Diff
Modified: trunk/LayoutTests/ChangeLog (205357 => 205358)
--- trunk/LayoutTests/ChangeLog 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/LayoutTests/ChangeLog 2016-09-02 19:00:22 UTC (rev 205358)
@@ -1,5 +1,21 @@
2016-09-02 Chris Dumez <[email protected]>
+ Object.defineProperty() should throw cross-origin
+ https://bugs.webkit.org/show_bug.cgi?id=161460
+
+ Reviewed by Geoffrey Garen.
+
+ Add test coverage.
+
+ * http/tests/security/cross-frame-access-object-prototype-expected.txt:
+ * http/tests/security/location-cross-origin-expected.txt:
+ * http/tests/security/location-cross-origin.html:
+ * http/tests/security/window-defineProperty-crossOrigin-expected.txt: Added.
+ * http/tests/security/window-defineProperty-crossOrigin.html: Added.
+ * http/tests/security/xss-DENIED-defineProperty-expected.txt:
+
+2016-09-02 Chris Dumez <[email protected]>
+
Align proto getter / setter behavior with other browsers
https://bugs.webkit.org/show_bug.cgi?id=161455
Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-object-prototype-expected.txt (205357 => 205358)
--- trunk/LayoutTests/http/tests/security/cross-frame-access-object-prototype-expected.txt 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/LayoutTests/http/tests/security/cross-frame-access-object-prototype-expected.txt 2016-09-02 19:00:22 UTC (rev 205358)
@@ -1,6 +1,6 @@
-CONSOLE MESSAGE: line 39: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 40: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
----- test getting values cross-frame using Object.prototype -----
Modified: trunk/LayoutTests/http/tests/security/location-cross-origin-expected.txt (205357 => 205358)
--- trunk/LayoutTests/http/tests/security/location-cross-origin-expected.txt 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/LayoutTests/http/tests/security/location-cross-origin-expected.txt 2016-09-02 19:00:22 UTC (rev 205358)
@@ -47,6 +47,7 @@
PASS Object.getOwnPropertyDescriptor(window.location, 'pathname').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
PASS Object.getOwnPropertyDescriptor(window.location, 'search').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
PASS Object.getOwnPropertyDescriptor(window.location, 'hash').set.call(frames[0].location, 1) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
+PASS Object.defineProperty(frames[0].location, 'foo', { value: 1 }) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
PASS frames[0].location.href = '' did not throw exception.
PASS frames[0].location.href is "about:blank"
PASS successfullyParsed is true
Modified: trunk/LayoutTests/http/tests/security/location-cross-origin.html (205357 => 205358)
--- trunk/LayoutTests/http/tests/security/location-cross-origin.html 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/LayoutTests/http/tests/security/location-cross-origin.html 2016-09-02 19:00:22 UTC (rev 205358)
@@ -56,6 +56,8 @@
shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'search').set.call(frames[0].location, 1)", "SecurityError");
shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hash').set.call(frames[0].location, 1)", "SecurityError");
+ shouldThrowErrorName("Object.defineProperty(frames[0].location, 'foo', { value: 1 })", "SecurityError");
+
// Setting 'href' cross origin should be allowed.
shouldNotThrow("frames[0].location.href = ''");
setTimeout(function() {
Added: trunk/LayoutTests/http/tests/security/window-defineProperty-crossOrigin-expected.txt (0 => 205358)
--- trunk/LayoutTests/http/tests/security/window-defineProperty-crossOrigin-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/window-defineProperty-crossOrigin-expected.txt 2016-09-02 19:00:22 UTC (rev 205358)
@@ -0,0 +1,10 @@
+Test that calling Object.defineProperty() on a cross-origin Window throws.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS Object.defineProperty(frames[0], 'foo', { value: 1 }) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match..
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/http/tests/security/window-defineProperty-crossOrigin.html (0 => 205358)
--- trunk/LayoutTests/http/tests/security/window-defineProperty-crossOrigin.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/window-defineProperty-crossOrigin.html 2016-09-02 19:00:22 UTC (rev 205358)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<iframe src=""
+<script>
+description("Test that calling Object.defineProperty() on a cross-origin Window throws.");
+jsTestIsAsync = true;
+
+_onload_ = function() {
+ shouldThrowErrorName("Object.defineProperty(frames[0], 'foo', { value: 1 })", "SecurityError");
+ finishJSTest();
+};
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt (205357 => 205358)
--- trunk/LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt 2016-09-02 19:00:22 UTC (rev 205358)
@@ -1,21 +1,3 @@
-CONSOLE MESSAGE: line 20: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 20: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 20: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 20: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 20: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 20: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 24: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 24: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 24: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 24: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 24: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
-CONSOLE MESSAGE: line 24: Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
PASS: cross-site assignment of Object constructor not allowed
PASS: cross-site assignment of new property not allowed
@@ -76,4 +58,22 @@
SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
+SecurityError (DOM Exception 18): Blocked a frame with origin "http://localhost:8000" from accessing a frame with origin "http://127.0.0.1:8000". Protocols, domains, and ports must match.
Modified: trunk/Source/WebCore/ChangeLog (205357 => 205358)
--- trunk/Source/WebCore/ChangeLog 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/Source/WebCore/ChangeLog 2016-09-02 19:00:22 UTC (rev 205358)
@@ -1,3 +1,23 @@
+2016-09-02 Chris Dumez <[email protected]>
+
+ Object.defineProperty() should throw cross-origin
+ https://bugs.webkit.org/show_bug.cgi?id=161460
+
+ Reviewed by Geoffrey Garen.
+
+ Object.defineProperty() should throw cross-origin to match Firefox and
+ Chrome.
+
+ The specification is in the process of being updated to match the
+ behavior of browsers.
+
+ Test: http/tests/security/window-defineProperty-crossOrigin.html
+
+ * bindings/js/JSDOMWindowCustom.cpp:
+ (WebCore::JSDOMWindow::defineOwnProperty):
+ * bindings/js/JSLocationCustom.cpp:
+ (WebCore::JSLocation::defineOwnProperty):
+
2016-09-02 Brady Eidson <[email protected]>
Weak link the GameController.framework on macOS but differently than before.
Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (205357 => 205358)
--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2016-09-02 19:00:22 UTC (rev 205358)
@@ -332,7 +332,7 @@
{
JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(object);
// Only allow defining properties in this way by frames in the same origin, as it allows setters to be introduced.
- if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped()))
+ if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), ThrowSecurityError))
return false;
// Don't allow shadowing location using accessor properties.
Modified: trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp (205357 => 205358)
--- trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp 2016-09-02 18:14:27 UTC (rev 205357)
+++ trunk/Source/WebCore/bindings/js/JSLocationCustom.cpp 2016-09-02 19:00:22 UTC (rev 205358)
@@ -119,6 +119,10 @@
bool JSLocation::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
{
+ JSLocation* thisObject = jsCast<JSLocation*>(object);
+ if (!BindingSecurity::shouldAllowAccessToFrame(exec, thisObject->wrapped().frame(), ThrowSecurityError))
+ return false;
+
if (descriptor.isAccessorDescriptor() && (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf))
return false;
return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
