Title: [230017] trunk/Source/WebCore
- Revision
- 230017
- Author
- [email protected]
- Date
- 2018-03-27 17:12:32 -0700 (Tue, 27 Mar 2018)
Log Message
Make it possible to call ContentSecurityPolicy::upgradeInsecureRequestIfNeeded() from non-main threads
https://bugs.webkit.org/show_bug.cgi?id=184029
Reviewed by Youenn Fablet.
Make it possible to call ContentSecurityPolicy::upgradeInsecureRequestIfNeeded() from non-main threads
by having it use SecurityOriginData (which is safe to construct on non-main threads) instead of
SecurityOrigin (which isn't).
ContentSecurityPolicy::upgradeInsecureRequestIfNeeded() is already called from non-main thread in
FetchLoader, XHR and WebSocket when used in workers. This wasn't safe.
* loader/DocumentWriter.cpp:
(WebCore::DocumentWriter::begin):
* page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::upgradeInsecureRequestIfNeeded const):
(WebCore::ContentSecurityPolicy::setUpgradeInsecureRequests):
(WebCore::ContentSecurityPolicy::takeNavigationRequestsToUpgrade):
(WebCore::ContentSecurityPolicy::setInsecureNavigationRequestsToUpgrade):
* page/csp/ContentSecurityPolicy.h:
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (230016 => 230017)
--- trunk/Source/WebCore/ChangeLog 2018-03-27 23:54:24 UTC (rev 230016)
+++ trunk/Source/WebCore/ChangeLog 2018-03-28 00:12:32 UTC (rev 230017)
@@ -1,3 +1,26 @@
+2018-03-27 Chris Dumez <[email protected]>
+
+ Make it possible to call ContentSecurityPolicy::upgradeInsecureRequestIfNeeded() from non-main threads
+ https://bugs.webkit.org/show_bug.cgi?id=184029
+
+ Reviewed by Youenn Fablet.
+
+ Make it possible to call ContentSecurityPolicy::upgradeInsecureRequestIfNeeded() from non-main threads
+ by having it use SecurityOriginData (which is safe to construct on non-main threads) instead of
+ SecurityOrigin (which isn't).
+
+ ContentSecurityPolicy::upgradeInsecureRequestIfNeeded() is already called from non-main thread in
+ FetchLoader, XHR and WebSocket when used in workers. This wasn't safe.
+
+ * loader/DocumentWriter.cpp:
+ (WebCore::DocumentWriter::begin):
+ * page/csp/ContentSecurityPolicy.cpp:
+ (WebCore::ContentSecurityPolicy::upgradeInsecureRequestIfNeeded const):
+ (WebCore::ContentSecurityPolicy::setUpgradeInsecureRequests):
+ (WebCore::ContentSecurityPolicy::takeNavigationRequestsToUpgrade):
+ (WebCore::ContentSecurityPolicy::setInsecureNavigationRequestsToUpgrade):
+ * page/csp/ContentSecurityPolicy.h:
+
2018-03-27 Daniel Bates <[email protected]>
Attempt to fix media control layout tests after <https://trac.webkit.org/changeset/230006/>
Modified: trunk/Source/WebCore/loader/DocumentWriter.cpp (230016 => 230017)
--- trunk/Source/WebCore/loader/DocumentWriter.cpp 2018-03-27 23:54:24 UTC (rev 230016)
+++ trunk/Source/WebCore/loader/DocumentWriter.cpp 2018-03-28 00:12:32 UTC (rev 230017)
@@ -155,7 +155,7 @@
// requests in new navigation contexts. Although this information is present when we construct the
// Document object, it is discard in the subsequent 'clear' statements below. So, we must capture it
// so we can restore it.
