Changeset 83362 in webkit


Ignore:
Timestamp:
Apr 8, 2011 5:04:50 PM (13 years ago)
Author:
andersca@apple.com
Message:

2011-04-08 Anders Carlsson <​andersca@apple.com>

Reviewed by Dan Bernstein.

Sandboxing doesn't work if a local file is dropped on the content area
​https://bugs.webkit.org/show_bug.cgi?id=58177
<rdar://problem/9019253>

When performing a drag and the dragging pasteboard contains a local file, create a
sandbox extension and pass it along. If we end up loading the file, the sandbox extension
tracker will consume the extension.

  • UIProcess/API/mac/WKView.mm: (maybeCreateSandboxExtensionFromPasteboard): Add helper function.

(-[WKView performDragOperation:]):
Create a sandbox extension handle and pass it to performDrag.

  • UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::dragEntered): (WebKit::WebPageProxy::dragUpdated): (WebKit::WebPageProxy::dragExited): Pass an empty sandbox extension handle to performDragControllerAction.

(WebKit::WebPageProxy::performDrag):
Pass the sandbox extension handle along to performDragControllerAction.

(WebKit::WebPageProxy::performDragControllerAction):
Send along the sandbox extension handle.

  • WebProcess/WebCoreSupport/WebDragClient.cpp: (WebKit::WebDragClient::willPerformDragDestinationAction): If the destination action is a load action, call WebPage::willPerformLoadDragDestinationAction.
  • WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::performDragControllerAction): Create a sandbox extension.

(WebKit::WebPage::willPerformLoadDragDestinationAction):
If we have a sandbox extension, pass it along to the sandbox extension tracker.

(WebKit::WebPage::SandboxExtensionTracker::willPerformLoadDragDestinationAction):
Call setPendingProvisionalSandboxExtension.

(WebKit::WebPage::SandboxExtensionTracker::beginLoad):
Call setPendingProvisionalSandboxExtension.

(WebKit::WebPage::SandboxExtensionTracker::setPendingProvisionalSandboxExtension):
Factor code from beginLoad out into a separate function.

  • WebProcess/WebPage/WebPage.messages.in: PerformDragControllerAction now takes a sandbox extension handle.
Location:
trunk/Source/WebKit2
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit2/ChangeLog

    r83357 r83362  
     12011-04-08  Anders Carlsson  <andersca@apple.com>
     2
     3        Reviewed by Dan Bernstein.
     4
     5        Sandboxing doesn't work if a local file is dropped on the content area
     6        https://bugs.webkit.org/show_bug.cgi?id=58177
     7        <rdar://problem/9019253>
     8
     9        When performing a drag and the dragging pasteboard contains a local file, create a
     10        sandbox extension and pass it along. If we end up loading the file, the sandbox extension
     11        tracker will consume the extension.
     12
     13        * UIProcess/API/mac/WKView.mm:
     14        (maybeCreateSandboxExtensionFromPasteboard):
     15        Add helper function.
     16
     17        (-[WKView performDragOperation:]):
     18        Create a sandbox extension handle and pass it to performDrag.
     19
     20        * UIProcess/WebPageProxy.cpp:
     21        (WebKit::WebPageProxy::dragEntered):
     22        (WebKit::WebPageProxy::dragUpdated):
     23        (WebKit::WebPageProxy::dragExited):
     24        Pass an empty sandbox extension handle to performDragControllerAction.
     25
     26        (WebKit::WebPageProxy::performDrag):
     27        Pass the sandbox extension handle along to performDragControllerAction.
     28
     29        (WebKit::WebPageProxy::performDragControllerAction):
     30        Send along the sandbox extension handle.
     31
     32        * WebProcess/WebCoreSupport/WebDragClient.cpp:
     33        (WebKit::WebDragClient::willPerformDragDestinationAction):
     34        If the destination action is a load action, call WebPage::willPerformLoadDragDestinationAction.
     35
     36        * WebProcess/WebPage/WebPage.cpp:
     37        (WebKit::WebPage::performDragControllerAction):
     38        Create a sandbox extension.
     39
     40        (WebKit::WebPage::willPerformLoadDragDestinationAction):
     41        If we have a sandbox extension, pass it along to the sandbox extension tracker.
     42
     43        (WebKit::WebPage::SandboxExtensionTracker::willPerformLoadDragDestinationAction):
     44        Call setPendingProvisionalSandboxExtension.
     45
     46        (WebKit::WebPage::SandboxExtensionTracker::beginLoad):
     47        Call setPendingProvisionalSandboxExtension.
     48
     49        (WebKit::WebPage::SandboxExtensionTracker::setPendingProvisionalSandboxExtension):
     50        Factor code from beginLoad out into a separate function.
     51
     52        * WebProcess/WebPage/WebPage.messages.in:
     53        PerformDragControllerAction now takes a sandbox extension handle.
     54
    1552011-04-08  Alice Liu  <alice.liu@apple.com>
    256

