Changeset 32791 in webkit


Ignore:
Timestamp:
May 1, 2008 7:08:43 PM (16 years ago)
Author:
weinig@apple.com
Message:

WebCore:

2008-05-01 Sam Weinig <​sam@webkit.org>

Reviewed by Geoffrey Garen.

Fixes:

This patch changes us to perform same-origin checks based on the lexical global object)
rather than dynamic global object, which is now possible we don't re-use the window on
navigations, but rather switch in a new one and re-use the outer shell. This is both
more secure and conforms with the HTML5 specification. Now that all the checks are
done based on the lexical global object, we can remove the SecurityOrigin::Reason
concept, as it was only around to work around an ebay.com bug that required the check to
be done that way.

An important thing to note is that we currently implement a stricter than necessary policy
and perform the same-origin check based on the currently active global object to avoid leaking
the document in cases when the target frame is navigated before access. This will be fixed in
an upcoming patch.

  • bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::allowsAccessFrom): (WebCore::JSDOMWindowBase::allowsAccessFromNoErrorMessage): (WebCore::JSDOMWindowBase::allowsAccessFromPrivate): (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage): (WebCore::JSDOMWindowBase::printErrorMessage): (WebCore::asJSDOMWindow):
  • bindings/js/JSDOMWindowBase.h:
  • html/CanvasRenderingContext2D.cpp: (WebCore::CanvasRenderingContext2D::checkOrigin): (WebCore::CanvasRenderingContext2D::createPattern):
  • loader/FrameLoader.cpp: (WebCore::FrameLoader::begin): (WebCore::FrameLoader::write): (WebCore::FrameLoader::setOpener): (WebCore::FrameLoader::shouldAllowNavigation):
  • page/DOMWindow.h: (WebCore::DOMWindow::setSecurityOrigin): (WebCore::DOMWindow::securityOrigin): (WebCore::DOMWindow::setURL): (WebCore::DOMWindow::url):
  • platform/SecurityOrigin.cpp: (WebCore::SecurityOrigin::canAccess): (WebCore::SecurityOrigin::isSecureTransitionTo):
  • platform/SecurityOrigin.h:

LayoutTests:

2008-05-01 Sam Weinig <​sam@webkit.org>

Reviewed by Geoffrey Garen.

  • http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt:
  • http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt:
  • http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt:
  • http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt:
  • http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt:
  • http/tests/security/listener/xss-window-onclick-shortcut-expected.txt:
  • http/tests/security/xss-eval-expected.txt:
Location:
trunk
Files:
16 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r32785 r32791  
     12008-05-01  Sam Weinig  <sam@webkit.org>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        * http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt:
     6        * http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt:
     7        * http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt:
     8        * http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt:
     9        * http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt:
     10        * http/tests/security/listener/xss-window-onclick-shortcut-expected.txt:
     11        * http/tests/security/xss-eval-expected.txt:
     12
    1132008-05-01  Anders Carlsson  <andersca@apple.com>
    214

  • trunk/LayoutTests/http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt

    r25249 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/childWithButton.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/targetChild-JSTargetNode-onclick-addEventListener.html. Domains, protocols and ports must match.
    22
    33CONSOLE MESSAGE: line 6: Value undefined (result of expression alert) is not object.

  • trunk/LayoutTests/http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt

    r25249 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/childWithButton.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/targetChild-JSTargetNode-onclick-shortcut.html. Domains, protocols and ports must match.
    22
    33CONSOLE MESSAGE: line 6: Value undefined (result of expression alert) is not object.

  • trunk/LayoutTests/http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt

    r25284 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/childWithXMLHttpRequest.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/targetChild-XMLHttpRequest-addEventListener.html. Domains, protocols and ports must match.
    22
    33CONSOLE MESSAGE: line 6: Value undefined (result of expression alert) is not object.

  • trunk/LayoutTests/http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt

    r25284 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/childWithXMLHttpRequest.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/targetChild-XMLHttpRequest-shortcut.html. Domains, protocols and ports must match.
    22
    33CONSOLE MESSAGE: line 6: Value undefined (result of expression alert) is not object.

