Changeset 90581 in webkit

Timestamp:

Jul 7, 2011 11:38:18 AM (13 years ago)

Author:

caseq@chromium.org

Message:

2011-07-07 Andrey Kosyakov <​caseq@chromium.org>

Web Inspector: secure access to extensions API
​https://bugs.webkit.org/show_bug.cgi?id=64080

Reviewed by Pavel Feldman.

• inspector/front-end/ExtensionAPI.js: (WebInspector.injectedExtensionAPI.Panels.prototype.create): (WebInspector.injectedExtensionAPI.ExtensionSidebarPaneImpl.prototype.setPage):
• inspector/front-end/ExtensionPanel.js: (WebInspector.ExtensionPanel):
• inspector/front-end/ExtensionServer.js: (WebInspector.ExtensionServer): (WebInspector.ExtensionServer.prototype._onCreatePanel): (WebInspector.ExtensionServer.prototype._onSetSidebarPage): (WebInspector.ExtensionServer.prototype._addExtensions): (WebInspector.ExtensionServer.prototype._onWindowMessage): (WebInspector.ExtensionServer.prototype._registerSubscriptionHandler): (WebInspector.ExtensionServer.prototype._expandResourcePath):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• inspector/front-end/ExtensionAPI.js (modified) (4 diffs)
• inspector/front-end/ExtensionPanel.js (modified) (1 diff)
• inspector/front-end/ExtensionServer.js (modified) (6 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-07  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: secure access to extensions API
+        https://bugs.webkit.org/show_bug.cgi?id=64080
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.Panels.prototype.create):
+        (WebInspector.injectedExtensionAPI.ExtensionSidebarPaneImpl.prototype.setPage):
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionPanel):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer):
+        (WebInspector.ExtensionServer.prototype._onCreatePanel):
+        (WebInspector.ExtensionServer.prototype._onSetSidebarPage):
+        (WebInspector.ExtensionServer.prototype._addExtensions):
+        (WebInspector.ExtensionServer.prototype._onWindowMessage):
+        (WebInspector.ExtensionServer.prototype._registerSubscriptionHandler):
+        (WebInspector.ExtensionServer.prototype._expandResourcePath):
+
 2011-07-07  Kyusun Kim  <maniagoon@company100.net>
 

trunk/Source/WebCore/inspector/front-end/ExtensionAPI.js

@@ -168 +168 @@
 
 Panels.prototype = {
-    create: function(title, iconURL, pageURL, callback)
+    create: function(title, icon, page, callback)
     {
         var id = "extension-panel-" + extensionServer.nextObjectId();
@@ -175 +175 @@
             id: id,
             title: title,
-            icon: expandURL(iconURL),
-            url: expandURL(pageURL)
+            icon: icon,
+            page: page
         };
         extensionServer.sendRequest(request, callback && bind(callback, this, new ExtensionPanel(id)));
@@ -249 +249 @@
     },
 
-    setPage: function(url)
-    {
-        extensionServer.sendRequest({ command: "setSidebarPage", id: this._id, url: expandURL(url) });
+    setPage: function(page)
+    {
+        extensionServer.sendRequest({ command: "setSidebarPage", id: this._id, page: page });
     }
 }
@@ -441 +441 @@
 }
 
-function expandURL(url)
-{
-    if (!url)
-        return url;
-    if (/^[^/]+:/.exec(url)) // See if url has schema.
-        return url;
-    var baseURL = location.protocol + "//" + location.hostname + location.port;
-    if (/^\//.exec(url))
-        return baseURL + url;
-    return baseURL + location.pathname.replace(/\/[^/]*$/,"/") + url;
-}
-
 function bind(func, thisObject)
 {

trunk/Source/WebCore/inspector/front-end/ExtensionPanel.js

@@ -32 +32 @@
 {
     this.toolbarItemLabel = label;
-    this._addStyleRule(".toolbar-item." + id + " .toolbar-icon", "background-image: url(" + iconURL + ");");
+    if (iconURL)
+        this._addStyleRule(".toolbar-item." + id + " .toolbar-icon", "background-image: url(" + iconURL + ");");
     WebInspector.Panel.call(this, id);
 }

trunk/Source/WebCore/inspector/front-end/ExtensionServer.js

@@ -39 +39 @@
     this._resources = {};
     this._lastResourceId = 0;
+    this._allowedOrigins = {};
     this._status = new WebInspector.ExtensionStatus();
 
@@ -204 +205 @@
             return this._status.E_EXISTS(id);
 
-        var panel = new WebInspector.ExtensionPanel(id, message.title, message.icon);
+        var panel = new WebInspector.ExtensionPanel(id, message.title, this._expandResourcePath(port._extensionOrigin, message.icon));
         this._clientObjects[id] = panel;
         WebInspector.panels[id] = panel;
         WebInspector.addPanel(panel);
 
-        var iframe = this.createClientIframe(panel.element, message.url);
+        var iframe = this.createClientIframe(panel.element, this._expandResourcePath(port._extensionOrigin, message.page));
         iframe.addStyleClass("panel");
         return this._status.OK();
@@ -258 +259 @@
     },
 
-    _onSetSidebarPage: function(message)
+    _onSetSidebarPage: function(message, port)
     {
         var sidebar = this._clientObjects[message.id];
         if (!sidebar)
             return this._status.E_NOTFOUND(message.id);
-        sidebar.setPage(message.url);
+        sidebar.setPage(this._expandResourcePath(port._extensionOrigin, message.page));
     },
 
@@ -409 +410 @@
                 if (!extension.startPage)
                     return;
+                var originMatch = /([^:]+:\/\/[^/]*)\//.exec(extension.startPage);
+                if (!originMatch) {
+                    console.error("Skipping extension with invalid URL: " + extension.startPage);
+                    continue;
+                }
+                this._allowedOrigins[originMatch[1]] = true;
                 var iframe = document.createElement("iframe");
                 iframe.src = extension.startPage;
@@ -442 +449 @@
         if (event.data !== "registerExtension")
             return;
+        if (!this._allowedOrigins.hasOwnProperty(event.origin)) {
+            console.error("Ignoring unauthorized client request from " + event.origin);
+            return;
+        }
         var port = event.ports[0];
+        port._extensionOrigin = event.origin;
         port.addEventListener("message", this._onmessage.bind(this), false);
         port.start();
@@ -470 +482 @@
         this._subscriptionStartHandlers[eventTopic] =  onSubscribeFirst;
         this._subscriptionStopHandlers[eventTopic] =  onUnsubscribeLast;
+    },
+
+    _expandResourcePath: function(extensionPath, resourcePath)
+    {
+        if (!resourcePath)
+            return;
+        return extensionPath + escape(this._normalizePath(resourcePath));
+    },
+
+    _normalizePath: function(path)
+    {
+        var source = path.split("/");
+        var result = [];
+
+        for (var i = 0; i < source.length; ++i) {
+            if (source[i] === ".")
+                continue;
+            // Ignore empty path components resulting from //, as well as a leading and traling slashes.
+            if (source[i] === "")
+                continue;
+            if (source[i] === "..")
+                result.pop();
+            else
+                result.push(source[i]);
+        }
+        return "/" + result.join("/");
     }
 }