Changeset 199795 in webkit


Ignore:
Timestamp:
Apr 20, 2016 3:56:40 PM (8 years ago)
Author:
commit-queue@webkit.org
Message:

[GTK] Expose AllowUniversalAccessFromFileURLs preference now that calling localStorage.getItem() results in SecurityError: DOM Exception 18
Source/WebKit2:

Patch by Dustin Falgout <​dustin@falgout.us> on 2016-04-20
Reviewed by Michael Catanzaro.

As of r197858 JavaScript loaded in the context of a file scheme url cannot access local storage. That is a major
breaking change as many applications that serve files locally rely on having access to local storage. The point
of that security fix is to avoid cases of downloaded HTML content (such as e-mail attachments or JS injected
into local contexts) from having access to your local file system and arbitrary local storage. If you are serving
local files in your applications, you can use the WebKitAllowUniversalAccessFromFileURLs preference key to tell
Webkit that you are approve of these kinds of interactions.

​https://bugs.webkit.org/show_bug.cgi?id=156651

  • UIProcess/API/gtk/WebKitSettings.cpp:

(webKitSettingsSetProperty):
(webKitSettingsGetProperty):
(webkit_settings_class_init):
(webkit_settings_get_allow_universal_access_from_file_urls):
(webkit_settings_set_allow_universal_access_from_file_urls):

  • UIProcess/API/gtk/WebKitSettings.h:
  • UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:

Tools:

​https://bugs.webkit.org/show_bug.cgi?id=156651

Patch by Dustin Falgout <​dustin@falgout.us> on 2016-04-20
Reviewed by Michael Catanzaro.

  • TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitSettings.cpp:

(testWebKitSettings):

Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit2/ChangeLog

    r199779 r199795  
     12016-04-20  Dustin Falgout  <dustin@falgout.us>
     2
     3        [GTK] Expose AllowUniversalAccessFromFileURLs preference now that calling localStorage.getItem() results in SecurityError: DOM Exception 18
     4       
     5        Reviewed by Michael Catanzaro.
     6               
     7        As of r197858 JavaScript loaded in the context of a file scheme url cannot access local storage. That is a major
     8        breaking change as many applications that serve files locally rely on having access to local storage. The point 
     9        of that security fix is to avoid cases of downloaded HTML content (such as e-mail attachments or JS injected
     10        into local contexts) from having access to your local file system and arbitrary local storage. If you are serving
     11        local files in your applications, you can use the WebKitAllowUniversalAccessFromFileURLs preference key to tell
     12        Webkit that you are approve of these kinds of interactions.
     13                                             
     14        https://bugs.webkit.org/show_bug.cgi?id=156651
     15
     16        * UIProcess/API/gtk/WebKitSettings.cpp:
     17        (webKitSettingsSetProperty):
     18        (webKitSettingsGetProperty):
     19        (webkit_settings_class_init):
     20        (webkit_settings_get_allow_universal_access_from_file_urls):
     21        (webkit_settings_set_allow_universal_access_from_file_urls):
     22        * UIProcess/API/gtk/WebKitSettings.h:
     23        * UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:
     24
    1252016-04-20  Brady Eidson  <beidson@apple.com>
    226