  • trunk/LayoutTests/http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt

    r25249 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/childWindow.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/targetChild-window-onclick-addEventListener.html. Domains, protocols and ports must match.
    22
    33CONSOLE MESSAGE: line 6: Value undefined (result of expression alert) is not object.

  • trunk/LayoutTests/http/tests/security/listener/xss-window-onclick-shortcut-expected.txt

    r25249 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/childWindow.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe.html from frame with URL http://127.0.0.1:8000/security/listener/resources/targetChild-window-onclick-shortcut.html. Domains, protocols and ports must match.
    22
    33CONSOLE MESSAGE: line 6: Value undefined (result of expression alert) is not object.

  • trunk/LayoutTests/http/tests/security/xss-eval-expected.txt

    r30871 r32791  
    1 CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/xss-eval3.html from frame with URL http://127.0.0.1:8000/security/xss-eval.html. Domains, protocols and ports must match.
     1CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/xss-eval3.html from frame with URL http://127.0.0.1:8000/security/resources/xss-eval2.html. Domains, protocols and ports must match.
    22
    33This page verifies that you can't use eval to subvert cross-domain checks.

  • trunk/WebCore/ChangeLog

    r32790 r32791  
     12008-05-01  Sam Weinig  <sam@webkit.org>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        Fixes:
     6          - https://bugs.webkit.org/show_bug.cgi?id=17249
     7            Incorrect lexical scope after navigation leads to UXSS
     8            <rdar://problem/5738497>
     9
     10          - https://bugs.webkit.org/show_bug.cgi?id=16824
     11            Script authorization should follow lexical (not dynamic) scope
     12            <rdar://problem/5683032>
     13
     14        This patch changes us to perform same-origin checks based on the lexical global object)
     15        rather than dynamic global object, which is now possible we don't re-use the window on
     16        navigations, but rather switch in a new one and re-use the outer shell.  This is both
     17        more secure and conforms with the HTML5 specification.  Now that all the checks are
     18        done based on the lexical global object, we can remove the SecurityOrigin::Reason
     19        concept, as it was only around to work around an ebay.com bug that required the check to
     20        be done that way.
     21
     22        An important thing to note is that we currently implement a stricter than necessary policy
     23        and perform the same-origin check based on the currently active global object to avoid leaking
     24        the document in cases when the target frame is navigated before access.  This will be fixed in
     25        an upcoming patch.
     26
     27        * bindings/js/JSDOMWindowBase.cpp:
     28        (WebCore::JSDOMWindowBase::allowsAccessFrom):
     29        (WebCore::JSDOMWindowBase::allowsAccessFromNoErrorMessage):
     30        (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
     31        (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
     32        (WebCore::JSDOMWindowBase::printErrorMessage):
     33        (WebCore::asJSDOMWindow):
     34        * bindings/js/JSDOMWindowBase.h:
     35        * html/CanvasRenderingContext2D.cpp:
     36        (WebCore::CanvasRenderingContext2D::checkOrigin):
     37        (WebCore::CanvasRenderingContext2D::createPattern):
     38        * loader/FrameLoader.cpp:
     39        (WebCore::FrameLoader::begin):
     40        (WebCore::FrameLoader::write):
     41        (WebCore::FrameLoader::setOpener):
     42        (WebCore::FrameLoader::shouldAllowNavigation):
     43        * page/DOMWindow.h:
     44        (WebCore::DOMWindow::setSecurityOrigin):
     45        (WebCore::DOMWindow::securityOrigin):
     46        (WebCore::DOMWindow::setURL):
     47        (WebCore::DOMWindow::url):
     48        * platform/SecurityOrigin.cpp:
     49        (WebCore::SecurityOrigin::canAccess):
     50        (WebCore::SecurityOrigin::isSecureTransitionTo):
     51        * platform/SecurityOrigin.h:
     52
    1532008-05-01  Anders Carlsson  <andersca@apple.com>
    254

