Changeset 92142 in webkit


Ignore:
Timestamp:
Aug 1, 2011 2:18:49 PM (13 years ago)
Author:
jochen@chromium.org
Message:

Source/WebCore: Never override the policy URL on form submissions.
​https://bugs.webkit.org/show_bug.cgi?id=61809

Reviewed by Adam Barth.

Tests: http/tests/security/cookies/third-party-cookie-blocking-main-frame.html

http/tests/security/cookies/third-party-cookie-blocking-user-action.html
http/tests/security/cookies/third-party-cookie-blocking.html

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadURL):
(WebCore::FrameLoader::addExtraFieldsToSubresourceRequest):
(WebCore::FrameLoader::addExtraFieldsToMainResourceRequest):
(WebCore::FrameLoader::addExtraFieldsToRequest):
(WebCore::FrameLoader::loadPostRequest):
(WebCore::FrameLoader::loadDifferentDocumentItem):

  • loader/FrameLoader.h:

LayoutTests: Require explicit user action to override the policy URL on form submissions.
​https://bugs.webkit.org/show_bug.cgi?id=61809

Reviewed by Adam Barth.

  • http/tests/loading/redirect-methods-expected.txt:
  • http/tests/security/cookies/resources/set-a-cookie.php: Added.
  • http/tests/security/cookies/third-party-cookie-blocking-expected.txt: Added.
  • http/tests/security/cookies/third-party-cookie-blocking-main-frame-expected.txt: Added.
  • http/tests/security/cookies/third-party-cookie-blocking-main-frame.html: Added.
  • http/tests/security/cookies/third-party-cookie-blocking-user-action-expected.txt: Added.
  • http/tests/security/cookies/third-party-cookie-blocking-user-action.html: Added.
  • http/tests/security/cookies/third-party-cookie-blocking.html: Added.
Location:
trunk
Files:
7 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r92141 r92142  
     12011-08-01  Jochen Eisinger  <jochen@chromium.org>
     2
     3        Require explicit user action to override the policy URL on form submissions.
     4        https://bugs.webkit.org/show_bug.cgi?id=61809
     5
     6        Reviewed by Adam Barth.
     7
     8        * http/tests/loading/redirect-methods-expected.txt:
     9        * http/tests/security/cookies/resources/set-a-cookie.php: Added.
     10        * http/tests/security/cookies/third-party-cookie-blocking-expected.txt: Added.
     11        * http/tests/security/cookies/third-party-cookie-blocking-main-frame-expected.txt: Added.
     12        * http/tests/security/cookies/third-party-cookie-blocking-main-frame.html: Added.
     13        * http/tests/security/cookies/third-party-cookie-blocking-user-action-expected.txt: Added.
     14        * http/tests/security/cookies/third-party-cookie-blocking-user-action.html: Added.
     15        * http/tests/security/cookies/third-party-cookie-blocking.html: Added.
     16
    1172011-08-01  Anna Cavender  <annacc@chromium.org>
    218

  • trunk/LayoutTests/http/tests/loading/redirect-methods-expected.txt

    r65340 r92142  
    2525http://127.0.0.1:8000/loading/resources/redirect-methods-form.html - didFinishLoading
    2626frame "0" - didStartProvisionalLoadForFrame
    27 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method POST> redirectResponse (null)
    28 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method GET> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 301>
     27http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method POST> redirectResponse (null)
     28http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method GET> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 301>
    2929frame "0" - didReceiveServerRedirectForProvisionalLoadForFrame
    3030http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - didReceiveResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, http status code 200>
    … …  
    5555http://127.0.0.1:8000/loading/resources/redirect-methods-form.html - didFinishLoading
    5656frame "1" - didStartProvisionalLoadForFrame
    57 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method POST> redirectResponse (null)
    58 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method GET> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 302>
     57http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method POST> redirectResponse (null)
     58http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method GET> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 302>
    5959frame "1" - didReceiveServerRedirectForProvisionalLoadForFrame
    6060http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - didReceiveResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, http status code 200>
    … …  
    8585http://127.0.0.1:8000/loading/resources/redirect-methods-form.html - didFinishLoading
    8686frame "2" - didStartProvisionalLoadForFrame
    87 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method POST> redirectResponse (null)
    88 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method GET> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 303>
     87http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method POST> redirectResponse (null)
     88http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method GET> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 303>
    8989frame "2" - didReceiveServerRedirectForProvisionalLoadForFrame
    9090http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - didReceiveResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, http status code 200>
    … …  
    115115http://127.0.0.1:8000/loading/resources/redirect-methods-form.html - didFinishLoading
    116116frame "3" - didStartProvisionalLoadForFrame
    117 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method POST> redirectResponse (null)
    118 http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http method POST> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 307>
     117http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method POST> redirectResponse (null)
     118http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, main document URL http://127.0.0.1:8000/loading/redirect-methods.html, http method POST> redirectResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php, http status code 307>
    119119frame "3" - didReceiveServerRedirectForProvisionalLoadForFrame
    120120http://127.0.0.1:8000/loading/resources/redirect-methods-result.php - didReceiveResponse <NSURLResponse http://127.0.0.1:8000/loading/resources/redirect-methods-result.php?redirected=true, http status code 200>

