Changeset 205171 in webkit


Ignore:
Timestamp:
Aug 29, 2016 10:24:13 PM (8 years ago)
Author:
Chris Dumez
Message:

We should throw a SecurityError when denying setting a cross-origin Location property
​https://bugs.webkit.org/show_bug.cgi?id=161368

Reviewed by Ryosuke Niwa.

Source/WebCore:

We should throw a SecurityError when denying setting a cross-origin
Location property:

Firefox and Chrome already throw. We currently ignore and log an error
message.

No new tests, updated existing tests.

  • bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::putDelegate):

LayoutTests:

Update / Rebaseline existing tests to reflect behavior change.

  • http/tests/security/cross-frame-access-location-put-expected.txt:
  • http/tests/security/location-cross-origin-expected.txt:
  • http/tests/security/location-cross-origin.html:
  • http/tests/security/xss-DENIED-assign-location-hash-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-host-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-hostname-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-nonstandardProperty-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-pathname-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-protocol-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-reload-expected.txt:
  • http/tests/security/xss-DENIED-assign-location-search-expected.txt:
Location:
trunk
Files:
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r205170 r205171  
     12016-08-29  Chris Dumez  <cdumez@apple.com>
     2
     3        We should throw a SecurityError when denying setting a cross-origin Location property
     4        https://bugs.webkit.org/show_bug.cgi?id=161368
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        Update / Rebaseline existing tests to reflect behavior change.
     9
     10        * http/tests/security/cross-frame-access-location-put-expected.txt:
     11        * http/tests/security/location-cross-origin-expected.txt:
     12        * http/tests/security/location-cross-origin.html:
     13        * http/tests/security/xss-DENIED-assign-location-hash-expected.txt:
     14        * http/tests/security/xss-DENIED-assign-location-host-expected.txt:
     15        * http/tests/security/xss-DENIED-assign-location-hostname-expected.txt:
     16        * http/tests/security/xss-DENIED-assign-location-nonstandardProperty-expected.txt:
     17        * http/tests/security/xss-DENIED-assign-location-pathname-expected.txt:
     18        * http/tests/security/xss-DENIED-assign-location-protocol-expected.txt:
     19        * http/tests/security/xss-DENIED-assign-location-reload-expected.txt:
     20        * http/tests/security/xss-DENIED-assign-location-search-expected.txt:
     21
    1222016-08-29  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
    223

  • trunk/LayoutTests/http/tests/security/cross-frame-access-location-put-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    2 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    3 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    4 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    51
     2SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
     3SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
     4SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
     5SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    66
    77

  • trunk/LayoutTests/http/tests/security/location-cross-origin-expected.txt

    r205154 r205171  
    2828PASS Object.getOwnPropertyDescriptor(window.location, 'toString').value.call(frames[0].location) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
    2929PASS Object.getOwnPropertyDescriptor(window.location, 'href').get.call(frames[0].location) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     30PASS frames[0].location.protocol = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     31PASS frames[0].location.host = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     32PASS frames[0].location.hostname = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     33PASS frames[0].location.port = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     34PASS frames[0].location.pathname = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     35PASS frames[0].location.search = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     36PASS frames[0].location.hash = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     37PASS frames[0].location.origin = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     38PASS frames[0].location.ancestorOrigins = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     39FAIL frames[0].location.toString = 1 should throw a SecurityError. Did not throw.
     40PASS frames[0].location.reload = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     41PASS frames[0].location.replace = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     42PASS frames[0].location.assign = 1 threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     43PASS Object.getOwnPropertyDescriptor(window.location, 'protocol').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     44PASS Object.getOwnPropertyDescriptor(window.location, 'host').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     45PASS Object.getOwnPropertyDescriptor(window.location, 'hostname').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     46PASS Object.getOwnPropertyDescriptor(window.location, 'port').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     47PASS Object.getOwnPropertyDescriptor(window.location, 'pathname').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     48PASS Object.getOwnPropertyDescriptor(window.location, 'search').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     49PASS Object.getOwnPropertyDescriptor(window.location, 'hash').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
    3050PASS frames[0].location.href = 'about:blank' did not throw exception.
    3151PASS frames[0].location.href is "about:blank"