  • trunk/WebCore/bindings/js/JSDOMWindowBase.cpp

    r32786 r32791  
    734734bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
    735735{
    736     SecurityOrigin::Reason reason;
    737     if (allowsAccessFromPrivate(other, reason))
     736    if (allowsAccessFromPrivate(other))
    738737        return true;
    739     printErrorMessage(crossDomainAccessErrorMessage(other, reason));
     738    printErrorMessage(crossDomainAccessErrorMessage(other));
    740739    return false;
    741740}
    … …  
    743742bool JSDOMWindowBase::allowsAccessFrom(ExecState* exec) const
    744743{
    745     SecurityOrigin::Reason reason;
    746     if (allowsAccessFromPrivate(exec, reason))
     744    if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
    747745        return true;
    748     printErrorMessage(crossDomainAccessErrorMessage(exec->dynamicGlobalObject(), reason));
     746    printErrorMessage(crossDomainAccessErrorMessage(exec->lexicalGlobalObject()));
    749747    return false;
    750748}
    … …  
    752750bool JSDOMWindowBase::allowsAccessFromNoErrorMessage(ExecState* exec) const
    753751{
    754     SecurityOrigin::Reason reason;
    755     return allowsAccessFromPrivate(exec, reason);
     752    return allowsAccessFromPrivate(exec->lexicalGlobalObject());
    756753}
    757754
    758755bool JSDOMWindowBase::allowsAccessFrom(ExecState* exec, String& message) const
    759756{
    760     SecurityOrigin::Reason reason;
    761     if (allowsAccessFromPrivate(exec, reason))
     757    if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
    762758        return true;
    763     message = crossDomainAccessErrorMessage(exec->dynamicGlobalObject(), reason);
     759    message = crossDomainAccessErrorMessage(exec->lexicalGlobalObject());
    764760    return false;
    765761}
    766762   
    767 ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const ExecState* exec, SecurityOrigin::Reason& reason) const
    768 {
    769     if (allowsAccessFromPrivate(exec->dynamicGlobalObject(), reason))
     763ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject* other) const
     764{
     765    const JSDOMWindow* originWindow = asJSDOMWindow(other);
     766    const JSDOMWindow* targetWindow = toJSDOMWindow(impl()->frame());
     767
     768    if (originWindow == targetWindow)
    770769        return true;
    771     if (reason == SecurityOrigin::DomainSetInDOMMismatch) {
    772         // If the only reason the access failed was a domainSetInDOM bit mismatch, try again against
    773         // lexical global object <rdar://problem/5698200>
    774         if (allowsAccessFromPrivate(exec->lexicalGlobalObject(), reason))
    775             return true;
    776     }
    777     return false;
    778 }
    779 
    780 ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject* other, SecurityOrigin::Reason& reason) const
    781 {
    782     const Frame* originFrame = static_cast<const JSDOMWindowBase*>(other)->impl()->frame();
    783     if (!originFrame) {
    784         reason = SecurityOrigin::GenericMismatch;
    785         return false;
    786     }
    787 
    788     const Frame* targetFrame = impl()->frame();
    789 
    790     if (originFrame == targetFrame)
    791         return true;
    792    
    793     if (!targetFrame) {
    794         reason = SecurityOrigin::GenericMismatch;
    795         return false;
    796     }
    797 
    798     Document* targetDocument = targetFrame->document();
    799770
    800771    // JS may be attempting to access the "window" object, which should be valid,
    801772    // even if the document hasn't been constructed yet.  If the document doesn't
    802773    // exist yet allow JS to access the window object.
    803     if (!targetDocument)
     774    if (!originWindow->impl()->document())
    804775        return true;
    805776
    806     Document* originDocument = originFrame->document();
    807 
    808     const SecurityOrigin* originSecurityOrigin = originDocument->securityOrigin();
    809     const SecurityOrigin* targetSecurityOrigin = targetDocument->securityOrigin();
    810 
    811     if (originSecurityOrigin->canAccess(targetSecurityOrigin, reason))
    812         return true;
    813 
    814     return false;
    815 }
    816 
    817 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other, SecurityOrigin::Reason) const
    818 {
    819     const Frame* originFrame = static_cast<const JSDOMWindowBase*>(other)->impl()->frame();
    820     const Frame* targetFrame = impl()->frame();
    821     if (!originFrame || !targetFrame)
     777    const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
     778    const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
     779
     780    return originSecurityOrigin->canAccess(targetSecurityOrigin);
     781}
     782
     783String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
     784{
     785    KURL originURL = asJSDOMWindow(other)->impl()->url();
     786    KURL targetURL = impl()->frame()->document()->url();
     787    if (originURL.isNull() || targetURL.isNull())
    822788        return String();
    823     Document* targetDocument = targetFrame->document();
    824     Document* originDocument = originFrame->document();
    825     if (!originDocument || !targetDocument)
    826         return String();
     789
    827790    // FIXME: this error message should contain more specifics of why the same origin check has failed.
    828791    return String::format("Unsafe JavaScript attempt to access frame with URL %s from frame with URL %s. Domains, protocols and ports must match.\n",
    829         targetDocument->url().string().utf8().data(), originDocument->url().string().utf8().data());
     792        targetURL.string().utf8().data(), originURL.string().utf8().data());
    830793}
    831794
    … …  
    845808        printf("%s", message.utf8().data());
    846809
    847     frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
     810    impl()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
    848811}
    849812
    … …  
    14271390}
    14281391
     1392const JSDOMWindow* asJSDOMWindow(const JSGlobalObject* globalObject)
     1393{
     1394    return static_cast<const JSDOMWindow*>(globalObject);
     1395}
     1396
    14291397} // namespace WebCore

