Changeset 54587 in webkit


Ignore:
Timestamp:
Feb 10, 2010 12:36:58 AM (14 years ago)
Author:
abarth@webkit.org
Message:

2010-02-10 Adam Barth <abarth@webkit.org>

Reviewed by Darin Adler.

Freeze sandbox attributes on creation
https://bugs.webkit.org/show_bug.cgi?id=34184

Test that allow-forms is frozen on document creation.

  • fast/frames/resources/sandboxed-iframe-form-dynamic-allowed.html: Added.
  • fast/frames/resources/sandboxed-iframe-form-dynamic-disallowed.html: Added.
  • fast/frames/sandboxed-iframe-forms-dynamic-expected.txt: Added.
  • fast/frames/sandboxed-iframe-forms-dynamic.html: Added.

2010-02-10 Adam Barth <abarth@webkit.org>

Reviewed by Darin Adler.

Freeze sandbox attributes on creation
https://bugs.webkit.org/show_bug.cgi?id=34184

This is how the spec works now.

Test: fast/frames/sandboxed-iframe-forms-dynamic.html

  • bindings/ScriptControllerBase.cpp: (WebCore::ScriptController::canExecuteScripts):
  • bindings/generic/BindingDOMWindow.h: (WebCore::::createWindow):
  • bindings/js/JSDOMWindowCustom.cpp: (WebCore::createWindow):
  • dom/Document.cpp:
  • dom/Document.h:
  • loader/FrameLoader.cpp: (WebCore::FrameLoader::submitForm): (WebCore::FrameLoader::requestObject): (WebCore::FrameLoader::shouldAllowNavigation): (WebCore::FrameLoader::updateSandboxFlags):
  • page/SecurityOrigin.cpp:
  • page/SecurityOrigin.h:
Location:
trunk
Files:
11 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r54573 r54587  
     12010-02-10  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Freeze sandbox attributes on creation
     6        https://bugs.webkit.org/show_bug.cgi?id=34184
     7
     8        Test that allow-forms is frozen on document creation.
     9
     10        * fast/frames/resources/sandboxed-iframe-form-dynamic-allowed.html: Added.
     11        * fast/frames/resources/sandboxed-iframe-form-dynamic-disallowed.html: Added.
     12        * fast/frames/sandboxed-iframe-forms-dynamic-expected.txt: Added.
     13        * fast/frames/sandboxed-iframe-forms-dynamic.html: Added.
     14
    1152010-02-09  Csaba Osztrogonác  <ossy@webkit.org>
    216
  • trunk/WebCore/ChangeLog

    r54585 r54587  
     12010-02-10  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Freeze sandbox attributes on creation
     6        https://bugs.webkit.org/show_bug.cgi?id=34184
     7
     8        This is how the spec works now.
     9
     10        Test: fast/frames/sandboxed-iframe-forms-dynamic.html
     11
     12        * bindings/ScriptControllerBase.cpp:
     13        (WebCore::ScriptController::canExecuteScripts):
     14        * bindings/generic/BindingDOMWindow.h:
     15        (WebCore::::createWindow):
     16        * bindings/js/JSDOMWindowCustom.cpp:
     17        (WebCore::createWindow):
     18        * dom/Document.cpp:
     19        * dom/Document.h:
     20        * loader/FrameLoader.cpp:
     21        (WebCore::FrameLoader::submitForm):
     22        (WebCore::FrameLoader::requestObject):
     23        (WebCore::FrameLoader::shouldAllowNavigation):
     24        (WebCore::FrameLoader::updateSandboxFlags):
     25        * page/SecurityOrigin.cpp:
     26        * page/SecurityOrigin.h:
     27
    1282010-02-09  Ariya Hidayat  <ariya.hidayat@gmail.com>
    229
  • trunk/WebCore/bindings/ScriptControllerBase.cpp

    r53046 r54587  
    3434bool ScriptController::canExecuteScripts()
    3535{
     36    // FIXME: We should get this information from the document instead of the frame.
    3637    if (m_frame->loader()->isSandboxed(SandboxScripts))
    3738        return false;
  • trunk/WebCore/bindings/generic/BindingDOMWindow.h

    r52810 r54587  
    3636#include "GenericBinding.h"
    3737#include "Page.h"
     38#include "SecurityOrigin.h"
    3839
    3940namespace WebCore {
     