  • trunk/Source/WebKit2/UIProcess/API/mac/WKView.mm

    r83354 r83362  
    14641464}
    14651465
     1466// FIXME: This code is more or less copied from Pasteboard::getBestURL.
     1467// It would be nice to be able to share the code somehow.
     1468static void maybeCreateSandboxExtensionFromPasteboard(NSPasteboard *pasteboard, SandboxExtension::Handle& sandboxExtensionHandle)
     1469{
     1470    NSArray *types = [pasteboard types];
     1471    if (![types containsObject:NSFilenamesPboardType])
     1472        return;
     1473
     1474    NSArray *files = [pasteboard propertyListForType:NSFilenamesPboardType];
     1475    if ([files count] != 1)
     1476        return;
     1477
     1478    NSString *file = [files objectAtIndex:0];
     1479    BOOL isDirectory;
     1480    if (![[NSFileManager defaultManager] fileExistsAtPath:file isDirectory:&isDirectory])
     1481        return;
     1482
     1483    if (isDirectory)
     1484        return;
     1485
     1486    SandboxExtension::createHandle("/", SandboxExtension::ReadOnly, sandboxExtensionHandle);
     1487}
     1488
    14661489- (BOOL)performDragOperation:(id <NSDraggingInfo>)draggingInfo
    14671490{
    … …  
    14691492    IntPoint global(globalPoint([draggingInfo draggingLocation], [self window]));
    14701493    DragData dragData(draggingInfo, client, global, static_cast<DragOperation>([draggingInfo draggingSourceOperationMask]), [self applicationFlags:draggingInfo]);
    1471     _data->_page->performDrag(&dragData, [[draggingInfo draggingPasteboard] name]);
     1494
     1495    SandboxExtension::Handle sandboxExtensionHandle;
     1496    maybeCreateSandboxExtensionFromPasteboard([draggingInfo draggingPasteboard], sandboxExtensionHandle);
     1497
     1498    _data->_page->performDrag(&dragData, [[draggingInfo draggingPasteboard] name], sandboxExtensionHandle);
     1499
    14721500    return YES;
    14731501}

  • trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp

    r83354 r83362  
    701701void WebPageProxy::dragEntered(WebCore::DragData* dragData, const String& dragStorageName)
    702702{
    703     performDragControllerAction(DragControllerActionEntered, dragData, dragStorageName);
     703    SandboxExtension::Handle sandboxExtensionHandle;
     704    performDragControllerAction(DragControllerActionEntered, dragData, dragStorageName, sandboxExtensionHandle);
    704705}
    705706
    706707void WebPageProxy::dragUpdated(WebCore::DragData* dragData, const String& dragStorageName)
    707708{
    708     performDragControllerAction(DragControllerActionUpdated, dragData, dragStorageName);
     709    SandboxExtension::Handle sandboxExtensionHandle;
     710    performDragControllerAction(DragControllerActionUpdated, dragData, dragStorageName, sandboxExtensionHandle);
    709711}
    710712
    711713void WebPageProxy::dragExited(WebCore::DragData* dragData, const String& dragStorageName)
    712714{
    713     performDragControllerAction(DragControllerActionExited, dragData, dragStorageName);
    714 }
    715 
    716 void WebPageProxy::performDrag(WebCore::DragData* dragData, const String& dragStorageName)
    717 {
    718     performDragControllerAction(DragControllerActionPerformDrag, dragData, dragStorageName);
    719 }
    720 
    721 void WebPageProxy::performDragControllerAction(DragControllerAction action, WebCore::DragData* dragData, const String& dragStorageName)
     715    SandboxExtension::Handle sandboxExtensionHandle;
     716    performDragControllerAction(DragControllerActionExited, dragData, dragStorageName, sandboxExtensionHandle);
     717}
     718
     719void WebPageProxy::performDrag(WebCore::DragData* dragData, const String& dragStorageName, const SandboxExtension::Handle& sandboxExtensionHandle)
     720{
     721    performDragControllerAction(DragControllerActionPerformDrag, dragData, dragStorageName, sandboxExtensionHandle);
     722}
     723
     724void WebPageProxy::performDragControllerAction(DragControllerAction action, WebCore::DragData* dragData, const String& dragStorageName, const SandboxExtension::Handle& sandboxExtensionHandle)
    722725{
    723726    if (!isValid())
    … …  
    728731        dragData->draggingSourceOperationMask(), dragData->dragDataMap(), dragData->flags()), m_pageID);
    729732#else
    730     process()->send(Messages::WebPage::PerformDragControllerAction(action, dragData->clientPosition(), dragData->globalPosition(), dragData->draggingSourceOperationMask(), dragStorageName, dragData->flags()), m_pageID);
     733    process()->send(Messages::WebPage::PerformDragControllerAction(action, dragData->clientPosition(), dragData->globalPosition(), dragData->draggingSourceOperationMask(), dragStorageName, dragData->flags(), sandboxExtensionHandle), m_pageID);
    731734#endif
    732735}

  • trunk/Source/WebKit2/UIProcess/WebPageProxy.h

    r83354 r83362  
    385385    void dragUpdated(WebCore::DragData*, const String& dragStorageName = String());
    386386    void dragExited(WebCore::DragData*, const String& dragStorageName = String());
    387     void performDrag(WebCore::DragData*, const String& dragStorageName = String());
     387    void performDrag(WebCore::DragData*, const String& dragStorageName, const SandboxExtension::Handle&);
    388388
    389389    void didPerformDragControllerAction(uint64_t resultOperation);
    … …  
    697697    void clearLoadDependentCallbacks();
    698698
    699     void performDragControllerAction(DragControllerAction, WebCore::DragData*, const String& dragStorageName);
     699    void performDragControllerAction(DragControllerAction, WebCore::DragData*, const String& dragStorageName, const SandboxExtension::Handle&);
    700700
    701701    PageClient* m_pageClient;

  • trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp

    r79335 r83362  
    2727#include "WebDragClient.h"
    2828
    29 #include <WebCore/NotImplemented.h>
     29#include "WebPage.h"
    3030
    3131using namespace WebCore;
    … …  
    3333namespace WebKit {
    3434
    35 void WebDragClient::willPerformDragDestinationAction(DragDestinationAction, DragData*)
     35void WebDragClient::willPerformDragDestinationAction(DragDestinationAction action, DragData*)
    3636{
     37    if (action == DragDestinationActionLoad)
     38        m_page->willPerformLoadDragDestinationAction();
    3739}
    3840

