Changeset 79223 in webkit


Ignore:
Timestamp:
Feb 21, 2011 8:01:41 AM (13 years ago)
Author:
antonm@chromium.org
Message:

2011-02-08 Anton Muhin <​antonm@chromium.org>

Reviewed by Adam Barth and Alexey Proskuryakov.

Propagate security origin of parent document into HTML documents created with DOMImplementation
​https://bugs.webkit.org/show_bug.cgi?id=53611

This restores invariant that JS wrappers residing in the same JS context should come
from the same security origin.

Absence of regressions is covered by the current tests. Different security origin of
DOMImplementation is difficult to check with layout tests as DOMImplementation
resides in the same JS context as parent document and therefore there are no security origin checks.
This is observable however in C++.

  • Android.jscbindings.mk:
  • CMakeLists.txt:
  • WebCore.gypi:
  • WebCore.pro:
  • WebCore.vcproj/WebCore.vcproj:
  • WebCore.xcodeproj/project.pbxproj:
  • bindings/v8/V8GCController.cpp: (WebCore::NodeGrouperVisitor::visitDOMWrapper):
  • dom/DOMImplementation.cpp: (WebCore::DOMImplementation::DOMImplementation): (WebCore::DOMImplementation::createDocument):
  • dom/DOMImplementation.h: (WebCore::DOMImplementation::create): (WebCore::DOMImplementation::documentDestroyed): (WebCore::DOMImplementation::parentDocument):
  • dom/DOMImplementation.idl:
  • dom/Document.cpp: (WebCore::Document::~Document): (WebCore::Document::implementation):
  • dom/Document.h:

2011-02-21 Anton Muhin <​antonm@chromium.org>

Reviewed by Adam Barth and Alexey Proskuryakov.

Propagate security origin of parent document into HTML documents created with DOMImplementation
​https://bugs.webkit.org/show_bug.cgi?id=53611

Additional test which checks case when parent document can be collected while
its implementation is alive.

  • fast/dom/gc-9.html:
Location:
trunk
Files:
17 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r79220 r79223  
     12011-02-21  Anton Muhin  <antonm@chromium.org>
     2
     3       Reviewed by Adam Barth and Alexey Proskuryakov.
     4
     5       Propagate security origin of parent document into HTML documents created with DOMImplementation
     6       https://bugs.webkit.org/show_bug.cgi?id=53611
     7
     8       Additional test which checks case when parent document can be collected while
     9       its implementation is alive.
     10
     11       * fast/dom/gc-9.html:
     12
    1132011-02-21  Ryosuke Niwa  <rniwa@webkit.org>
    214

  • trunk/LayoutTests/fast/dom/gc-9.html

    r58526 r79223  
    8484}
    8585
     86function testDOMImplementation()
     87{
     88  var impl = document.implementation.createHTMLDocument('').implementation;
     89  gc();
     90  impl.createHTMLDocument('');  // May crash or throw an exception if we collect parent document of impl.
     91}
     92
    8693function test()
    8794{
    … …  
    98105
    99106    testEvents();
     107    testDOMImplementation();
    100108}
    101109

  • trunk/Source/WebCore/Android.jscbindings.mk

    r78042 r79223  
    8888        bindings/js/JSDOMFormDataCustom.cpp \
    8989        bindings/js/JSDOMGlobalObject.cpp \
     90        bindings/js/JSDOMImplementationCustom.cpp \
    9091        bindings/js/JSDOMSettableTokenList.cpp \
    9192        bindings/js/JSDOMTokenList.cpp \

  • trunk/Source/WebCore/CMakeLists.txt

    r79011 r79223  
    486486    bindings/js/JSDOMFormDataCustom.cpp
    487487    bindings/js/JSDOMGlobalObject.cpp
     488    bindings/js/JSDOMImplementationCustom.cpp
    488489    bindings/js/JSDOMMimeTypeArrayCustom.cpp
    489490    bindings/js/JSDOMPluginArrayCustom.cpp

