Timeline
Oct 11, 2009:
- 11:50 PM Changeset in webkit [49434] by
-
- 5 edits6 adds in trunk
2009-10-11 Daniel Bates <dbates@webkit.org>
Reviewed by Adam Barth.
Fixes an issue where JavaScript URLs that are URL-encoded twice can
bypass the XSSAuditor.
JavaScript URLs that are completed by method Document::completeURL have added
URL-encoded characters such that a direct comparison with the URL-decoded
outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing
HTTP parameters must be URL-decoded before comparison.
Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
- bindings/ScriptControllerBase.cpp: (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor the URL-decoded source code for the JavaScript URL.
- page/XSSAuditor.cpp: (WebCore::isIllegalURICharacter): Minor syntactical change to the comment. (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added parameter decodeURLEscapeSequencesTwice. (WebCore::XSSAuditor::canEvaluateJavaScriptURL): (WebCore::XSSAuditor::decodeURL): Ditto. (WebCore::XSSAuditor::findInRequest): Ditto.
- page/XSSAuditor.h: (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
2009-10-11 Daniel Bates <dbates@webkit.org>
Reviewed by Adam Barth.
Tests that JavaScript URLs that are twice URL encoded do not bypass the XSSAuditor.
- http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode-expected.txt: Added.
- http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html: Added.
- http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2-expected.txt: Added.
- http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html: Added.
- http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3-expected.txt: Added.
- http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html: Added.
- 9:17 PM Changeset in webkit [49433] by
-
- 3 edits2 adds in trunk
WebKit/mac: <rdar://problem/7294267> REGRESSION (r48492): Gmail voice and video chat
doesn't work
https://bugs.webkit.org/show_bug.cgi?id=30295
Reviewed by Darin Adler.
Test: plugins/setProperty.html
- Plugins/Hosted/ProxyInstance.mm:
(WebKit::ProxyInstance::setFieldValue): Fixed a typo. The function
should return early if m_instanceProxy is null.
LayoutTests: Test for <rdar://problem/7294267> REGRESSION (r48492): Gmail voice and
video chat doesn't work
https://bugs.webkit.org/show_bug.cgi?id=30295
Reviewed by Darin Adler.
- plugins/setProperty-expected.txt: Added.
- plugins/setProperty.html: Added.
- 8:30 PM Changeset in webkit [49432] by
-
- 7 edits in trunk/WebCore
2009-10-11 Dominic Cooney <dominicc@google.com>
Reviewed by Adam Barth.
Fixes a build break in the V8 bindings caused by revision 49420.
https://bugs.webkit.org/show_bug.cgi?id=30294
Revision 49420 introduces an IDL-defined CanvasActiveInfo
type. This causes a build break in the V8 bindings where
CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
non-ref type.
- WebCore.gypi: Include CanvasActiveInfo.idl in build.
- bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref ptr type.
- bindings/v8/DOMObjectsInclude.h: Include generated CanvasActiveInfo files.
- bindings/v8/DerivedSourcesAllInOne.cpp:
- bindings/v8/V8Index.cpp:
- bindings/v8/V8Index.h:
- 8:15 PM Changeset in webkit [49431] by
-
- 2 edits in trunk/WebCore
2009-10-11 Collin Jackson <collinj@webkit.org>
Reviewed by Adam Barth.
Log mixed content warnings to console
- loader/FrameLoader.cpp: (WebCore::FrameLoader::checkIfDisplayInsecureContent): (WebCore::FrameLoader::checkIfRunInsecureContent):
- 7:53 PM Changeset in webkit [49430] by
-
- 2 edits in trunk/WebKitTools
2009-10-11 Adam Barth <abarth@webkit.org>
Unreviewed. Add Collin to committers.py.
- Scripts/modules/committers.py:
- 7:36 PM QtBackLog edited by
- (diff)
- 3:48 PM Changeset in webkit [49429] by
-
- 2 edits in trunk/WebCore
2009-10-11 Søren Gjesse <sgjesse@chromium.org>
Reviewed by Adam Barth.
