https://bugs.webkit.org/show_bug.cgi?id=112903
     5
     6        Reviewed by Adam Barth.
     7
     8        This change brings WebKit in line with IE and Gecko's behavior, both of
     9        which treat the blocked frame as being cross-origin for the purposes of
     10        access checks ('[frame].contentWindow.location.href' is inaccessible,
     11        for example).
     12
     13        * dom/Document.cpp:
     14        (WebCore::Document::processHttpEquiv):
     15            Rather than redirecting to 'about:blank', redirect to
     16            'data:text/html,<p></p>' which does not inherit the SecurityOrigin
     17            of the parent.
     18        * loader/DocumentLoader.cpp:
     19        (WebCore::DocumentLoader::responseReceived):
     20            Before calling cancelMainResourceLoad, ensure that the frame's
     21            document is sandboxed into a unique origin so that it doesn't
     22            inherit the parent's SecurityOrigin.
     23
    1242013-04-01  Elliott Sprehn  <esprehn@chromium.org>
    225

  • trunk/Source/WebCore/dom/Document.cpp

    r146935 r147402  
    29492949                String message = "Refused to display '" + url().elidedString() + "' in a frame because it set 'X-Frame-Options' to '" + content + "'.";
    29502950                frameLoader->stopAllLoaders();
    2951                 frame->navigationScheduler()->scheduleLocationChange(securityOrigin(), blankURL(), String());
     2951                // Stopping the loader isn't enough, as we're already parsing the document; to honor the header's
     2952                // intent, we must navigate away from the possibly partially-rendered document to a location that
     2953                // doesn't inherit the parent's SecurityOrigin.
     2954                frame->navigationScheduler()->scheduleLocationChange(securityOrigin(), "data:text/html,<p></p>", String());
    29522955                addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, message, requestIdentifier);
    29532956            }

  • trunk/Source/WebCore/loader/DocumentLoader.cpp

    r147336 r147402  
    592592            String message = "Refused to display '" + response.url().elidedString() + "' in a frame because it set 'X-Frame-Options' to '" + content + "'.";
    593593            frame()->document()->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, message, identifier);
     594            frame()->document()->enforceSandboxFlags(SandboxOrigin);
    594595            if (HTMLFrameOwnerElement* ownerElement = frame()->ownerElement())
    595596                ownerElement->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
Note: See TracChangeset for help on using the changeset viewer.