    6970    ASSERT(enteredFrame);
    7071
    71     // Sandboxed iframes cannot open new auxiliary browsing contexts.
    72     if (callingFrame && callingFrame->loader()->isSandboxed(SandboxNavigation))
    73         return 0;
     72    if (Document* callingDocument = callingFrame->document()) {
     73        // Sandboxed iframes cannot open new auxiliary browsing contexts.
     74        if (callingDocument->securityOrigin()->isSandboxed(SandboxNavigation))
     75            return 0;
     76    }
    7477
    7578    ResourceRequest request;
  • trunk/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r54400 r54587  
    667667    ASSERT(dynamicFrame);
    668668
    669     // Sandboxed iframes cannot open new auxiliary browsing contexts.
    670     if (lexicalFrame && lexicalFrame->loader()->isSandboxed(SandboxNavigation))
    671         return 0;
     669    if (Document* lexicalDocument = lexicalFrame->document()) {
     670        // Sandboxed iframes cannot open new auxiliary browsing contexts.
     671        if (lexicalDocument->securityOrigin()->isSandboxed(SandboxNavigation))
     672            return 0;
     673    }
    672674
    673675    ResourceRequest request;
  • trunk/WebCore/dom/Document.cpp

    r54438 r54587  
    44934493}
    44944494
    4495 void Document::updateSandboxFlags()
    4496 {
    4497     if (m_frame && securityOrigin())
    4498         securityOrigin()->setSandboxFlags(m_frame->loader()->sandboxFlags());
    4499 }
    4500 
    45014495void Document::updateFocusAppearanceSoon(bool restorePreviousSelection)
    45024496{
  • trunk/WebCore/dom/Document.h

    r54438 r54587  
    916916    void statePopped(SerializedScriptValue*);
    917917
    918     void updateSandboxFlags(); // Set sandbox flags as determined by the frame.
    919 
    920918    bool processingLoadEvent() const { return m_processingLoadEvent; }
    921919
  • trunk/WebCore/loader/FrameLoader.cpp

    r54329 r54587  
    451451        return;
    452452
    453     if (isSandboxed(SandboxForms))
     453    if (isDocumentSandboxed(SandboxForms))
    454454        return;
    455455
     
    12791279            || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
    12801280            return false;
    1281         if (isSandboxed(SandboxPlugins))
     1281        if (isDocumentSandboxed(SandboxPlugins))
    12821282            return false;
    12831283        return loadPlugin(renderer, completedURL, mimeType, paramNames, paramValues, useFallback);
     
    22422242
    22432243    // A sandboxed frame can only navigate itself and its descendants.
    2244     if (isSandboxed(SandboxNavigation) && !targetFrame->tree()->isDescendantOf(m_frame))
     2244    if (isDocumentSandboxed(SandboxNavigation) && !targetFrame->tree()->isDescendantOf(m_frame))
    22452245        return false;
    22462246
     
    39513951    m_sandboxFlags = flags;
    39523952
    3953     m_frame->document()->updateSandboxFlags();
    3954 
    39553953    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
    39563954        child->loader()->updateSandboxFlags();
     3955}
     3956
     3957bool FrameLoader::isDocumentSandboxed(SandboxFlags mask) const
     3958{
     3959    return m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(mask);
    39573960}
    39583961
  • trunk/WebCore/loader/FrameLoader.h

    r53361 r54587  
    446446
    447447    void updateSandboxFlags();
    448    
     448    // FIXME: isDocumentSandboxed should eventually replace isSandboxed.
     449    bool isDocumentSandboxed(SandboxFlags) const;
     450
    449451    Frame* m_frame;
    450452    FrameLoaderClient* m_client;
  • trunk/WebCore/page/SecurityOrigin.cpp

    r53423 r54587  
    285285{
    286286    m_universalAccess = true;
    287 }
    288 
    289 void SecurityOrigin::setSandboxFlags(SandboxFlags flags)
    290 {
    291     // Although you might think that we should set m_isUnique based on
    292     // SandboxOrigin, that's not actually the right behavior. We're supposed to
    293     // freeze the origin of a document when it is created, even if the sandbox
    294     // flags change after that point in time.
    295     m_sandboxFlags = flags;
    296287}
    297288
  • trunk/WebCore/page/SecurityOrigin.h

    r53423 r54587  
    115115    void grantUniversalAccess();
    116116
    117     void setSandboxFlags(SandboxFlags);
    118117    bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
    119118
Note: See TracChangeset for help on using the changeset viewer.