  • trunk/Source/WebCore/ChangeLog

    r79221 r79223  
     12011-02-08  Anton Muhin  <antonm@chromium.org>
     2
     3       Reviewed by Adam Barth and Alexey Proskuryakov.
     4
     5       Propagate security origin of parent document into HTML documents created with DOMImplementation
     6       https://bugs.webkit.org/show_bug.cgi?id=53611
     7
     8       This restores invariant that JS wrappers residing in the same JS context should come
     9       from the same security origin.
     10
     11       Absence of regressions is covered by the current tests.  Different security origin of
     12       DOMImplementation is difficult to check with layout tests as DOMImplementation
     13       resides in the same JS context as parent document and therefore there are no security origin checks.
     14       This is observable however in C++.
     15
     16       * Android.jscbindings.mk:
     17       * CMakeLists.txt:
     18       * WebCore.gypi:
     19       * WebCore.pro:
     20       * WebCore.vcproj/WebCore.vcproj:
     21       * WebCore.xcodeproj/project.pbxproj:
     22       * bindings/v8/V8GCController.cpp:
     23       (WebCore::NodeGrouperVisitor::visitDOMWrapper):
     24       * dom/DOMImplementation.cpp:
     25       (WebCore::DOMImplementation::DOMImplementation):
     26       (WebCore::DOMImplementation::createDocument):
     27       * dom/DOMImplementation.h:
     28       (WebCore::DOMImplementation::create):
     29       (WebCore::DOMImplementation::documentDestroyed):
     30       (WebCore::DOMImplementation::parentDocument):
     31       * dom/DOMImplementation.idl:
     32       * dom/Document.cpp:
     33       (WebCore::Document::~Document):
     34       (WebCore::Document::implementation):
     35       * dom/Document.h:
     36
    1372011-02-21  Andrey Adaikin  <aandrey@google.com>
    238

  • trunk/Source/WebCore/WebCore.gypi

    r79217 r79223  
    618618            'bindings/js/JSDOMGlobalObject.cpp',
    619619            'bindings/js/JSDOMGlobalObject.h',
     620            'bindings/js/JSDOMImplementationCustom.cpp',
    620621            'bindings/js/JSDOMStringMapCustom.cpp',
    621622            'bindings/js/JSDOMStringMapCustom.h',

  • trunk/Source/WebCore/WebCore.pro

    r79217 r79223  
    13971397        bindings/js/JSDOMBinding.h \
    13981398        bindings/js/JSDOMGlobalObject.h \
     1399        bindings/js/JSDOMImplementationCustom.h \
    13991400        bindings/js/JSDOMStringMapCustom.h \
    14001401        bindings/js/JSDOMWindowBase.h \

  • trunk/Source/WebCore/WebCore.vcproj/WebCore.vcproj

    r79217 r79223  
    5801858018                                </File>
    5801958019                                <File
     58020                                        RelativePath="..\bindings\js\JSDOMImplementationCustom.cpp"
     58021                                        >
     58022                                        <FileConfiguration
     58023                                                Name="Debug|Win32"
     58024                                        ExcludedFromBuild="true"
     58025                                                >
     58026                                                <Tool
     58027                                                        Name="VCCLCompilerTool"
     58028                                                />
     58029                                        </FileConfiguration>
     58030                                        <FileConfiguration
     58031                                                Name="Release|Win32"
     58032                                                ExcludedFromBuild="true"
     58033                                                >
     58034                                                <Tool
     58035                                                        Name="VCCLCompilerTool"
     58036                                                />
     58037                                        </FileConfiguration>
     58038                                        <FileConfiguration
     58039                                                Name="Debug_Cairo_CFLite|Win32"
     58040                                                ExcludedFromBuild="true"
     58041                                                >
     58042                                                <Tool
     58043                                                        Name="VCCLCompilerTool"
     58044                                                />
     58045                                        </FileConfiguration>
     58046                                        <FileConfiguration
     58047                                                Name="Release_Cairo_CFLite|Win32"
     58048                                                ExcludedFromBuild="true"
     58049                                                >
     58050                                                <Tool
     58051                                                        Name="VCCLCompilerTool"
     58052                                                />
     58053                                        </FileConfiguration>
     58054                                        <FileConfiguration
     58055                                                Name="Debug_All|Win32"
     58056                                                ExcludedFromBuild="true"
     58057                                                >
     58058                                                <Tool
     58059                                                        Name="VCCLCompilerTool"
     58060                                                />
     58061                                        </FileConfiguration>
     58062                                        <FileConfiguration
     58063                                                Name="Release_LTCG|Win32"
     58064                                                ExcludedFromBuild="true"
     58065                                                >
     58066                                                <Tool
     58067                                                        Name="VCCLCompilerTool"
     58068                                                />
     58069                                        </FileConfiguration>
     58070                                </File>
     58071                                <File
    5802058072                                        RelativePath="..\bindings\js\JSDOMMimeTypeArrayCustom.cpp"
    5802158073                                        >

