Changeset 205409 in webkit


Ignore:
Timestamp:
Sep 3, 2016 3:50:55 PM (8 years ago)
Author:
Chris Dumez
Message:

Align cross-Origin Object.getOwnPropertyNames() with the HTML specification
​https://bugs.webkit.org/show_bug.cgi?id=161457

Reviewed by Darin Adler.

Source/WebCore:

Align cross-Origin Object.getOwnPropertyNames() with the HTML specification:

We should list cross origin properties.

Firefox complies with the specification. However, WebKit was returning an
empty array and logs a security error message.

No new tests, updated existing test.

  • bindings/js/JSDOMWindowCustom.cpp:

(WebCore::addCrossOriginPropertyNames):
(WebCore::JSDOMWindow::getOwnPropertyNames):

  • bindings/js/JSLocationCustom.cpp:

(WebCore::addCrossOriginPropertyNames):
(WebCore::JSLocation::getOwnPropertyNames):

LayoutTests:

Add test coverage.

  • http/tests/security/cross-frame-access-enumeration-expected.txt:
  • http/tests/security/cross-frame-access-enumeration.html:
Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r205404 r205409  
     12016-09-03  Chris Dumez  <cdumez@apple.com>
     2
     3        Align cross-Origin Object.getOwnPropertyNames() with the HTML specification
     4        https://bugs.webkit.org/show_bug.cgi?id=161457
     5
     6        Reviewed by Darin Adler.
     7
     8        Add test coverage.
     9
     10        * http/tests/security/cross-frame-access-enumeration-expected.txt:
     11        * http/tests/security/cross-frame-access-enumeration.html:
     12
    1132016-09-03  Chris Dumez  <cdumez@apple.com>
    214

  • trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt

    r196237 r205409  
    1 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    2 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    3 CONSOLE MESSAGE: line 48: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    4 CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    5 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    6 CONSOLE MESSAGE: line 75: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    7 CONSOLE MESSAGE: line 82: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    8 This tests that variable names can't be enumerated cross domain (see http://bugs.webkit.org/show_bug.cgi?id=16387)
     1CONSOLE MESSAGE: line 28: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
     2CONSOLE MESSAGE: line 28: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
     3Tests enumeration of Window / Location properties cross origin.
     4
     5On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
    96
    107
    … …  
    1512PASS: Cross frame access by getting the keys of the Location object was denied.
    1613PASS: Cross frame access by getting the property names of the Location object was denied.
     14PASS: areArraysEqual(Object.getOwnPropertyNames(b_win).sort(), whitelistedWindowProperties.sort()) should be 'true' and is.
     15PASS: areArraysEqual(Object.getOwnPropertyNames(b_win.location).sort(), whitelistedLocationProperties.sort()) should be 'true' and is.
     16PASS: successfullyParsed should be 'true' and is.
    1717
     18TEST COMPLETE
     19

  • trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration.html

    r196237 r205409  
    11<html>
    22<head>
     3    <script src='/resources/js-test-pre.js'></script>
    34    <script src="resources/cross-frame-access.js"></script>
    45    <script>
     6        description("Tests enumeration of Window / Location properties cross origin.");
     7        jsTestIsAsync = true;
     8
    59        window.onload = function()
    610        {
    7             if (window.testRunner) {
    8                 testRunner.dumpAsText();
    9                 testRunner.waitUntilDone();
    10             }
    11 
    1211            if (window.testRunner) {
    1312                setTimeout(pollForTest, 1);
    … …  
    2827            }
    2928            runTest();
    30             testRunner.notifyDone();
     29            finishJSTest();
    3130        }
    3231
    … …  
    3433        {
    3534            // Test enumerating the Window object
    36             var b_win = document.getElementsByTagName("iframe")[0].contentWindow;
     35            b_win = document.getElementsByTagName("iframe")[0].contentWindow;
    3736            try {
    3837                for (var k in b_win) {
    … …  
    8685            }
    8786            log("PASS: Cross frame access by getting the property names of the Location object was denied.");
     87
     88            whitelistedWindowProperties = ['location', 'postMessage', 'window', 'frames', 'self', 'top', 'parent', 'opener', 'closed', 'close', 'blur', 'focus', 'length'];
     89            whitelistedLocationProperties = ['href', 'replace'];
     90            shouldBeTrue("areArraysEqual(Object.getOwnPropertyNames(b_win).sort(), whitelistedWindowProperties.sort())");
     91            shouldBeTrue("areArraysEqual(Object.getOwnPropertyNames(b_win.location).sort(), whitelistedLocationProperties.sort())");
    8892        }
    8993    </script>
    9094</head>
    9195<body>
    92     <p>This tests that variable names can't be enumerated cross domain (see http://bugs.webkit.org/show_bug.cgi?id=16387)</p>
    9396    <iframe src="http://localhost:8000/security/resources/cross-frame-iframe-for-enumeration-test.html"></iframe>
    94     <pre id="console"></pre>
     97    <script src='/resources/js-test-post.js'></script>
    9598</body>
    9699</html>