[V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
https://bugs.webkit.org/show_bug.cgi?id=30250
- bindings/v8/V8AbstractEventListener.cpp: (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
- 3:34 PM Changeset in webkit [49428] by
-
- 2 edits in trunk/WebCore
2009-10-11 Lyon Chen <lyon.chen@torchmobile.com>
Reviewed by Alexey Proskuryakov.
Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
This change requires no test case as it fix a compiling error.
- dom/Document.cpp: (WebCore::Document::finishedParsing):
- 3:17 PM Changeset in webkit [49427] by
-
- 3 edits in trunk/WebCore
2009-10-11 Dominic Cooney <dominicc@google.com>
Reviewed by Adam Barth.
Sets a 500K stack limit for JavaScript workers in Chromium.
https://bugs.webkit.org/show_bug.cgi?id=29797
Runaway recursion in JavaScript workers crashes the Chromium
worker process on OS X. This is because V8's default stack limit
is 512K on ia32 or 1M on x64, but the worker process runs workers
on a thread with the OS X default stack size--512K. Because there
are already some C++ frames on the stack when V8 establishes its
512K default stack limit, and V8 doesn't precisely enforce the
stack limit, runaway recursion in V8 workers overflows the OS
stack and segfaults, killing the worker process. This is described
in Chromium bug 21653 <http://crbug.com/21653>.
This patch sets the V8 stack limit for worker JavaScript in
Chromium to a more conservative 500K on all platforms. This allows
some "headroom" for the C++ stack in use when the limit is set up,
and some "legroom" for the V8 helper functions which in practice
briefly flout the V8 stack limit.
Test: LayoutTests/fast/workers/use-machine-stack.html
- bindings/v8/WorkerContextExecutionProxy.cpp: (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
- bindings/v8/WorkerContextExecutionProxy.h:
- 2:30 PM Changeset in webkit [49426] by
-
- 2 edits in trunk/JavaScriptCore
Re-enable the JIT.
- 1:01 PM Changeset in webkit [49425] by
-
- 4 edits in trunk
wx build fixes, adding bindings to include/source dirs and fixing wxMac 2.9 compilation.
- 2:46 AM Changeset in webkit [49424] by
-
- 10 edits3 adds in trunk
Allow [Reflect] on SVG elements.
https://bugs.webkit.org/show_bug.cgi?id=28936
Reviewed by Sam Weinig.
Update the JS binding generators to reference SVGNames instead of
HTMLNames, if [Reflect]ing an attribute on an SVG element. Make
SVGElement::id use [Reflect].
Also make [Reflect] on an attribute with a setter exception work in ObjC
bindings.
WebCore:
Test: svg/dom/id-reflect.html
- bindings/scripts/CodeGenerator.pm: Add a function to determine the
appropriate C++ namespace for attribute name constants.
- bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
code for [Reflect] on an attribute with a setter exception.
- bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
"HTMLNames" when appropriate.
- bindings/scripts/CodeGeneratorJS.pm: Ditto.
- bindings/scripts/CodeGeneratorV8.pm: Ditto.
- svg/SVGElement.cpp: Remove getter and setter methods for id.
- svg/SVGElement.h: Ditto.
- svg/SVGElement.idl: Add [Reflect] to id.
LayoutTests:
- svg/dom/script-tests/id-reflect.js: Added.
- svg/dom/id-reflect-expected.txt: Added.
- svg/dom/id-reflect.html: Added.
Oct 10, 2009:
- 8:47 PM Changeset in webkit [49423] by
-
- 3 edits3 adds in trunk
Support for String.trim(), String.trimLeft() and String.trimRight() methods
https://bugs.webkit.org/show_bug.cgi?id=26590
Reviewed by Maciej Stachowiak.
Implement trim, trimLeft, and trimRight
- 3:10 PM Changeset in webkit [49422] by
-
- 3 edits in trunk/LayoutTests
REGRESSION (r49414): Rebaseline needed for Windows / Gtk Linux
https://bugs.webkit.org/show_bug.cgi?id=30279
Patch by Ryosuke Niwa <rniwa@webkit.org> on 2009-10-10
Reviewed by Eric Seidel.