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r79217 r79223  
    653653                20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 20D629241253690B00081543 /* InspectorInstrumentation.cpp */; };
    654654                20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
     655                22885E641301AE4C00526E68 /* JSDOMImplementationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */; };
    655656                228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */ = {isa = PBXBuildFile; fileRef = 228C284410D82500009D0D0E /* ScriptWrappable.h */; settings = {ATTRIBUTES = (Private, ); }; };
    656657                24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */; };
    … …  
    70077008                20D629241253690B00081543 /* InspectorInstrumentation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorInstrumentation.cpp; sourceTree = "<group>"; };
    70087009                20D629251253690B00081543 /* InspectorInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentation.h; sourceTree = "<group>"; };
     7010                22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSDOMImplementationCustom.cpp; path = bindings/js/JSDOMImplementationCustom.cpp; sourceTree = "<group>"; };
    70097011                228C284410D82500009D0D0E /* ScriptWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptWrappable.h; sourceTree = "<group>"; };
    70107012                2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
    … …  
    1242212424                        isa = PBXGroup;
    1242312425                        children = (
     12426                                22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */,
    1242412427                                65C97AF208EA908800ACD273 /* config.h */,
    1242512428                                EDEC98020AED7E170059137F /* WebCorePrefix.h */,
    … …  
    2254122544                        buildConfigurationList = 149C284308902B11008A9EFC /* Build configuration list for PBXProject "WebCore" */;
    2254222545                        compatibilityVersion = "Xcode 2.4";
    22543                         developmentRegion = English;
    2254422546                        hasScannedForEncodings = 1;
    2254522547                        knownRegions = (
    … …  
    2516825170                                A1E1154613015C4E0054AC8C /* PointLightSource.cpp in Sources */,
    2516925171                                A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */,
     25172                                22885E641301AE4C00526E68 /* JSDOMImplementationCustom.cpp in Sources */,
    2517025173                                B8DBDB4B130B0F8A00F5CDB1 /* SetSelectionCommand.cpp in Sources */,
    2517125174                                B8DBDB4D130B0F8A00F5CDB1 /* SpellingCorrectionCommand.cpp in Sources */,

  • trunk/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp

    r78407 r79223  
    5757#include "JSDOMFormDataCustom.cpp"
    5858#include "JSDOMGlobalObject.cpp"
     59#include "JSDOMImplementationCustom.cpp"
    5960#include "JSDOMMimeTypeArrayCustom.cpp"
    6061#include "JSDOMPluginArrayCustom.cpp"

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm

    r77650 r79223  
    368368{
    369369END
    370     if ($domMapFunction) {
    371         push(@headerContent, "    if (!forceNewObject) {\n") if IsDOMNodeType($interfaceName);
    372         my $getWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getWrapper(impl)" : "${domMapFunction}.get(impl)";
    373         push(@headerContent, <<END);
     370    push(@headerContent, "    if (!forceNewObject) {\n") if IsDOMNodeType($interfaceName);
     371    my $getWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getWrapper(impl)" : "${domMapFunction}.get(impl)";
     372    push(@headerContent, <<END);
    374373        v8::Handle<v8::Object> wrapper = ${getWrapper};
    375374        if (!wrapper.IsEmpty())
    376375            return wrapper;
    377376END
    378         push(@headerContent, "    }\n") if IsDOMNodeType($interfaceName);
    379     }
     377    push(@headerContent, "    }\n") if IsDOMNodeType($interfaceName);
    380378    push(@headerContent, <<END);
    381379    return ${className}::wrapSlow(impl);
    … …  
    25022500    }
    25032501
    2504     if ($domMapFunction) {
    2505         push(@implContent, <<END);
     2502    push(@implContent, <<END);
    25062503    ${domMapFunction}.set(impl, v8::Persistent<v8::Object>::New(wrapper));
    25072504END
    2508     }
    25092505
    25102506    push(@implContent, <<END);
    … …  
    25502546    return "getDOMSVGElementInstanceMap()" if $type eq "SVGElementInstance";
    25512547    return "getDOMNodeMap()" if ($dataNode && IsNodeSubType($dataNode));
    2552     return "" if $type eq "DOMImplementation";
    25532548    return "getActiveDOMObjectMap()" if IsActiveDomType($type);
    25542549    return "getDOMObjectMap()";

  • trunk/Source/WebCore/bindings/v8/V8GCController.cpp

    r74686 r79223  
    291291            Document* document = reinterpret_cast<Document*>(node);
    292292            addDOMObjectToGroup(store, groupId, document->styleSheets());
     293            addDOMObjectToGroup(store, groupId, document->implementation());
    293294        }
    294295