- HashSet<RefPtr<SecurityOrigin>> insecureNavigationRequestsToUpgrade;
+ HashSet<SecurityOriginData> insecureNavigationRequestsToUpgrade;
if (auto* existingDocument = m_frame->document())
insecureNavigationRequestsToUpgrade = existingDocument->contentSecurityPolicy()->takeNavigationRequestsToUpgrade();
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp (230016 => 230017)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2018-03-27 23:54:24 UTC (rev 230016)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp 2018-03-28 00:12:32 UTC (rev 230017)
@@ -823,7 +823,7 @@
if (!url.protocolIs("http") && !url.protocolIs("ws"))
return;
- bool upgradeRequest = m_insecureNavigationRequestsToUpgrade.contains(SecurityOrigin::create(url));
+ bool upgradeRequest = m_insecureNavigationRequestsToUpgrade.contains(SecurityOriginData::fromURL(url));
if (requestType == InsecureRequestType::Load || requestType == InsecureRequestType::FormSubmission)
upgradeRequest |= m_upgradeInsecureRequests;
@@ -858,7 +858,7 @@
else if (upgradeURL.protocolIs("wss"))
upgradeURL.setProtocol("ws");
- m_insecureNavigationRequestsToUpgrade.add(SecurityOrigin::create(upgradeURL));
+ m_insecureNavigationRequestsToUpgrade.add(SecurityOriginData::fromURL(upgradeURL));
}
void ContentSecurityPolicy::inheritInsecureNavigationRequestsToUpgradeFromOpener(const ContentSecurityPolicy& other)
@@ -866,12 +866,12 @@
m_insecureNavigationRequestsToUpgrade.add(other.m_insecureNavigationRequestsToUpgrade.begin(), other.m_insecureNavigationRequestsToUpgrade.end());
}
-HashSet<RefPtr<SecurityOrigin>>&& ContentSecurityPolicy::takeNavigationRequestsToUpgrade()
+HashSet<SecurityOriginData> ContentSecurityPolicy::takeNavigationRequestsToUpgrade()
{
return WTFMove(m_insecureNavigationRequestsToUpgrade);
}
-void ContentSecurityPolicy::setInsecureNavigationRequestsToUpgrade(HashSet<RefPtr<SecurityOrigin>>&& insecureNavigationRequests)
+void ContentSecurityPolicy::setInsecureNavigationRequestsToUpgrade(HashSet<SecurityOriginData>&& insecureNavigationRequests)
{
m_insecureNavigationRequestsToUpgrade = WTFMove(insecureNavigationRequests);
}
Modified: trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h (230016 => 230017)
--- trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h 2018-03-27 23:54:24 UTC (rev 230016)
+++ trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h 2018-03-28 00:12:32 UTC (rev 230017)
@@ -164,9 +164,9 @@
void upgradeInsecureRequestIfNeeded(ResourceRequest&, InsecureRequestType) const;
void upgradeInsecureRequestIfNeeded(URL&, InsecureRequestType) const;
- HashSet<RefPtr<SecurityOrigin>>&& takeNavigationRequestsToUpgrade();
+ HashSet<SecurityOriginData> takeNavigationRequestsToUpgrade();
void inheritInsecureNavigationRequestsToUpgradeFromOpener(const ContentSecurityPolicy&);
- void setInsecureNavigationRequestsToUpgrade(HashSet<RefPtr<SecurityOrigin>>&&);
+ void setInsecureNavigationRequestsToUpgrade(HashSet<SecurityOriginData>&&);
private:
void logToConsole(const String& message, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), JSC::ExecState* = nullptr) const;
@@ -218,7 +218,7 @@
bool m_hasAPIPolicy { false };
OptionSet<ContentSecurityPolicyHashAlgorithm> m_hashAlgorithmsForInlineScripts;
OptionSet<ContentSecurityPolicyHashAlgorithm> m_hashAlgorithmsForInlineStylesheets;
- HashSet<RefPtr<SecurityOrigin>> m_insecureNavigationRequestsToUpgrade;
+ HashSet<SecurityOriginData> m_insecureNavigationRequestsToUpgrade;
mutable std::optional<ContentSecurityPolicyResponseHeaders> m_cachedResponseHeaders;
};
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
