Title: [243434] trunk/Source/WebKit
- Revision
- 243434
- Author
- [email protected]
- Date
- 2019-03-25 02:11:58 -0700 (Mon, 25 Mar 2019)
Log Message
[GTK][WPE] Do not allow changes in active URI before provisional load starts for non-API requests
https://bugs.webkit.org/show_bug.cgi?id=194208
Reviewed by Michael Catanzaro.
* UIProcess/API/glib/WebKitWebView.cpp:
(webkitWebViewWillStartLoad): Block updates of active URL.
(webkitWebViewLoadChanged): Unblock updates of active URL on WEBKIT_LOAD_STARTED.
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (243433 => 243434)
--- trunk/Source/WebKit/ChangeLog 2019-03-25 08:07:14 UTC (rev 243433)
+++ trunk/Source/WebKit/ChangeLog 2019-03-25 09:11:58 UTC (rev 243434)
@@ -1,3 +1,14 @@
+2019-03-25 Carlos Garcia Campos <[email protected]>
+
+ [GTK][WPE] Do not allow changes in active URI before provisional load starts for non-API requests
+ https://bugs.webkit.org/show_bug.cgi?id=194208
+
+ Reviewed by Michael Catanzaro.
+
+ * UIProcess/API/glib/WebKitWebView.cpp:
+ (webkitWebViewWillStartLoad): Block updates of active URL.
+ (webkitWebViewLoadChanged): Unblock updates of active URL on WEBKIT_LOAD_STARTED.
+
2019-03-25 Gyuyoung Kim <[email protected]>
Remove NavigatorContentUtils in WebCore/Modules
Modified: trunk/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp (243433 => 243434)
--- trunk/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp 2019-03-25 08:07:14 UTC (rev 243433)
+++ trunk/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp 2019-03-25 09:11:58 UTC (rev 243434)
@@ -246,6 +246,7 @@
CString title;
CString customTextEncoding;
CString activeURI;
+ bool isActiveURIChangeBlocked;
bool isLoading;
bool isEphemeral;
bool isControlledByAutomation;
@@ -355,10 +356,14 @@
void willChangeActiveURL() override
{
+ if (m_webView->priv->isActiveURIChangeBlocked)
+ return;
g_object_freeze_notify(G_OBJECT(m_webView));
}
void didChangeActiveURL() override
{
+ if (m_webView->priv->isActiveURIChangeBlocked)
+ return;
m_webView->priv->activeURI = getPage(m_webView).pageLoadState().activeURL().utf8();
g_object_notify(G_OBJECT(m_webView), "uri");
g_object_thaw_notify(G_OBJECT(m_webView));
@@ -2077,6 +2082,15 @@
void webkitWebViewWillStartLoad(WebKitWebView* webView)
{
+ // Ignore the active URI changes happening before WEBKIT_LOAD_STARTED. If they are not user-initiated,
+ // they could be a malicious attempt to trick users by loading an invalid URI on a trusted host, with the load
+ // intended to stall, or perhaps be repeated. If we trust the URI here and display it to the user, then the user's
+ // only indication that something is wrong would be a page loading indicator. If the load request is not
+ // user-initiated, we must not trust it until WEBKIT_LOAD_COMMITTED. If the load is triggered by API
+ // request, then the active URI is already the pending API request URL, so the blocking is harmless and the
+ // client application will still see the URI update immediately. Otherwise, the URI update will be delayed a bit.
+ webView->priv->isActiveURIChangeBlocked = true;
+
// This is called before NavigationClient::didStartProvisionalNavigation(), the page load state hasn't been committed yet.
auto& pageLoadState = getPage(webView).pageLoadState();
if (pageLoadState.isFinished())
@@ -2099,15 +2113,24 @@
webkitWebViewCancelAuthenticationRequest(webView);
priv->loadingResourcesMap.clear();
priv->mainResource = nullptr;
+ webView->priv->isActiveURIChangeBlocked = false;
break;
+ case WEBKIT_LOAD_COMMITTED: {
+ auto activeURL = getPage(webView).pageLoadState().activeURL().utf8();
+ // Active URL is trusted now. If it's different to our active URI, due to the
+ // update block before WEBKIT_LOAD_STARTED, we update it here to be in sync
+ // again with the page load state.
+ if (activeURL != priv->activeURI) {
+ priv->activeURI = activeURL;
+ g_object_notify(G_OBJECT(webView), "uri");
+ }
#if PLATFORM(GTK)
- case WEBKIT_LOAD_COMMITTED: {
WebKitFaviconDatabase* database = webkit_web_context_get_favicon_database(priv->context.get());
GUniquePtr<char> faviconURI(webkit_favicon_database_get_favicon_uri(database, priv->activeURI.data()));
webkitWebViewUpdateFaviconURI(webView, faviconURI.get());
+#endif
break;
}
-#endif
case WEBKIT_LOAD_FINISHED:
webkitWebViewCancelAuthenticationRequest(webView);
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