  • trunk/WebCore/bindings/js/JSDOMWindowBase.h

    r32786 r32791  
    2222
    2323#include "PlatformString.h"
    24 #include "SecurityOrigin.h"
    2524#include "kjs_binding.h"
    2625#include <kjs/protect.h>
    … …  
    4140    class PausedTimeouts;
    4241    class ScheduledAction;
     42    class SecurityOrigin;
    4343
    4444    class JSDOMWindowBasePrivate;
    … …  
    149149        int installTimeout(ScheduledAction*, int interval, bool singleShot);
    150150
    151         bool allowsAccessFromPrivate(const KJS::JSGlobalObject*, SecurityOrigin::Reason&) const;
    152         bool allowsAccessFromPrivate(const KJS::ExecState*, SecurityOrigin::Reason&) const;
    153         String crossDomainAccessErrorMessage(const KJS::JSGlobalObject*, SecurityOrigin::Reason) const;
     151        bool allowsAccessFromPrivate(const KJS::JSGlobalObject*) const;
     152        String crossDomainAccessErrorMessage(const KJS::JSGlobalObject*) const;
    154153
    155154        RefPtr<DOMWindow> m_impl;
    … …  
    176175
    177176    JSDOMWindow* asJSDOMWindow(KJS::JSGlobalObject*);
     177    const JSDOMWindow* asJSDOMWindow(const KJS::JSGlobalObject*);
    178178
    179179} // namespace WebCore

  • trunk/WebCore/html/CanvasRenderingContext2D.cpp

    r32700 r32791  
    946946{
    947947    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
    948     SecurityOrigin::Reason reason;
    949     if (!m_canvas->document()->securityOrigin()->canAccess(origin.get(), reason))
     948    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
    950949        m_canvas->setOriginTainted();
    951950}
    … …  
    10981097        KURL url(cachedImage->url());
    10991098        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
    1100         SecurityOrigin::Reason reason;
    1101         originClean = m_canvas->document()->securityOrigin()->canAccess(origin.get(), reason);
     1099        originClean = m_canvas->document()->securityOrigin()->canAccess(origin.get());
    11021100    }
    11031101    return new CanvasPattern(image->cachedImage(), repeatX, repeatY, originClean);

