Title: [206995] trunk/Source/WebCore
- Revision
- 206995
- Author
- [email protected]
- Date
- 2016-10-10 06:42:24 -0700 (Mon, 10 Oct 2016)
Log Message
Images and scripts should be said as clean based on CachedResource::isCORSSameOrigin
https://bugs.webkit.org/show_bug.cgi?id=162390
Patch by Youenn Fablet <[email protected]> on 2016-10-10
Reviewed by Darin Adler.
No observable change of behavior.
Renaming CachedResource::isClean to isCORSSameOrigin to match html spec terminology.
Making use of it to check whether images taint canvas and whether script errors should be sanitized.
Some asserts are added to ensure that a resource fetched using one origin is not reused for another origin.
* dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::sanitizeScriptError):
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::initializeStyleSheet):
* html/canvas/CanvasRenderingContext.cpp:
(WebCore::CanvasRenderingContext::wouldTaintOrigin):
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::isOriginClean):
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::isCORSSameOrigin):
* loader/cache/CachedResource.h:
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (206994 => 206995)
--- trunk/Source/WebCore/ChangeLog 2016-10-10 13:09:56 UTC (rev 206994)
+++ trunk/Source/WebCore/ChangeLog 2016-10-10 13:42:24 UTC (rev 206995)
@@ -1,5 +1,31 @@
2016-10-10 Youenn Fablet <[email protected]>
+ Images and scripts should be said as clean based on CachedResource::isCORSSameOrigin
+ https://bugs.webkit.org/show_bug.cgi?id=162390
+
+ Reviewed by Darin Adler.
+
+ No observable change of behavior.
+
+ Renaming CachedResource::isClean to isCORSSameOrigin to match html spec terminology.
+ Making use of it to check whether images taint canvas and whether script errors should be sanitized.
+
+ Some asserts are added to ensure that a resource fetched using one origin is not reused for another origin.
+
+ * dom/ScriptExecutionContext.cpp:
+ (WebCore::ScriptExecutionContext::sanitizeScriptError):
+ * html/HTMLLinkElement.cpp:
+ (WebCore::HTMLLinkElement::initializeStyleSheet):
+ * html/canvas/CanvasRenderingContext.cpp:
+ (WebCore::CanvasRenderingContext::wouldTaintOrigin):
+ * loader/cache/CachedImage.cpp:
+ (WebCore::CachedImage::isOriginClean):
+ * loader/cache/CachedResource.cpp:
+ (WebCore::CachedResource::isCORSSameOrigin):
+ * loader/cache/CachedResource.h:
+
+2016-10-10 Youenn Fablet <[email protected]>
+
[Fetch API] Memory cache should not bypass redirect mode
https://bugs.webkit.org/show_bug.cgi?id=162959
Modified: trunk/Source/WebCore/dom/ScriptExecutionContext.cpp (206994 => 206995)
--- trunk/Source/WebCore/dom/ScriptExecutionContext.cpp 2016-10-10 13:09:56 UTC (rev 206994)
+++ trunk/Source/WebCore/dom/ScriptExecutionContext.cpp 2016-10-10 13:42:24 UTC (rev 206995)
@@ -352,9 +352,15 @@
bool ScriptExecutionContext::sanitizeScriptError(String& errorMessage, int& lineNumber, int& columnNumber, String& sourceURL, Deprecated::ScriptValue& error, CachedScript* cachedScript)
{
- URL targetURL = completeURL(sourceURL);
- if (securityOrigin()->canRequest(targetURL) || (cachedScript && cachedScript->passesAccessControlCheck(*securityOrigin())))
+ ASSERT(securityOrigin());
+ if (cachedScript) {
+ ASSERT(cachedScript->origin());
+ ASSERT(securityOrigin()->toString() == cachedScript->origin()->toString());
+ if (cachedScript->isCORSSameOrigin())
+ return false;
+ } else if (securityOrigin()->canRequest(completeURL(sourceURL)))
return false;
+
errorMessage = "Script error.";
sourceURL = String();
lineNumber = 0;
Modified: trunk/Source/WebCore/html/canvas/CanvasRenderingContext.cpp (206994 => 206995)
--- trunk/Source/WebCore/html/canvas/CanvasRenderingContext.cpp 2016-10-10 13:09:56 UTC (rev 206994)
+++ trunk/Source/WebCore/html/canvas/CanvasRenderingContext.cpp 2016-10-10 13:42:24 UTC (rev 206995)
@@ -60,11 +60,17 @@
if (!image || !canvas()->originClean())
return false;
- CachedImage* cachedImage = image->cachedImage();
- if (!cachedImage->image()->hasSingleSecurityOrigin())
+ ASSERT(image->cachedImage());
+ CachedImage& cachedImage = *image->cachedImage();
+
+ ASSERT(cachedImage.image());
+ if (!cachedImage.image()->hasSingleSecurityOrigin())
return true;
- return wouldTaintOrigin(cachedImage->responseForSameOriginPolicyChecks().url()) && !cachedImage->passesAccessControlCheck(*canvas()->securityOrigin());
+ ASSERT(canvas()->securityOrigin());
+ ASSERT(cachedImage.origin());
+ ASSERT(canvas()->securityOrigin()->toString() == cachedImage.origin()->toString());
+ return !cachedImage.isCORSSameOrigin();
}
bool CanvasRenderingContext::wouldTaintOrigin(const HTMLVideoElement* video)
Modified: trunk/Source/WebCore/loader/cache/CachedImage.cpp (206994 => 206995)
--- trunk/Source/WebCore/loader/cache/CachedImage.cpp 2016-10-10 13:09:56 UTC (rev 206994)
+++ trunk/Source/WebCore/loader/cache/CachedImage.cpp 2016-10-10 13:42:24 UTC (rev 206995)
@@ -492,13 +492,12 @@
return image->currentFrameKnownToBeOpaque();
}
-bool CachedImage::isOriginClean(SecurityOrigin* securityOrigin)
+bool CachedImage::isOriginClean(SecurityOrigin* origin)
{
- if (!image()->hasSingleSecurityOrigin())
- return false;
- if (passesAccessControlCheck(*securityOrigin))
- return true;
- return !securityOrigin->taintsCanvas(responseForSameOriginPolicyChecks().url());
+ ASSERT_UNUSED(origin, origin);
+ ASSERT(this->origin());
+ ASSERT(origin->toString() == this->origin()->toString());
+ return !loadFailedOrCanceled() && isCORSSameOrigin();
}
CachedResource::RevalidationDecision CachedImage::makeRevalidationDecision(CachePolicy cachePolicy) const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