- platform/gtk/editing/style/5228141-expected.txt: Same rebaseline done for Mac in r49414
- platform/win/editing/execCommand/toggle-compound-styles-expected.txt: two i tags are merged properly
- 2:46 PM Changeset in webkit [49421] by
-
- 2 edits in trunk/WebCore
Fix paths in xcode.
- 2:16 PM Changeset in webkit [49420] by
-
- 10 edits2 copies8 adds in trunk
Implement getActiveAttrib and getActiveUniform
https://bugs.webkit.org/show_bug.cgi?id=30276
Reviewed by Eric Carlson.
Implements the getActiveAttrib and getActiveUniform APIs.
Rather simple patch, adds CanvasActiveInfo definition and implementation
and adds forwarding to the GraphicsContext3D.
Test: fast/canvas/webgl/getActiveTest.html
- 12:21 PM Changeset in webkit [49419] by
-
- 2 edits in trunk/WebCore
2009-10-10 Pavel Feldman <pfeldman@chromium.org>
Reviewed by Timothy Hatcher.
Web Inspector: Adding new attributes in Element Panel is
counterintuitive.
- inspector/front-end/ElementsTreeOutline.js: (WebInspector.ElementsTreeOutline.prototype._onmousemove): (WebInspector.ElementsTreeElement.prototype.set hovered): (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
- 9:19 AM Changeset in webkit [49418] by
-
- 4 edits in trunk/WebCore
2009-10-10 Laszlo Gombos <Laszlo Gombos>
Reviewed by Holger Freyther.
Build fix if Netscape plugin support is turned off
https://bugs.webkit.org/show_bug.cgi?id=30275
In addition to fixing the build break with guards
remove notImplemented() from PluginViewNone.cpp and
make them just just be empty functions.
- plugins/PluginView.cpp: (WebCore::PluginView::handleEvent): (WebCore::PluginView::PluginView):
- plugins/PluginView.h:
- plugins/PluginViewNone.cpp: (WebCore::PluginView::setFocus): (WebCore::PluginView::show): (WebCore::PluginView::hide): (WebCore::PluginView::paint): (WebCore::PluginView::handleKeyboardEvent): (WebCore::PluginView::handleMouseEvent): (WebCore::PluginView::setParent): (WebCore::PluginView::setNPWindowRect): (WebCore::PluginView::handlePostReadFile): (WebCore::PluginView::getValue): (WebCore::PluginView::getValueStatic): (WebCore::PluginView::invalidateRect): (WebCore::PluginView::invalidateRegion): (WebCore::PluginView::forceRedraw): (WebCore::PluginView::platformStart): (WebCore::PluginView::platformDestroy): (WebCore::PluginView::setParentVisible): (WebCore::PluginView::updatePluginWidget):
- 8:56 AM Changeset in webkit [49417] by
-
- 2 edits in trunk/WebCore
2009-10-10 Laszlo Gombos <Laszlo Gombos>
Unreviewed.
Add HistoryController.cpp to the build.
- WebCore.pro:
- 6:53 AM Changeset in webkit [49416] by
-
- 2 edits in trunk/WebCore
2009-10-09 Darin Fisher <darin@chromium.org>
Reviewed by Eric Seidel.
[Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
https://bugs.webkit.org/show_bug.cgi?id=30262
This is not testable from WebKit since WebKit never uses the member
function form of protocolIs with input that can be controlled from a
web page. It always passes string literals lacking hyphens.
- platform/KURLGoogle.cpp: (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would transform the input character.
- 3:04 AM BuildingQtOnWindows edited by
- (diff)
- 2:11 AM Changeset in webkit [49415] by
-
- 8 edits2 adds in trunk/WebCore
2009-10-10 Adam Barth <abarth@webkit.org>
Reviewed by Oliver Hunt.
Move HistoryController to its own file
https://bugs.webkit.org/show_bug.cgi?id=30272
Purely mechanical.
- GNUmakefile.am:
- WebCore.gypi:
- WebCore.vcproj/WebCore.vcproj:
- WebCore.xcodeproj/project.pbxproj:
- WebCoreSources.bkl:
- loader/FrameLoader.cpp:
- loader/FrameLoader.h:
- loader/HistoryController.cpp: Added.
- loader/HistoryController.h: Added.