  • trunk/Source/WebCore/ChangeLog

    r205408 r205409  
     12016-09-03  Chris Dumez  <cdumez@apple.com>
     2
     3        Align cross-Origin Object.getOwnPropertyNames() with the HTML specification
     4        https://bugs.webkit.org/show_bug.cgi?id=161457
     5
     6        Reviewed by Darin Adler.
     7
     8        Align cross-Origin Object.getOwnPropertyNames() with the HTML specification:
     9        - https://html.spec.whatwg.org/#windowproxy-ownpropertykeys
     10        - https://html.spec.whatwg.org/#location-ownpropertykeys
     11        - https://html.spec.whatwg.org/#crossoriginproperties-(-o-)
     12
     13        We should list cross origin properties.
     14
     15        Firefox complies with the specification. However, WebKit was returning an
     16        empty array and logs a security error message.
     17
     18        No new tests, updated existing test.
     19
     20        * bindings/js/JSDOMWindowCustom.cpp:
     21        (WebCore::addCrossOriginPropertyNames):
     22        (WebCore::JSDOMWindow::getOwnPropertyNames):
     23        * bindings/js/JSLocationCustom.cpp:
     24        (WebCore::addCrossOriginPropertyNames):
     25        (WebCore::JSLocation::getOwnPropertyNames):
     26
    1272016-09-03  Frédéric Wang  <fwang@igalia.com>
    228

  • trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r205404 r205409  
    320320}
    321321
     322static void addCrossOriginWindowPropertyNames(ExecState& state, PropertyNameArray& propertyNames)
     323{
     324    // https://html.spec.whatwg.org/#crossoriginproperties-(-o-)
     325    static const Identifier* properties[] = {
     326        &state.propertyNames().blur, &state.propertyNames().close, &state.propertyNames().closed,
     327        &state.propertyNames().focus, &state.propertyNames().frames, &state.propertyNames().length,
     328        &state.propertyNames().location, &state.propertyNames().opener, &state.propertyNames().parent,
     329        &state.propertyNames().postMessage, &state.propertyNames().self, &state.propertyNames().top,
     330        &state.propertyNames().window
     331    };
     332    for (auto* property : properties)
     333        propertyNames.add(*property);
     334}
     335
    322336void JSDOMWindow::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
    323337{
    324338    JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(object);
    325     // Only allow the window to enumerated by frames in the same origin.
    326     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped()))
     339    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), DoNotReportSecurityError)) {
     340        addCrossOriginWindowPropertyNames(*exec, propertyNames);
    327341        return;
     342    }
    328343    Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
    329344}

  • trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp

    r205372 r205409  
    109109}
    110110
     111static void addCrossOriginLocationPropertyNames(ExecState& state, PropertyNameArray& propertyNames)
     112{
     113    // https://html.spec.whatwg.org/#crossoriginproperties-(-o-)
     114    static const Identifier* properties[] = { &state.propertyNames().href, &state.propertyNames().replace };
     115    for (auto* property : properties)
     116        propertyNames.add(*property);
     117}
     118
    111119void JSLocation::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
    112120{
    113121    JSLocation* thisObject = jsCast<JSLocation*>(object);
    114     // Only allow the location object to enumerated by frames in the same origin.
    115     if (!shouldAllowAccessToFrame(exec, thisObject->wrapped().frame()))
     122    if (!BindingSecurity::shouldAllowAccessToFrame(exec, thisObject->wrapped().frame(), DoNotReportSecurityError)) {
     123        addCrossOriginLocationPropertyNames(*exec, propertyNames);
    116124        return;
     125    }
    117126    Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
    118127}
Note: See TracChangeset for help on using the changeset viewer.