Changeset 29678 in webkit


Ignore:
Timestamp:
Jan 20, 2008 3:18:32 PM (16 years ago)
Author:
weinig@apple.com
Message:

WebCore:

Reviewed by Sam Weinig.

Fix for ​http://bugs.webkit.org/show_bug.cgi?id=16775

We now use frame()->loader()->url() for postMessage, preventing a
malicious sender from overwriting the uri property (using a <base> tag,
for example). Also, use frame->loader()->url().host() instead of
instead of document()->SecurityOrigin()->domain() to reflect a recent
clarification in the HTML5 spec.

Tests: http/tests/security/postMessage/domain-affected-by-document-domain.html

http/tests/security/postMessage/domain-and-uri-unaffected-by-base-tag.html
http/tests/security/postMessage/javascript-page-still-sends-domain.html

  • bindings/js/JSDOMWindowCustom.cpp: (WebCore::JSDOMWindow::postMessage):

LayoutTests:

Reviewed by Sam Weinig.

Tests for ​http://bugs.webkit.org/show_bug.cgi?id=16775

  • http/tests/security/postMessage: Added.
  • http/tests/security/postMessage/domain-and-uri-unaffected-by-base-tag-expected.txt: Added.
  • http/tests/security/postMessage/domain-and-uri-unaffected-by-base-tag.html: Added.
  • http/tests/security/postMessage/domain-unaffected-by-document-domain-expected.txt: Added.
  • http/tests/security/postMessage/domain-unaffected-by-document-domain.html: Added.
  • http/tests/security/postMessage/javascript-page-still-sends-domain-expected.txt: Added.
  • http/tests/security/postMessage/javascript-page-still-sends-domain.html: Added.
  • http/tests/security/postMessage/resources: Added.
  • http/tests/security/postMessage/resources/javascript-post-message-sender.html: Added.
  • http/tests/security/postMessage/resources/post-message-listener.html: Added.
Location:
trunk
Files:
10 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r29677 r29678  
     12008-01-20  Collin Jackson  <webkit@collinjackson.com>
     2
     3        Reviewed by Sam Weinig.
     4
     5        Tests for http://bugs.webkit.org/show_bug.cgi?id=16775
     6
     7        * http/tests/security/postMessage: Added.
     8        * http/tests/security/postMessage/domain-and-uri-unaffected-by-base-tag-expected.txt: Added.
     9        * http/tests/security/postMessage/domain-and-uri-unaffected-by-base-tag.html: Added.
     10        * http/tests/security/postMessage/domain-unaffected-by-document-domain-expected.txt: Added.
     11        * http/tests/security/postMessage/domain-unaffected-by-document-domain.html: Added.
     12        * http/tests/security/postMessage/javascript-page-still-sends-domain-expected.txt: Added.
     13        * http/tests/security/postMessage/javascript-page-still-sends-domain.html: Added.
     14        * http/tests/security/postMessage/resources: Added.
     15        * http/tests/security/postMessage/resources/javascript-post-message-sender.html: Added.
     16        * http/tests/security/postMessage/resources/post-message-listener.html: Added.
     17
    1182008-01-20  Antti Koivisto  <antti@apple.com>
    219

  • trunk/WebCore/ChangeLog

    r29677 r29678  
     12008-01-20  Collin Jackson  <webkit@collinjackson.com>
     2
     3        Reviewed by Sam Weinig.
     4
     5        Fix for http://bugs.webkit.org/show_bug.cgi?id=16775
     6
     7        We now use frame()->loader()->url() for postMessage, preventing a
     8        malicious sender from overwriting the uri property (using a <base> tag,
     9        for example). Also, use frame->loader()->url().host() instead of
     10        instead of document()->SecurityOrigin()->domain() to reflect a recent
     11        clarification in the HTML5 spec.
     12
     13        Tests: http/tests/security/postMessage/domain-affected-by-document-domain.html
     14               http/tests/security/postMessage/domain-and-uri-unaffected-by-base-tag.html
     15               http/tests/security/postMessage/javascript-page-still-sends-domain.html
     16
     17        * bindings/js/JSDOMWindowCustom.cpp:
     18        (WebCore::JSDOMWindow::postMessage):
     19
    1202008-01-20  Antti Koivisto  <antti@apple.com>
    221

  • trunk/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r29663 r29678  
    2424#include "DOMWindow.h"
    2525#include "ExceptionCode.h"
     26#include "Frame.h"
     27#include "FrameLoader.h"
    2628#include "kjs_window.h"
    2729#include "kjs/object.h"
    … …  
    119121   
    120122    DOMWindow* source = static_cast<JSDOMWindow*>(exec->dynamicGlobalObject())->impl();
    121     String domain = source->document()->securityOrigin()->host();
    122     String uri = source->document()->documentURI();
     123    String domain = source->frame()->loader()->url().host();
     124    String uri = source->frame()->loader()->url().string();
    123125    String message = args[0]->toString(exec);
    124126   
Note: See TracChangeset for help on using the changeset viewer.