Changeset 253544 in webkit

Timestamp:

Dec 16, 2019 3:04:41 AM (4 years ago)

Author:

youenn@apple.com

Message:

SecurityOrigin should be unique for null blob URLs that have been unregistered
​https://bugs.webkit.org/show_bug.cgi?id=205169

Reviewed by Darin Adler.

Source/WebCore:

In case we cannot retrieve a cached origin for a null origin, just create a unique one.
This is better than having an origin with an empty host and empty scheme.

Test: http/tests/security/blob-null-url-location-origin.html

• fileapi/ThreadableBlobRegistry.cpp:

(WebCore::ThreadableBlobRegistry::unregisterBlobURL):
(WebCore::ThreadableBlobRegistry::getCachedOrigin):

LayoutTests:

• http/tests/security/blob-null-url-location-origin-expected.txt: Added.
• http/tests/security/blob-null-url-location-origin.html: Added.
• platform/win/TestExpectations: Skipping test as timing out in windows.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/blob-null-url-location-origin-expected.txt (added)
• LayoutTests/http/tests/security/blob-null-url-location-origin.html (added)
• LayoutTests/platform/win/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/fileapi/ThreadableBlobRegistry.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-12-16  youenn fablet  <youenn@apple.com>
+
+        SecurityOrigin should be unique for null blob URLs that have been unregistered
+        https://bugs.webkit.org/show_bug.cgi?id=205169
+
+        Reviewed by Darin Adler.
+
+        * http/tests/security/blob-null-url-location-origin-expected.txt: Added.
+        * http/tests/security/blob-null-url-location-origin.html: Added.
+        * platform/win/TestExpectations: Skipping test as timing out in windows.
+
 2019-12-15  Emilio Cobos Álvarez  <emilio@crisal.io>
 

trunk/LayoutTests/platform/win/TestExpectations

@@ -744 +744 @@
 http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-report.php [ Skip ]
 http/tests/security/contentSecurityPolicy/same-origin-plugin-document-with-csp-blocked-in-child-window.html [ Skip ]
+
+http/tests/security/blob-null-url-location-origin.html [ Skip ]
 
 ################################################################################

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-12-16  youenn fablet  <youenn@apple.com>
+
+        SecurityOrigin should be unique for null blob URLs that have been unregistered
+        https://bugs.webkit.org/show_bug.cgi?id=205169
+
+        Reviewed by Darin Adler.
+
+        In case we cannot retrieve a cached origin for a null origin, just create a unique one.
+        This is better than having an origin with an empty host and empty scheme.
+
+        Test: http/tests/security/blob-null-url-location-origin.html
+
+        * fileapi/ThreadableBlobRegistry.cpp:
+        (WebCore::ThreadableBlobRegistry::unregisterBlobURL):
+        (WebCore::ThreadableBlobRegistry::getCachedOrigin):
+
 2019-12-15  Emilio Cobos Álvarez  <emilio@crisal.io>
 

trunk/Source/WebCore/fileapi/ThreadableBlobRegistry.cpp

@@ -90 +90 @@
 }
 
+static inline bool isBlobURLContainsNullOrigin(const URL& url)
+{
+    ASSERT(url.protocolIsBlob());
+    return BlobURL::getOrigin(url) == "null";
+}
+
 void ThreadableBlobRegistry::registerBlobURL(SecurityOrigin* origin, const URL& url, const URL& srcURL)
 {
     // If the blob URL contains null origin, as in the context with unique security origin or file URL, save the mapping between url and origin so that the origin can be retrived when doing security origin check.
-    if (origin && BlobURL::getOrigin(url) == "null")
+    if (origin && isBlobURLContainsNullOrigin(url))
         originMap()->add(url.string(), origin);
 
@@ -146 +152 @@
 void ThreadableBlobRegistry::unregisterBlobURL(const URL& url)
 {
-    if (BlobURL::getOrigin(url) == "null")
+    if (isBlobURLContainsNullOrigin(url))
         originMap()->remove(url.string());
 
@@ -160 +166 @@
 RefPtr<SecurityOrigin> ThreadableBlobRegistry::getCachedOrigin(const URL& url)
 {
-    return originMap()->get(url.string());
+    if (auto cachedOrigin = originMap()->get(url.string()))
+        return cachedOrigin;
+
+    if (!url.protocolIsBlob() || !isBlobURLContainsNullOrigin(url))
+        return nullptr;
+
+    // If we do not have a cached origin for null blob URLs, we use a unique origin.
+    return SecurityOrigin::createUnique();
 }