Changeset 191008 in webkit

Timestamp:

Oct 13, 2015 2:46:10 PM (9 years ago)

Author:

dino@apple.com

Message:

Device motion and orientation should only be visible from the main frame's security origin
​https://bugs.webkit.org/show_bug.cgi?id=150072
<rdar://problem/23082036>

Reviewed by Brent Fulgham.

.:

Add a manual test for cross-origin device orientation events, while
we're waiting on the mock client to be supported everywhere.

• ManualTests/deviceorientation-child-frame.html: Added.
• ManualTests/deviceorientation-main-frame-only.html: Added.

Source/WebCore:

There are reports that gyroscope and accelerometer information can
be used to detect keyboard entry. One initial step to reduce the
risk is to forbid device motion and orientation events from
being fired in frames that are a different security origin from the main page.

Manual test: deviceorientation-main-frame-only.html

• page/DOMWindow.cpp:

(WebCore::DOMWindow::isSameSecurityOriginAsMainFrame): New helper function.
(WebCore::DOMWindow::addEventListener): Check if we are the main frame, or the
same security origin as the main frame. If not, don't add the event
listeners.

Location:

trunk

Files:

• ChangeLog (modified) (1 diff)
• ManualTests/deviceorientation-child-frame.html (added)
• ManualTests/deviceorientation-main-frame-only.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/DOMWindow.cpp (modified) (2 diffs)
• Source/WebCore/page/DOMWindow.h (modified) (1 diff)

trunk/ChangeLog

@@ +1 @@
+2015-10-13  Dean Jackson  <dino@apple.com>
+
+        Device motion and orientation should only be visible from the main frame's security origin
+        https://bugs.webkit.org/show_bug.cgi?id=150072
+        <rdar://problem/23082036>
+
+        Reviewed by Brent Fulgham.
+
+        Add a manual test for cross-origin device orientation events, while
+        we're waiting on the mock client to be supported everywhere.
+
+        * ManualTests/deviceorientation-child-frame.html: Added.
+        * ManualTests/deviceorientation-main-frame-only.html: Added.
+
 2015-10-12  Philip Chimento  <philip.chimento@gmail.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-10-13  Dean Jackson  <dino@apple.com>
+
+        Device motion and orientation should only be visible from the main frame's security origin
+        https://bugs.webkit.org/show_bug.cgi?id=150072
+        <rdar://problem/23082036>
+
+        Reviewed by Brent Fulgham.
+
+        There are reports that gyroscope and accelerometer information can
+        be used to detect keyboard entry. One initial step to reduce the
+        risk is to forbid device motion and orientation events from
+        being fired in frames that are a different security origin from the main page.
+
+        Manual test: deviceorientation-main-frame-only.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::isSameSecurityOriginAsMainFrame): New helper function.
+        (WebCore::DOMWindow::addEventListener): Check if we are the main frame, or the
+        same security origin as the main frame. If not, don't add the event
+        listeners.
+
 2015-10-12  Dean Jackson  <dino@apple.com>
 

trunk/Source/WebCore/page/DOMWindow.cpp

@@ -1692 +1692 @@
 }
 
+bool DOMWindow::isSameSecurityOriginAsMainFrame() const
+{
+    if (!m_frame || !m_frame->page() || !document())
+        return false;
+
+    if (m_frame->isMainFrame())
+        return true;
+
+    Document* mainFrameDocument = m_frame->mainFrame().document();
+
+    if (mainFrameDocument && document()->securityOrigin()->canAccess(mainFrameDocument->securityOrigin()))
+        return true;
+
+    return false;
+}
+
 bool DOMWindow::addEventListener(const AtomicString& eventType, RefPtr<EventListener>&& listener, bool useCapture)
 {
@@ -1713 +1729 @@
 #if ENABLE(DEVICE_ORIENTATION)
 #if PLATFORM(IOS)
-    else if (eventType == eventNames().devicemotionEvent && document())
-        document()->deviceMotionController()->addDeviceEventListener(this);
-    else if (eventType == eventNames().deviceorientationEvent && document())
-        document()->deviceOrientationController()->addDeviceEventListener(this);
+    else if ((eventType == eventNames().devicemotionEvent || eventType == eventNames().deviceorientationEvent) && document()) {
+        if (isSameSecurityOriginAsMainFrame()) {
+            if (eventType == eventNames().deviceorientationEvent)
+                document()->deviceOrientationController()->addDeviceEventListener(this);
+            else
+                document()->deviceMotionController()->addDeviceEventListener(this);
+        } else if (document())
+            document()->addConsoleMessage(MessageSource::JS, MessageLevel::Warning, ASCIILiteral("Blocked attempt add device motion or orientation listener from child frame that wasn't the same security origin as the main page."));
+    }
 #else
     else if (eventType == eventNames().devicemotionEvent && RuntimeEnabledFeatures::sharedFeatures().deviceMotionEnabled()) {
-        if (DeviceMotionController* controller = DeviceMotionController::from(page()))
-            controller->addDeviceEventListener(this);
+        if (isSameSecurityOriginAsMainFrame()) {
+            if (DeviceMotionController* controller = DeviceMotionController::from(page()))
+                controller->addDeviceEventListener(this);
+        } else if (document())
+            document()->addConsoleMessage(MessageSource::JS, MessageLevel::Warning, ASCIILiteral("Blocked attempt add device motion listener from child frame that wasn't the same security origin as the main page."));
     } else if (eventType == eventNames().deviceorientationEvent && RuntimeEnabledFeatures::sharedFeatures().deviceOrientationEnabled()) {
-        if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
-            controller->addDeviceEventListener(this);
+        if (isSameSecurityOriginAsMainFrame()) {
+            if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
+                controller->addDeviceEventListener(this);
+        } else if (document())
+            document()->addConsoleMessage(MessageSource::JS, MessageLevel::Warning, ASCIILiteral("Blocked attempt add device orientation listener from child frame that wasn't the same security origin as the main page."));
     }
 #endif // PLATFORM(IOS)

trunk/Source/WebCore/page/DOMWindow.h

@@ -362 +362 @@
         void willDestroyDocumentInFrame();
 
+        bool isSameSecurityOriginAsMainFrame() const;
+
 #if ENABLE(GAMEPAD)
         void incrementGamepadEventListenerCount();