Changeset 147526 in webkit

Timestamp:

Apr 3, 2013 1:31:07 AM (11 years ago)

Author:

mkwst@chromium.org

Message:

Extract URL that doesn't inherit a parent's SecurityOrigin out into a constant.
​https://bugs.webkit.org/show_bug.cgi?id=113780

Reviewed by Jochen Eisinger.

We're scheduling navigations to 'data:text/html,' in XSSAuditor in
order to end up on a page that doesn't inherit its parent's
SecurityOrigin. We'll be reusing this mechainsm to solve
​http://wkbug.com/112903

This patch makes us more explicit about what we're doing and why.
It doesn't change any behavior: XSSAuditor tests should still pass.

• html/parser/XSSAuditorDelegate.cpp:

(WebCore::XSSAuditorDelegate::didBlockScript):

Use SecurityOrigin::urlWithUniqueSecurityOrigin rather than a
literal string to make our intentions clear.

• page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::urlWithUniqueSecurityOrigin):

• page/SecurityOrigin.h:

Add the new static method.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/parser/XSSAuditorDelegate.cpp (modified) (1 diff)
• page/SecurityOrigin.cpp (modified) (1 diff)
• page/SecurityOrigin.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-03  Mike West  <mkwst@chromium.org>
+
+        Extract URL that doesn't inherit a parent's SecurityOrigin out into a constant.
+        https://bugs.webkit.org/show_bug.cgi?id=113780
+
+        Reviewed by Jochen Eisinger.
+
+        We're scheduling navigations to 'data:text/html,' in XSSAuditor in
+        order to end up on a page that doesn't inherit its parent's
+        SecurityOrigin. We'll be reusing this mechainsm to solve
+        http://wkbug.com/112903
+
+        This patch makes us more explicit about what we're doing and why.
+        It doesn't change any behavior: XSSAuditor tests should still pass.
+
+        * html/parser/XSSAuditorDelegate.cpp:
+        (WebCore::XSSAuditorDelegate::didBlockScript):
+            Use SecurityOrigin::urlWithUniqueSecurityOrigin rather than a
+            literal string to make our intentions clear.
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::urlWithUniqueSecurityOrigin):
+        * page/SecurityOrigin.h:
+            Add the new static method.
+
 2013-04-02  Chris Fleizach  <cfleizach@apple.com>
 

trunk/Source/WebCore/html/parser/XSSAuditorDelegate.cpp

@@ -112 +112 @@
 
     if (xssInfo.m_didBlockEntirePage)
-        m_document->frame()->navigationScheduler()->scheduleLocationChange(m_document->securityOrigin(), String("data:text/html,<p></p>"), blankURL());
+        m_document->frame()->navigationScheduler()->scheduleLocationChange(m_document->securityOrigin(), SecurityOrigin::urlWithUniqueSecurityOrigin(), String());
 }
 

trunk/Source/WebCore/page/SecurityOrigin.cpp

@@ -593 +593 @@
 }
 
+String SecurityOrigin::urlWithUniqueSecurityOrigin()
+{
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(const String, uniqueSecurityOriginURL, (ASCIILiteral("data:,")));
+    return uniqueSecurityOriginURL;
+}
+
 } // namespace WebCore

trunk/Source/WebCore/page/SecurityOrigin.h

@@ -211 +211 @@
     bool isSameSchemeHostPort(const SecurityOrigin*) const;
 
+    static String urlWithUniqueSecurityOrigin();
+
 private:
     SecurityOrigin();