Changeset 206478 in webkit


Ignore:
Timestamp:
Sep 27, 2016 5:37:01 PM (8 years ago)
Author:
Chris Dumez
Message:

<a download> does not honor the same-origin requirement
​https://bugs.webkit.org/show_bug.cgi?id=156100

Reviewed by Alex Christensen.

Source/WebCore:

We now completely ignore the "download" attribute on anchors if the
href URL is cross-origin. We therefore navigate to the URL instead
of forcefully downloading it in this case and leave it up to the server
to give us the right headers if it should be downloaded. This is
conservative and matches Firefox.

Chrome and the HTML specification ignore only the suggested filename
if the URL is cross-origin but still download the file.

No new tests, updated existing test.

  • html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::handleClick):

LayoutTests:

Update existing cross origin test as it expected the suggested filename to
be ignored but the file to still be downloaded (Chrome behavior) instead
of the download attribute to be completely ignored and therefore navigate
(Firefox behavior).

  • TestExpectations:
  • http/tests/resources/pass-notify-done.html: Added.
  • http/tests/security/anchor-download-block-crossorigin-expected.txt:
  • http/tests/security/anchor-download-block-crossorigin.html:
Location:
trunk
Files:
1 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r206474 r206478  
     12016-09-27  Chris Dumez  <cdumez@apple.com>
     2
     3        <a download> does not honor the same-origin requirement
     4        https://bugs.webkit.org/show_bug.cgi?id=156100
     5
     6        Reviewed by Alex Christensen.
     7
     8        Update existing cross origin test as it expected the suggested filename to
     9        be ignored but the file to still be downloaded (Chrome behavior) instead
     10        of the download attribute to be completely ignored and therefore navigate
     11        (Firefox behavior).
     12
     13        * TestExpectations:
     14        * http/tests/resources/pass-notify-done.html: Added.
     15        * http/tests/security/anchor-download-block-crossorigin-expected.txt:
     16        * http/tests/security/anchor-download-block-crossorigin.html:
     17
    1182016-09-27  Ryan Haddad  <ryanhaddad@apple.com>
    219

  • trunk/LayoutTests/TestExpectations

    r206449 r206478  
    899899fast/scrolling/rtl-scrollbars-animation-property.html [ Failure ]
    900900
    901 # <a download> does not honor cross-origin restrictions
    902 webkit.org/b/156100 http/tests/security/anchor-download-block-crossorigin.html [ Failure ]
    903 
    904901webkit.org/b/157849 fast/frames/crash-during-iframe-load-stop.html [ Pass Timeout ]
    905902

  • trunk/LayoutTests/http/tests/security/anchor-download-block-crossorigin-expected.txt

    r198955 r206478  
    1 Downloading URL with suggested filename ""
    2 Tests that a suggested filename on a download attribute is ignored if the link is cross origin.
    3 
    4 The suggested filename at the top should be empty.
     1PASS

  • trunk/LayoutTests/http/tests/security/anchor-download-block-crossorigin.html

    r198955 r206478  
    55<script>
    66    if (window.testRunner)
    7         testRunner.waitUntilDownloadFinished();
     7        testRunner.waitUntilDone();
    88</script>
    99</head>
    1010<body>
    1111<p>
    12 Tests that a suggested filename on a download attribute is ignored if
    13 <a id="dl" href="http://localhost:8080/security/resources/attachment.php" download="foo.pdf">the link</a> is cross origin.
     12Tests that the download attribute is ignored if
     13<a id="dl" href="http://localhost:8080/resources/pass-notify-done.html" download="FAIL.pdf">the link</a> is cross origin.
    1414<p>
    15 The suggested filename at the top should be empty.
     15It should navigate instead of downloading the file.
    1616<script>
    1717    function click(elmt)

  • trunk/Source/WebCore/ChangeLog

    r206477 r206478  
     12016-09-27  Chris Dumez  <cdumez@apple.com>
     2
     3        <a download> does not honor the same-origin requirement
     4        https://bugs.webkit.org/show_bug.cgi?id=156100
     5
     6        Reviewed by Alex Christensen.
     7
     8        We now completely ignore the "download" attribute on anchors if the
     9        href URL is cross-origin. We therefore navigate to the URL instead
     10        of forcefully downloading it in this case and leave it up to the server
     11        to give us the right headers if it should be downloaded. This is
     12        conservative and matches Firefox.
     13
     14        Chrome and the HTML specification ignore only the suggested filename
     15        if the URL is cross-origin but still download the file.
     16
     17        No new tests, updated existing test.
     18
     19        * html/HTMLAnchorElement.cpp:
     20        (WebCore::HTMLAnchorElement::handleClick):
     21
    1222016-09-27  Alex Christensen  <achristensen@webkit.org>
    223

  • trunk/Source/WebCore/html/HTMLAnchorElement.cpp

    r206356 r206478  
    364364    url.append(stripLeadingAndTrailingHTMLSpaces(attributeWithoutSynchronization(hrefAttr)));
    365365    appendServerMapMousePosition(url, event);
    366     URL kurl = document().completeURL(url.toString());
     366    URL completedURL = document().completeURL(url.toString());
    367367
    368368    auto downloadAttribute = nullAtom;
    369369#if ENABLE(DOWNLOAD_ATTRIBUTE)
    370370    if (RuntimeEnabledFeatures::sharedFeatures().downloadAttributeEnabled()) {
    371         downloadAttribute = attributeWithoutSynchronization(downloadAttr);
     371        // Ignore the download attribute completely if the href URL is cross origin.
     372        bool isSameOrigin = completedURL.protocolIsData() || document().securityOrigin()->canRequest(completedURL);
     373        if (isSameOrigin)
     374            downloadAttribute = attributeWithoutSynchronization(downloadAttr);
    372375        // If the a element has a download attribute and the algorithm is not triggered by user activation
    373376        // then abort these steps.
    … …  
    378381#endif
    379382
    380     frame->loader().urlSelected(kurl, target(), &event, LockHistory::No, LockBackForwardList::No, hasRel(RelationNoReferrer) ? NeverSendReferrer : MaybeSendReferrer, document().shouldOpenExternalURLsPolicyToPropagate(), downloadAttribute);
    381 
    382     sendPings(kurl);
     383    frame->loader().urlSelected(completedURL, target(), &event, LockHistory::No, LockBackForwardList::No, hasRel(RelationNoReferrer) ? NeverSendReferrer : MaybeSendReferrer, document().shouldOpenExternalURLsPolicyToPropagate(), downloadAttribute);
     384
     385    sendPings(completedURL);
    383386}
    384387
Note: See TracChangeset for help on using the changeset viewer.