Title: [88071] trunk
- Revision
- 88071
- Author
- [email protected]
- Date
- 2011-06-03 15:42:58 -0700 (Fri, 03 Jun 2011)
Log Message
2011-06-03 Adam Barth <[email protected]>
Reviewed by Eric Seidel.
DOMWindow::setLocation doesn't understand that DOMWindow can be inactive
https://bugs.webkit.org/show_bug.cgi?id=62057
Test that some esoteric combination of eval, load, and Location don't
do something goofy.
* http/tests/security/xss-DENIED-contentWindow-eval-expected.txt: Added.
* http/tests/security/xss-DENIED-contentWindow-eval.html: Added.
2011-06-03 Adam Barth <[email protected]>
Reviewed by Eric Seidel.
DOMWindow::setLocation doesn't understand that DOMWindow can be inactive
https://bugs.webkit.org/show_bug.cgi?id=62057
This code gets confused when dealing with inactive DOMWindows. We
should just block inactive DOMWindows because there's no compatibility
reason to support them in this code path.
Test: http/tests/security/xss-DENIED-contentWindow-eval.html
* page/DOMWindow.cpp:
(WebCore::DOMWindow::isInsecureScriptAccess):
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (88070 => 88071)
--- trunk/LayoutTests/ChangeLog 2011-06-03 22:34:21 UTC (rev 88070)
+++ trunk/LayoutTests/ChangeLog 2011-06-03 22:42:58 UTC (rev 88071)
@@ -1,3 +1,16 @@
+2011-06-03 Adam Barth <[email protected]>
+
+ Reviewed by Eric Seidel.
+
+ DOMWindow::setLocation doesn't understand that DOMWindow can be inactive
+ https://bugs.webkit.org/show_bug.cgi?id=62057
+
+ Test that some esoteric combination of eval, load, and Location don't
+ do something goofy.
+
+ * http/tests/security/xss-DENIED-contentWindow-eval-expected.txt: Added.
+ * http/tests/security/xss-DENIED-contentWindow-eval.html: Added.
+
2011-06-03 James Simonsen <[email protected]>
[Chromium] Unreviewed, baseline for full-screen-placeholder. More flakiness for svg/zoom and navigator.
Added: trunk/LayoutTests/http/tests/security/xss-DENIED-contentWindow-eval-expected.txt (0 => 88071)
--- trunk/LayoutTests/http/tests/security/xss-DENIED-contentWindow-eval-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-contentWindow-eval-expected.txt 2011-06-03 22:42:58 UTC (rev 88071)
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: line 1: Unsafe _javascript_ attempt to access frame with URL about:blank from frame with URL about:blank. Domains, protocols and ports must match.
+
+This test passes if alert() is not called.
Added: trunk/LayoutTests/http/tests/security/xss-DENIED-contentWindow-eval.html (0 => 88071)
--- trunk/LayoutTests/http/tests/security/xss-DENIED-contentWindow-eval.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-contentWindow-eval.html 2011-06-03 22:42:58 UTC (rev 88071)
@@ -0,0 +1,17 @@
+<body>
+This test passes if alert() is not called.
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+i = document.body.appendChild(document.createElement("iframe"));
+f = frames[0].eval('(function(){location="_javascript_:alert(location)"})');
+i.src = ""
+i.addEventListener("load", f);
+i.addEventListener("load", function() {
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+});
+</script>
Modified: trunk/Source/WebCore/ChangeLog (88070 => 88071)
--- trunk/Source/WebCore/ChangeLog 2011-06-03 22:34:21 UTC (rev 88070)
+++ trunk/Source/WebCore/ChangeLog 2011-06-03 22:42:58 UTC (rev 88071)
@@ -1,3 +1,19 @@
+2011-06-03 Adam Barth <[email protected]>
+
+ Reviewed by Eric Seidel.
+
+ DOMWindow::setLocation doesn't understand that DOMWindow can be inactive
+ https://bugs.webkit.org/show_bug.cgi?id=62057
+
+ This code gets confused when dealing with inactive DOMWindows. We
+ should just block inactive DOMWindows because there's no compatibility
+ reason to support them in this code path.
+
+ Test: http/tests/security/xss-DENIED-contentWindow-eval.html
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::isInsecureScriptAccess):
+
2011-05-31 Martin Robinson <[email protected]>
Reviewed by Ryosuke Niwa.
Modified: trunk/Source/WebCore/page/DOMWindow.cpp (88070 => 88071)
--- trunk/Source/WebCore/page/DOMWindow.cpp 2011-06-03 22:34:21 UTC (rev 88070)
+++ trunk/Source/WebCore/page/DOMWindow.cpp 2011-06-03 22:42:58 UTC (rev 88071)
@@ -1713,14 +1713,21 @@
if (!protocolIsJavaScript(urlString))
return false;
- // FIXME: Is there some way to eliminate the need for a separate "activeWindow == this" check?
- if (activeWindow == this)
- return false;
+ // If m_frame->domWindow() != this, then |this| isn't the DOMWindow that's
+ // currently active in the frame and there's no way we should allow the
+ // access.
+ // FIXME: Remove this check if we're able to disconnect DOMWindow from
+ // Frame on navigation: https://bugs.webkit.org/show_bug.cgi?id=62054
+ if (m_frame->domWindow() == this) {
+ // FIXME: Is there some way to eliminate the need for a separate "activeWindow == this" check?
+ if (activeWindow == this)
+ return false;
- // FIXME: The name canAccess seems to be a roundabout way to ask "can execute script".
- // Can we name the SecurityOrigin function better to make this more clear?
- if (activeWindow->securityOrigin()->canAccess(securityOrigin()))
- return false;
+ // FIXME: The name canAccess seems to be a roundabout way to ask "can execute script".
+ // Can we name the SecurityOrigin function better to make this more clear?
+ if (activeWindow->securityOrigin()->canAccess(securityOrigin()))
+ return false;
+ }
printErrorMessage(crossDomainAccessErrorMessage(activeWindow));
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