  • trunk/LayoutTests/http/tests/security/location-cross-origin.html

    r205154 r205171  
    3535    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'href').get.call(frames[0].location)", "SecurityError");
    3636
     37    shouldThrowErrorName("frames[0].location.protocol = 1", "SecurityError");
     38    shouldThrowErrorName("frames[0].location.host = 1", "SecurityError");
     39    shouldThrowErrorName("frames[0].location.hostname = 1", "SecurityError");
     40    shouldThrowErrorName("frames[0].location.port = 1", "SecurityError");
     41    shouldThrowErrorName("frames[0].location.pathname = 1", "SecurityError");
     42    shouldThrowErrorName("frames[0].location.search = 1", "SecurityError");
     43    shouldThrowErrorName("frames[0].location.hash = 1", "SecurityError");
     44    shouldThrowErrorName("frames[0].location.origin = 1", "SecurityError");
     45    shouldThrowErrorName("frames[0].location.ancestorOrigins = 1", "SecurityError");
     46    shouldThrowErrorName("frames[0].location.toString = 1", "SecurityError");
     47    shouldThrowErrorName("frames[0].location.reload = 1", "SecurityError");
     48    shouldThrowErrorName("frames[0].location.replace = 1", "SecurityError");
     49    shouldThrowErrorName("frames[0].location.assign = 1", "SecurityError");
     50
     51    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'protocol').set.call(frames[0].location, 1)", "SecurityError");
     52    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'host').set.call(frames[0].location, 1)", "SecurityError");
     53    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hostname').set.call(frames[0].location, 1)", "SecurityError");
     54    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'port').set.call(frames[0].location, 1)", "SecurityError");
     55    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'pathname').set.call(frames[0].location, 1)", "SecurityError");
     56    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'search').set.call(frames[0].location, 1)", "SecurityError");
     57    shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hash').set.call(frames[0].location, 1)", "SecurityError");
     58
    3759    // Setting 'href' cross origin should be allowed.
    3860    shouldNotThrow("frames[0].location.href = 'about:blank'");

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-hash-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.hash not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-host-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.host not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-hostname-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.hostname not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-nonstandardProperty-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.nonstandardProperty not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-pathname-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.pathname not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-protocol-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.protocol not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-reload-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.replace not allowed

  • trunk/LayoutTests/http/tests/security/xss-DENIED-assign-location-search-expected.txt

    r178527 r205171  
    1 CONSOLE MESSAGE: line 4: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
     1CONSOLE MESSAGE: line 4: SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
    22
    33PASS: cross-site assignment of location.search not allowed

  • trunk/Source/WebCore/ChangeLog

    r205163 r205171  
     12016-08-29  Chris Dumez  <cdumez@apple.com>
     2
     3        We should throw a SecurityError when denying setting a cross-origin Location property
     4        https://bugs.webkit.org/show_bug.cgi?id=161368
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        We should throw a SecurityError when denying setting a cross-origin
     9        Location property:
     10        - https://html.spec.whatwg.org/#location-set
     11        - https://html.spec.whatwg.org/#crossoriginset-(-o,-p,-v,-receiver-)
     12        - https://html.spec.whatwg.org/#location-getownproperty
     13
     14        Firefox and Chrome already throw. We currently ignore and log an error
     15        message.
     16
     17        No new tests, updated existing tests.
     18
     19        * bindings/js/JSLocationCustom.cpp:
     20        (WebCore::JSLocation::putDelegate):
     21
    1222016-08-29  Brent Fulgham  <bfulgham@apple.com>
    223

  • trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp

    r205154 r205171  
    7979    // disclose other parts of the original location.
    8080    if (propertyName != exec->propertyNames().href) {
    81         // FIXME: We should throw a SecurityError.
    82         printErrorMessageForFrame(frame, errorMessage);
     81        throwSecurityError(*exec, errorMessage);
    8382        return true;
    8483    }
Note: See TracChangeset for help on using the changeset viewer.