  • trunk/Source/WebCore/dom/DOMImplementation.cpp

    r65986 r79223  
    172172#endif
    173173
     174DOMImplementation::DOMImplementation(Document* ownerDocument)
     175    : m_ownerDocument(ownerDocument)
     176{
     177    ASSERT(m_ownerDocument);
     178}
     179
    174180bool DOMImplementation::hasFeature(const String& feature, const String& version)
    175181{
    … …  
    241247        doc = Document::create(0, KURL());
    242248
     249    if (!m_ownerDocument) {
     250        ec = INVALID_STATE_ERR;
     251        return 0;
     252    }
     253    doc->setSecurityOrigin(m_ownerDocument->securityOrigin());
     254
    243255    RefPtr<Node> documentElement;
    244256    if (!qualifiedName.isEmpty()) {
    … …  
    301313    d->write("<!doctype html><html><body></body></html>");
    302314    d->setTitle(title);
     315    ASSERT(m_ownerDocument);
     316    if (m_ownerDocument)
     317        d->setSecurityOrigin(m_ownerDocument->securityOrigin());
    303318    return d.release();
    304319}

  • trunk/Source/WebCore/dom/DOMImplementation.h

    r65021 r79223  
    4242class DOMImplementation : public RefCounted<DOMImplementation> {
    4343public:
    44     static PassRefPtr<DOMImplementation> create() { return adoptRef(new DOMImplementation); }
     44    static PassRefPtr<DOMImplementation> create(Document* ownerDocument) { return adoptRef(new DOMImplementation(ownerDocument)); }
    4545
    4646    // DOM methods & attributes for DOMImplementation
    4747    static bool hasFeature(const String& feature, const String& version);
    48     static PassRefPtr<DocumentType> createDocumentType(const String& qualifiedName, const String& publicId, const String &systemId, ExceptionCode&);
    49     static PassRefPtr<Document> createDocument(const String& namespaceURI, const String& qualifiedName, DocumentType*, ExceptionCode&);
     48    PassRefPtr<DocumentType> createDocumentType(const String& qualifiedName, const String& publicId, const String& systemId, ExceptionCode&);
     49    PassRefPtr<Document> createDocument(const String& namespaceURI, const String& qualifiedName, DocumentType*, ExceptionCode&);
    5050
    5151    DOMImplementation* getInterface(const String& feature);
    … …  
    5555
    5656    // From the HTMLDOMImplementation interface
    57     static PassRefPtr<HTMLDocument> createHTMLDocument(const String& title);
     57    PassRefPtr<HTMLDocument> createHTMLDocument(const String& title);
    5858
    5959    // Other methods (not part of DOM)
    … …  
    6363    static bool isTextMIMEType(const String& MIMEType);
    6464
     65    Document* ownerDocument() { return m_ownerDocument; }
     66    void ownerDocumentDestroyed() { m_ownerDocument = 0; }
     67
    6568private:
    66     DOMImplementation() { }
     69    DOMImplementation(Document* ownerDocument);
     70
     71    Document* m_ownerDocument;
    6772};
    6873

  • trunk/Source/WebCore/dom/DOMImplementation.idl

    r52921 r79223  
    2121module core {
    2222
    23     interface DOMImplementation {
     23    interface [
     24        CustomMarkFunction
     25    ] DOMImplementation {
    2426
    2527        // DOM Level 1

  • trunk/Source/WebCore/dom/Document.cpp

    r79208 r79223  
    603603    if (m_mediaQueryMatcher)
    604604        m_mediaQueryMatcher->documentDestroyed();
     605
     606    if (m_implementation)
     607        m_implementation->ownerDocumentDestroyed();
    605608}
    606609
    … …  
    684687}
    685688
    686 DOMImplementation* Document::implementation() const
     689DOMImplementation* Document::implementation()
    687690{
    688691    if (!m_implementation)
    689         m_implementation = DOMImplementation::create();
     692        m_implementation = DOMImplementation::create(this);
    690693    return m_implementation.get();
    691694}

  • trunk/Source/WebCore/dom/Document.h

    r79208 r79223  
    307307    DocumentType* doctype() const { return m_docType.get(); }
    308308
    309     DOMImplementation* implementation() const;
     309    DOMImplementation* implementation();
    310310   
    311311    Element* documentElement() const
Note: See TracChangeset for help on using the changeset viewer.