  • trunk/WebCore/loader/FrameLoader.cpp

    r32666 r32791  
    938938        document->setSecurityOrigin(forcedSecurityOrigin.get());
    939939
     940    m_frame->domWindow()->setURL(document->url());
     941    m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
     942
    940943    updatePolicyBaseURL();
    941944
    … …  
    989992        if (m_encoding.isEmpty()) {
    990993            Frame* parentFrame = m_frame->tree()->parent();
    991             SecurityOrigin::Reason reason;
    992             if (parentFrame && parentFrame->document()->securityOrigin()->canAccess(m_frame->document()->securityOrigin(), reason))
     994            if (parentFrame && parentFrame->document()->securityOrigin()->canAccess(m_frame->document()->securityOrigin()))
    993995                m_decoder->setEncoding(parentFrame->document()->inputEncoding(), TextResourceDecoder::DefaultEncoding);
    994996        } else {
    … …  
    17731775    m_opener = opener;
    17741776
    1775     if (m_frame->document())
     1777    if (m_frame->document()) {
    17761778        m_frame->document()->initSecurityOrigin();
     1779        m_frame->domWindow()->setSecurityOrigin(m_frame->document()->securityOrigin());
     1780    }
    17771781}
    17781782
    … …  
    24452449            return true;
    24462450
    2447         SecurityOrigin::Reason reason;
    24482451        const SecurityOrigin* ancestorSecurityOrigin = ancestorDocument->securityOrigin();
    2449         if (activeSecurityOrigin->canAccess(ancestorSecurityOrigin, reason))
     2452        if (activeSecurityOrigin->canAccess(ancestorSecurityOrigin))
    24502453            return true;
    24512454    }

  • trunk/WebCore/page/DOMWindow.h

    r32597 r32791  
    2727#define DOMWindow_h
    2828
     29#include "KURL.h"
    2930#include "PlatformString.h"
     31#include "SecurityOrigin.h"
     32#include <wtf/Forward.h>
    3033#include <wtf/RefCounted.h>
    31 #include <wtf/Forward.h>
    3234#include <wtf/RefPtr.h>
    3335
    … …  
    6870
    6971        void clear();
     72
     73        void setSecurityOrigin(SecurityOrigin* securityOrigin) { m_securityOrigin = securityOrigin; }
     74        SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
     75
     76        void setURL(const KURL& url) { m_url = url; }
     77        KURL url() const { return m_url; }
    7078
    7179        static void adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges);
    … …  
    200208        DOMApplicationCache* optionalApplicationCache() const { return m_applicationCache.get(); }
    201209#endif
    202        
     210
    203211    private:
    204212        DOMWindow(Frame*);
    205        
     213
     214        RefPtr<SecurityOrigin> m_securityOrigin;
     215        KURL m_url;
     216
    206217        Frame* m_frame;
    207218        mutable RefPtr<Screen> m_screen;

  • trunk/WebCore/platform/SecurityOrigin.cpp

    r32597 r32791  
    136136}
    137137
    138 bool SecurityOrigin::canAccess(const SecurityOrigin* other, Reason& reason) const
     138bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
    139139{ 
    140140    if (FrameLoader::shouldTreatSchemeAsLocal(m_protocol))
    141141        return true;
    142142
    143     if (m_noAccess || other->m_noAccess) {
    144         reason = SecurityOrigin::GenericMismatch;
    145         return false;
    146     }
     143    if (m_noAccess || other->m_noAccess)
     144        return false;
    147145
    148146    // Here are three cases where we should permit access:
    … …  
    179177                return true;
    180178        } else {
    181             if (m_host == other->m_host && m_port == other->m_port) {
    182                 reason = DomainSetInDOMMismatch;
     179            if (m_host == other->m_host && m_port == other->m_port)
    183180                return false;
    184             }
    185181        }
    186182    }
    187183   
    188     reason = SecurityOrigin::GenericMismatch;
    189184    return false;
    190185}
    … …  
    197192
    198193    RefPtr<SecurityOrigin> other = SecurityOrigin::create(url);
    199     Reason reason;
    200     return canAccess(other.get(), reason);
     194    return canAccess(other.get());
    201195}
    202196

  • trunk/WebCore/platform/SecurityOrigin.h

    r32597 r32791  
    5555        String domain() const { return m_domain; }
    5656        unsigned short port() const { return m_port; }
    57        
    58         enum Reason  {
    59             GenericMismatch,
    60             DomainSetInDOMMismatch
    61         };
    62         bool canAccess(const SecurityOrigin*, Reason&) const;
     57
     58        bool canAccess(const SecurityOrigin*) const;
    6359        bool isSecureTransitionTo(const KURL&) const;
    6460
Note: See TracChangeset for help on using the changeset viewer.