Changeset 210474 in webkit

Timestamp:

Jan 6, 2017 11:14:03 PM (7 years ago)

Author:

dbates@webkit.org

Message:

Ensure navigation only allowed for documents not in the page cache
​https://bugs.webkit.org/show_bug.cgi?id=166773
<rdar://problem/29762809>

Reviewed by Brent Fulgham.

It is wise to ensure that navigation is only allowed when initiated from a document that
is not in- or about to be put in- the page cache. Such a navigation would surprise a
person that had navigated away from the initiating document among other issues.

• dom/Document.cpp:

(WebCore::Document::canNavigate): Only allow navigation if the document is not in the
page cache.

• html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::handleClick): Ditto.

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::handleClick): Ditto.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::urlSelected): Assert triggering event's document is not in the
page cache.
(WebCore::FrameLoader::submitForm): Allow submission if the document is not in the
page cache.
(WebCore::FrameLoader::loadFrameRequest): Assert triggering event's document is not in
the page cache.

• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::defaultEventHandler): Only allow navigation if the document is
not in the page cache.

• svg/SVGAElement.cpp:

(WebCore::SVGAElement::defaultEventHandler): Ditto.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Document.cpp (modified) (1 diff)
• html/HTMLAnchorElement.cpp (modified) (1 diff)
• html/HTMLLinkElement.cpp (modified) (1 diff)
• loader/FrameLoader.cpp (modified) (3 diffs)
• mathml/MathMLElement.cpp (modified) (1 diff)
• svg/SVGAElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-01-06  Daniel Bates  <dabates@apple.com>
+
+        Ensure navigation only allowed for documents not in the page cache
+        https://bugs.webkit.org/show_bug.cgi?id=166773
+        <rdar://problem/29762809>
+
+        Reviewed by Brent Fulgham.
+
+        It is wise to ensure that navigation is only allowed when initiated from a document that
+        is not in- or about to be put in- the page cache. Such a navigation would surprise a
+        person that had navigated away from the initiating document among other issues.
+
+        * dom/Document.cpp:
+        (WebCore::Document::canNavigate): Only allow navigation if the document is not in the
+        page cache.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::handleClick): Ditto.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::handleClick): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Assert triggering event's document is not in the
+        page cache.
+        (WebCore::FrameLoader::submitForm): Allow submission if the document is not in the
+        page cache.
+        (WebCore::FrameLoader::loadFrameRequest): Assert triggering event's document is not in
+        the page cache.
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::defaultEventHandler): Only allow navigation if the document is
+        not in the page cache.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Ditto.
+
 2017-01-06  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -2973 +2973 @@
         return false;
 
+    if (pageCacheState() != Document::NotInPageCache)
+        return false;
+
     // FIXME: We shouldn't call this function without a target frame, but
     // fast/forms/submit-to-blank-multiple-times.html depends on this function

trunk/Source/WebCore/html/HTMLAnchorElement.cpp

@@ -370 +370 @@
         return;
 
+    if (document().pageCacheState() != Document::NotInPageCache)
+        return;
+
     StringBuilder url;
     url.append(stripLeadingAndTrailingHTMLSpaces(attributeWithoutSynchronization(hrefAttr)));

trunk/Source/WebCore/html/HTMLLinkElement.cpp

@@ -491 +491 @@
     if (!frame)
         return;
+    if (document().pageCacheState() != Document::NotInPageCache)
+        return;
     frame->loader().urlSelected(url, target(), &event, LockHistory::No, LockBackForwardList::No, MaybeSendReferrer, document().shouldOpenExternalURLsPolicyToPropagate());
 }

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -347 +347 @@
 void FrameLoader::urlSelected(const FrameLoadRequest& passedRequest, Event* triggeringEvent)
 {
+    ASSERT_WITH_SECURITY_IMPLICATION(!triggeringEvent || !triggeringEvent->target() || !triggeringEvent->target()->toNode()
+        || triggeringEvent->target()->toNode()->document().pageCacheState() == Document::NotInPageCache);
+
     Ref<Frame> protect(m_frame);
     FrameLoadRequest frameRequest(passedRequest);
@@ -370 +373 @@
     ASSERT(submission->state());
     ASSERT(!submission->state()->sourceDocument()->frame() || submission->state()->sourceDocument()->frame() == &m_frame);
-    
+
     if (!m_frame.page())
         return;
-    
+
+    if (submission->state()->sourceDocument()->pageCacheState() != Document::NotInPageCache)
+        return;
+
     if (submission->action().isEmpty())
         return;
@@ -1124 +1130 @@
 
 void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, Event* event, FormState* formState)
-{    
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!event || !event->target() || !event->target()->toNode()
+        || event->target()->toNode()->document().pageCacheState() == Document::NotInPageCache);
+
     // Protect frame from getting blown away inside dispatchBeforeLoadEvent in loadWithDocumentLoader.
     Ref<Frame> protect(m_frame);

trunk/Source/WebCore/mathml/MathMLElement.cpp

@@ -150 +150 @@
             const auto& url = stripLeadingAndTrailingHTMLSpaces(href);
             event.setDefaultHandled();
+            if (document().pageCacheState() != Document::NotInPageCache)
+                return;
             if (auto* frame = document().frame())
                 frame->loader().urlSelected(document().completeURL(url), "_self", &event, LockHistory::No, LockBackForwardList::No, MaybeSendReferrer, document().shouldOpenExternalURLsPolicyToPropagate());

trunk/Source/WebCore/svg/SVGAElement.cpp

@@ -146 +146 @@
             if (!frame)
                 return;
+            if (document().pageCacheState() != Document::NotInPageCache)
+                return;
             frame->loader().urlSelected(document().completeURL(url), target, &event, LockHistory::No, LockBackForwardList::No, MaybeSendReferrer, document().shouldOpenExternalURLsPolicyToPropagate());
             return;