Changeset 205200 in webkit


Ignore:
Timestamp:
Aug 30, 2016 3:24:39 PM (8 years ago)
Author:
Chris Dumez
Message:

Delete? should throw for cross-origin Window / Location objects
​https://bugs.webkit.org/show_bug.cgi?id=161397

Reviewed by Ryosuke Niwa.

Source/WebCore:

Delete? should throw for cross-origin Window / Location objects:

Firefox and Chrome already throw. Previously, WebKit was merely
ignoring the call and logging an error message.

No new tests, updated existing test.

  • bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::deleteProperty):
(WebCore::JSDOMWindow::deletePropertyByIndex):

  • bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::deleteProperty):
(WebCore::JSLocation::deletePropertyByIndex):

LayoutTests:

Update / rebaseline existing test to reflect behavior change.

  • http/tests/security/cross-frame-access-delete-expected.txt:
  • http/tests/security/cross-frame-access-delete.html:
  • http/tests/security/resources/cross-frame-iframe-for-delete-test.html:
Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r205196 r205200  
     12016-08-30  Chris Dumez  <cdumez@apple.com>
     2
     3        [[Delete]] should throw for cross-origin Window / Location objects
     4        https://bugs.webkit.org/show_bug.cgi?id=161397
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        Update / rebaseline existing test to reflect behavior change.
     9
     10        * http/tests/security/cross-frame-access-delete-expected.txt:
     11        * http/tests/security/cross-frame-access-delete.html:
     12        * http/tests/security/resources/cross-frame-iframe-for-delete-test.html:
     13
    1142016-08-30  Ryan Haddad  <ryanhaddad@apple.com>
    215

  • trunk/LayoutTests/http/tests/security/cross-frame-access-delete-expected.txt

    r196227 r205200  
    1 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    2 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    3 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    4 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
     1Tests [[Delete]] for cross origin Window / Location.
    52
    6 PASS: eval('delete targetWindow.existingProperty') should be 'false' and is.
    7 PASS: eval('delete targetWindow[1]') should be 'false' and is.
    8 PASS: eval('delete targetWindow.location.existingProperty') should be 'false' and is.
    9 PASS: eval('delete targetWindow.location[1]') should be 'false' and is.
     3On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
     4
     5
     6PASS delete targetWindow.existingProperty threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     7PASS delete targetWindow.name threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     8PASS delete targetWindow[1] threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     9PASS delete targetWindow.location.existingProperty threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     10PASS delete targetWindow.location.host threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     11PASS delete targetWindow.location[1] threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
     12PASS: successfullyParsed should be 'true' and is.
     13
     14TEST COMPLETE
     15
    1016
    1117

  • trunk/LayoutTests/http/tests/security/cross-frame-access-delete.html

    r196227 r205200  
    11<html>
    22<head>
     3    <script src="/js-test-resources/js-test-pre.js"></script>
    34    <script src="resources/cross-frame-access.js"></script>
    45    <script>
    5         if (window.testRunner) {
    6             testRunner.dumpAsText();
     6        description("Tests [[Delete]] for cross origin Window / Location.");
     7        jsTestIsAsync = true;
     8
     9        if (window.testRunner)
    710            testRunner.dumpChildFramesAsText();
    8             testRunner.waitUntilDone();
    9         }
    1011
    1112        receiver = function(e)
    … …  
    1314            if (e.data == "setValuesComplete")
    1415                deleteTest();
     16            if (e.data == "checkValuesComplete")
     17                finishJSTest();
    1518        }
    1619        addEventListener('message', receiver, false);
    … …  
    2023            targetWindow = frames[0];
    2124
    22             shouldBe("eval('delete targetWindow.existingProperty')", "false");
    23             shouldBe("eval('delete targetWindow[1]')", "false");
    24             shouldBe("eval('delete targetWindow.location.existingProperty')", "false");
    25             shouldBe("eval('delete targetWindow.location[1]')", "false");
     25            shouldThrowErrorName("delete targetWindow.existingProperty", "SecurityError");
     26            shouldThrowErrorName("delete targetWindow.name", "SecurityError");
     27            shouldThrowErrorName("delete targetWindow[1]", "SecurityError");
     28            shouldThrowErrorName("delete targetWindow.location.existingProperty", "SecurityError");
     29            shouldThrowErrorName("delete targetWindow.location.host", "SecurityError");
     30            shouldThrowErrorName("delete targetWindow.location[1]", "SecurityError");
    2631
    2732            targetWindow.postMessage("deletingValuesComplete", "*");
    … …  
    3237    <iframe src="http://localhost:8000/security/resources/cross-frame-iframe-for-delete-test.html"></iframe>
    3338    <pre id="console"></pre>
     39    <script src="/js-test-resources/js-test-post.js"></script>
    3440</body>
    3541</html>