  • trunk/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp

    r196767 r199795  
    145145    PROP_ENABLE_SPATIAL_NAVIGATION,
    146146    PROP_ENABLE_MEDIASOURCE,
    147     PROP_ALLOW_FILE_ACCESS_FROM_FILE_URLS
     147    PROP_ALLOW_FILE_ACCESS_FROM_FILE_URLS,
     148    PROP_ALLOW_UNIVERSAL_ACCESS_FROM_FILE_URLS
    148149};
    149150
    … …  
    314315        webkit_settings_set_allow_file_access_from_file_urls(settings, g_value_get_boolean(value));
    315316        break;
     317    case PROP_ALLOW_UNIVERSAL_ACCESS_FROM_FILE_URLS:
     318        webkit_settings_set_allow_universal_access_from_file_urls(settings, g_value_get_boolean(value));
     319        break;
    316320    default:
    317321        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
    … …  
    471475    case PROP_ALLOW_FILE_ACCESS_FROM_FILE_URLS:
    472476        g_value_set_boolean(value, webkit_settings_get_allow_file_access_from_file_urls(settings));
     477        break;
     478    case PROP_ALLOW_UNIVERSAL_ACCESS_FROM_FILE_URLS:
     479        g_value_set_boolean(value, webkit_settings_get_allow_universal_access_from_file_urls(settings));
    473480        break;
    474481    default:
    … …  
    12431250            FALSE,
    12441251            readWriteConstructParamFlags));
     1252
     1253    /**
     1254     * WebKitSettings:allow-universal-access-from-file-urls:
     1255     *
     1256     * Whether or not JavaScript running in the context of a file scheme URL
     1257     * should be allowed to access content from any origin.  By default, when
     1258     * something is loaded in a #WebKitWebView using a file scheme URL,
     1259     * access to the local file system and arbitrary local storage is not
     1260     * allowed. This setting allows you to change that behaviour, so that
     1261     * it would be possible to use local storage, for example.
     1262     *
     1263     * Since: 2.14
     1264     */
     1265    g_object_class_install_property(gObjectClass,
     1266        PROP_ALLOW_UNIVERSAL_ACCESS_FROM_FILE_URLS,
     1267        g_param_spec_boolean("allow-universal-access-from-file-urls",
     1268            _("Allow universal access from the context of file scheme URLs"),
     1269            _("Whether or not universal access is allowed from the context of file scheme URLs"),
     1270            FALSE,
     1271            readWriteConstructParamFlags));
    12451272}
    12461273
    … …  
    30633090    g_object_notify(G_OBJECT(settings), "allow-file-access-from-file-urls");
    30643091}
     3092
     3093/**
     3094 * webkit_settings_get_allow_universal_access_from_file_urls:
     3095 * @settings: a #WebKitSettings
     3096 *
     3097 * Get the #WebKitSettings:allow-universal-access-from-file-urls property.
     3098 *
     3099 * Returns: %TRUE If universal access from file URLs is allowed or %FALSE otherwise.
     3100 *
     3101 * Since: 2.14
     3102 */
     3103gboolean webkit_settings_get_allow_universal_access_from_file_urls(WebKitSettings* settings)
     3104{
     3105    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
     3106
     3107    return settings->priv->preferences->allowUniversalAccessFromFileURLs();
     3108}
     3109
     3110/**
     3111 * webkit_settings_set_allow_universal_access_from_file_urls:
     3112 * @settings: a #WebKitSettings
     3113 * @allowed: Value to be set
     3114 *
     3115 * Set the #WebKitSettings:allow-universal-access-from-file-urls property.
     3116 *
     3117 * Since: 2.14
     3118 */
     3119void webkit_settings_set_allow_universal_access_from_file_urls(WebKitSettings* settings, gboolean allowed)
     3120{
     3121    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
     3122
     3123    WebKitSettingsPrivate* priv = settings->priv;
     3124    if (priv->preferences->allowUniversalAccessFromFileURLs() == allowed)
     3125        return;
     3126
     3127    priv->preferences->setAllowUniversalAccessFromFileURLs(allowed);
     3128    g_object_notify(G_OBJECT(settings), "allow-universal-access-from-file-urls");
     3129}

  • trunk/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h

    r183992 r199795  
    422422                                                                gboolean        allowed);
    423423
     424WEBKIT_API gboolean
     425webkit_settings_get_allow_universal_access_from_file_urls      (WebKitSettings *settings);
     426
     427WEBKIT_API void
     428webkit_settings_set_allow_universal_access_from_file_urls      (WebKitSettings *settings,
     429                                                                gboolean        allowed);
     430
    424431G_END_DECLS
    425432

  • trunk/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt

    r194579 r199795  
    454454webkit_settings_get_allow_file_access_from_file_urls
    455455webkit_settings_set_allow_file_access_from_file_urls
     456webkit_settings_get_allow_universal_access_from_file_urls
     457webkit_settings_set_allow_universal_access_from_file_urls
    456458
    457459<SUBSECTION Standard>

  • trunk/Tools/ChangeLog

    r199779 r199795  
     12016-04-20  Dustin Falgout  <dustin@falgout.us>
     2
     3        [GTK] Expose AllowUniversalAccessFromFileURLs preference now that calling localStorage.getItem() results in SecurityError: DOM Exception 18
     4        https://bugs.webkit.org/show_bug.cgi?id=156651
     5
     6        Reviewed by Michael Catanzaro.
     7
     8        * TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitSettings.cpp:
     9        (testWebKitSettings):
     10
    1112016-04-20  Brady Eidson  <beidson@apple.com>
    212

  • trunk/Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestWebKitSettings.cpp

    r185502 r199795  
    279279    g_assert(webkit_settings_get_allow_file_access_from_file_urls(settings));
    280280
     281    // Universal access from file URLs is not allowed by default.
     282    g_assert(!webkit_settings_get_allow_universal_access_from_file_urls(settings));
     283    webkit_settings_set_allow_universal_access_from_file_urls(settings, TRUE);
     284    g_assert(webkit_settings_get_allow_universal_access_from_file_urls(settings));
     285
    281286    g_object_unref(G_OBJECT(settings));
    282287}
Note: See TracChangeset for help on using the changeset viewer.