  • trunk/Source/WebKit2/WebProcess/WebPage/WebPage.cpp

    r83081 r83362  
    14891489}
    14901490#else
    1491 void WebPage::performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const String& dragStorageName, uint32_t flags)
     1491void WebPage::performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const String& dragStorageName, uint32_t flags, const SandboxExtension::Handle& sandboxExtensionHandle)
    14921492{
    14931493    if (!m_page) {
    … …  
    15101510        break;
    15111511       
    1512     case DragControllerActionPerformDrag:
     1512    case DragControllerActionPerformDrag: {
     1513        ASSERT(!m_pendingDropSandboxExtension);
     1514
     1515        m_pendingDropSandboxExtension = SandboxExtension::create(sandboxExtensionHandle);
     1516
    15131517        m_page->dragController()->performDrag(&dragData);
     1518
     1519        // If we started loading a local file, the sandbox extension tracker would have adopted this
     1520        // pending drop sandbox extension. If not, we'll play it safe and invalidate it.
     1521        if (m_pendingDropSandboxExtension) {
     1522            m_pendingDropSandboxExtension->invalidate();
     1523            m_pendingDropSandboxExtension = nullptr;
     1524        }
     1525
    15141526        break;
    1515        
     1527    }
     1528
    15161529    default:
    15171530        ASSERT_NOT_REACHED();
    … …  
    15351548}
    15361549
     1550void WebPage::willPerformLoadDragDestinationAction()
     1551{
     1552    m_sandboxExtensionTracker.willPerformLoadDragDestinationAction(m_pendingDropSandboxExtension.release());
     1553}
     1554
    15371555WebEditCommand* WebPage::webEditCommand(uint64_t commandID)
    15381556{
    … …  
    18621880}
    18631881
     1882void WebPage::SandboxExtensionTracker::willPerformLoadDragDestinationAction(PassRefPtr<SandboxExtension> pendingDropSandboxExtension)
     1883{
     1884    setPendingProvisionalSandboxExtension(pendingDropSandboxExtension);
     1885}
     1886
    18641887void WebPage::SandboxExtensionTracker::beginLoad(WebFrame* frame, const SandboxExtension::Handle& handle)
    18651888{
    18661889    ASSERT(frame->isMainFrame());
    18671890
     1891    setPendingProvisionalSandboxExtension(SandboxExtension::create(handle));
     1892}
     1893
     1894void WebPage::SandboxExtensionTracker::setPendingProvisionalSandboxExtension(PassRefPtr<SandboxExtension> pendingProvisionalSandboxExtension)
     1895{
    18681896    // If we get two beginLoad calls in succession, without a provisional load starting, then
    18691897    // m_pendingProvisionalSandboxExtension will be non-null. Invalidate and null out the extension if that is the case.
    … …  
    18721900        m_pendingProvisionalSandboxExtension = nullptr;
    18731901    }
    1874        
    1875     m_pendingProvisionalSandboxExtension = SandboxExtension::create(handle);
     1902   
     1903    m_pendingProvisionalSandboxExtension = pendingProvisionalSandboxExtension;   
    18761904}
    18771905

  • trunk/Source/WebKit2/WebProcess/WebPage/WebPage.h

    r83204 r83362  
    291291
    292292        void beginLoad(WebFrame*, const SandboxExtension::Handle& handle);
     293        void willPerformLoadDragDestinationAction(PassRefPtr<SandboxExtension> pendingDropSandboxExtension);
    293294        void didStartProvisionalLoad(WebFrame*);
    294295        void didCommitProvisionalLoad(WebFrame*);
    295296        void didFailProvisionalLoad(WebFrame*);
     297
    296298    private:
     299        void setPendingProvisionalSandboxExtension(PassRefPtr<SandboxExtension>);
     300
    297301        RefPtr<SandboxExtension> m_pendingProvisionalSandboxExtension;
    298302        RefPtr<SandboxExtension> m_provisionalSandboxExtension;
    … …  
    349353    void performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const WebCore::DragDataMap&, uint32_t flags);
    350354#else
    351     void performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const WTF::String& dragStorageName, uint32_t flags);
     355    void performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const WTF::String& dragStorageName, uint32_t flags, const SandboxExtension::Handle&);
    352356#endif
    353357    void dragEnded(WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t operation);
     358
     359    void willPerformLoadDragDestinationAction();
    354360
    355361    void beginPrinting(uint64_t frameID, const PrintInfo&);
    … …  
    615621    uint64_t m_pageID;
    616622
     623    RefPtr<SandboxExtension> m_pendingDropSandboxExtension;
     624
    617625    bool m_canRunBeforeUnloadConfirmPanel;
    618626

  • trunk/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in

    r83204 r83362  
    121121#endif
    122122#if !PLATFORM(WIN)
    123     PerformDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, WTF::String dragStorageName, uint32_t flags)
     123    PerformDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, WTF::String dragStorageName, uint32_t flags, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
    124124#endif
    125125    DragEnded(WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t operation)
Note: See TracChangeset for help on using the changeset viewer.