  • trunk/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-delete-test.html

    r120174 r205200  
    3333            shouldBe("window.location[1]", "'test value'");
    3434
    35             if (window.testRunner)
    36                 testRunner.notifyDone();
     35             window.parent.postMessage("checkValuesComplete", "*");
    3736        }
    3837    </script>

  • trunk/Source/WebCore/ChangeLog

    r205199 r205200  
     12016-08-30  Chris Dumez  <cdumez@apple.com>
     2
     3        [[Delete]] should throw for cross-origin Window / Location objects
     4        https://bugs.webkit.org/show_bug.cgi?id=161397
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        [[Delete]] should throw for cross-origin Window / Location objects:
     9        - https://github.com/whatwg/html/pull/1728
     10
     11        Firefox and Chrome already throw. Previously, WebKit was merely
     12        ignoring the call and logging an error message.
     13
     14        No new tests, updated existing test.
     15
     16        * bindings/js/JSDOMWindowCustom.cpp:
     17        (WebCore::JSDOMWindow::deleteProperty):
     18        (WebCore::JSDOMWindow::deletePropertyByIndex):
     19        * bindings/js/JSLocationCustom.cpp:
     20        (WebCore::JSLocation::deleteProperty):
     21        (WebCore::JSLocation::deletePropertyByIndex):
     22
    1232016-08-30  Brady Eidson  <beidson@apple.com>
    224

  • trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r205198 r205200  
    270270    JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(cell);
    271271    // Only allow deleting properties by frames in the same origin.
    272     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped()))
     272    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), ThrowSecurityError))
    273273        return false;
    274274    return Base::deleteProperty(thisObject, exec, propertyName);
    … …  
    279279    JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(cell);
    280280    // Only allow deleting properties by frames in the same origin.
    281     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped()))
     281    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), ThrowSecurityError))
    282282        return false;
    283283    return Base::deletePropertyByIndex(thisObject, exec, propertyName);

  • trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp

    r205198 r205200  
    9595    JSLocation* thisObject = jsCast<JSLocation*>(cell);
    9696    // Only allow deleting by frames in the same origin.
    97     if (!shouldAllowAccessToFrame(exec, thisObject->wrapped().frame()))
     97    if (!BindingSecurity::shouldAllowAccessToFrame(exec, thisObject->wrapped().frame(), ThrowSecurityError))
    9898        return false;
    9999    return Base::deleteProperty(thisObject, exec, propertyName);
    … …  
    104104    JSLocation* thisObject = jsCast<JSLocation*>(cell);
    105105    // Only allow deleting by frames in the same origin.
    106     if (!shouldAllowAccessToFrame(exec, thisObject->wrapped().frame()))
     106    if (!BindingSecurity::shouldAllowAccessToFrame(exec, thisObject->wrapped().frame(), ThrowSecurityError))
    107107        return false;
    108108    return Base::deletePropertyByIndex(thisObject, exec, propertyName);
Note: See TracChangeset for help on using the changeset viewer.