  • trunk/Source/WebCore/ChangeLog

    r92140 r92142  
     12011-08-01  Jochen Eisinger  <jochen@chromium.org>
     2
     3        Never override the policy URL on form submissions.
     4        https://bugs.webkit.org/show_bug.cgi?id=61809
     5
     6        Reviewed by Adam Barth.
     7
     8        Tests: http/tests/security/cookies/third-party-cookie-blocking-main-frame.html
     9               http/tests/security/cookies/third-party-cookie-blocking-user-action.html
     10               http/tests/security/cookies/third-party-cookie-blocking.html
     11
     12        * loader/FrameLoader.cpp:
     13        (WebCore::FrameLoader::loadURL):
     14        (WebCore::FrameLoader::addExtraFieldsToSubresourceRequest):
     15        (WebCore::FrameLoader::addExtraFieldsToMainResourceRequest):
     16        (WebCore::FrameLoader::addExtraFieldsToRequest):
     17        (WebCore::FrameLoader::loadPostRequest):
     18        (WebCore::FrameLoader::loadDifferentDocumentItem):
     19        * loader/FrameLoader.h:
     20
     21
    1222011-08-01  Ryosuke Niwa  <rniwa@webkit.org>
    223

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r91583 r92142  
    11761176        addHTTPOriginIfNeeded(request, referrerOrigin->toString());
    11771177    }
    1178     addExtraFieldsToRequest(request, newLoadType, true, event || isFormSubmission);
     1178    addExtraFieldsToRequest(request, newLoadType, true);
    11791179    if (newLoadType == FrameLoadTypeReload || newLoadType == FrameLoadTypeReloadFromOrigin)
    11801180        request.setCachePolicy(ReloadIgnoringCacheData);
    … …  
    24382438void FrameLoader::addExtraFieldsToSubresourceRequest(ResourceRequest& request)
    24392439{
    2440     addExtraFieldsToRequest(request, m_loadType, false, false);
     2440    addExtraFieldsToRequest(request, m_loadType, false);
    24412441}
    24422442
    24432443void FrameLoader::addExtraFieldsToMainResourceRequest(ResourceRequest& request)
    24442444{
    2445     addExtraFieldsToRequest(request, m_loadType, true, false);
    2446 }
    2447 
    2448 void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadType loadType, bool mainResource, bool cookiePolicyURLFromRequest)
     2445    addExtraFieldsToRequest(request, m_loadType, true);
     2446}
     2447
     2448void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadType loadType, bool mainResource)
    24492449{
    24502450    // Don't set the cookie policy URL if it's already been set.
    24512451    // But make sure to set it on all requests, as it has significance beyond the cookie policy for all protocols (<rdar://problem/6616664>).
    24522452    if (request.firstPartyForCookies().isEmpty()) {
    2453         if (mainResource && (isLoadingMainFrame() || cookiePolicyURLFromRequest))
     2453        if (mainResource && isLoadingMainFrame())
    24542454            request.setFirstPartyForCookies(request.url());
    24552455        else if (Document* document = m_frame->document())
    … …  
    25512551    workingResourceRequest.setHTTPBody(formData);
    25522552    workingResourceRequest.setHTTPContentType(contentType);
    2553     addExtraFieldsToRequest(workingResourceRequest, loadType, true, true);
     2553    addExtraFieldsToRequest(workingResourceRequest, loadType, true);
    25542554
    25552555    NavigationAction action(url, loadType, true, event);
    … …  
    30253025        // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
    30263026        // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
    3027         addExtraFieldsToRequest(request, m_loadType, true, formData);
     3027        addExtraFieldsToRequest(request, m_loadType, true);
    30283028        addedExtraFields = true;
    30293029       
    … …  
    30683068   
    30693069    if (!addedExtraFields)
    3070         addExtraFieldsToRequest(request, m_loadType, true, formData);
     3070        addExtraFieldsToRequest(request, m_loadType, true);
    30713071
    30723072    loadWithNavigationAction(request, action, false, loadType, 0);

  • trunk/Source/WebCore/loader/FrameLoader.h

    r91006 r92142  
    302302    void setFirstPartyForCookies(const KURL&);
    303303   
    304     void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
     304    void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType, bool isMainResource);
    305305
    306306    void clearProvisionalLoad();
Note: See TracChangeset for help on using the changeset viewer.