Title: [245925] branches/safari-607-branch
- Revision
- 245925
- Author
- [email protected]
- Date
- 2019-05-30 17:30:13 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r245538. rdar://problem/50753927
Fix security check in ScriptController::canAccessFromCurrentOrigin()
https://bugs.webkit.org/show_bug.cgi?id=196730
<rdar://problem/49731231>
Reviewed by Ryosuke Niwa.
Source/WebCore:
Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
current JS exec state. Instead of returning true unconditionally, we now fall back to
using the accessing document's origin for the security check. The new behavior is
aligned with Blink:
https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
This fix is based on a patch from Sergei Glazunov <[email protected]>.
Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::canAccessFromCurrentOrigin):
* bindings/js/ScriptController.h:
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::isURLAllowed const):
LayoutTests:
Add layout test coverage.
* http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
* http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (245924 => 245925)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:10 UTC (rev 245924)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:13 UTC (rev 245925)
@@ -1,5 +1,55 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245538. rdar://problem/50753927
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin()
+ https://bugs.webkit.org/show_bug.cgi?id=196730
+ <rdar://problem/49731231>
+
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
+ current JS exec state. Instead of returning true unconditionally, we now fall back to
+ using the accessing document's origin for the security check. The new behavior is
+ aligned with Blink:
+ https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
+
+ This fix is based on a patch from Sergei Glazunov <[email protected]>.
+
+ Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
+
+ * bindings/js/ScriptController.cpp:
+ (WebCore::ScriptController::canAccessFromCurrentOrigin):
+ * bindings/js/ScriptController.h:
+ * html/HTMLFrameElementBase.cpp:
+ (WebCore::HTMLFrameElementBase::isURLAllowed const):
+
+ LayoutTests:
+
+ Add layout test coverage.
+
+ * http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
+ * http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-20 Chris Dumez <[email protected]>
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin()
+ https://bugs.webkit.org/show_bug.cgi?id=196730
+ <rdar://problem/49731231>
+
+ Reviewed by Ryosuke Niwa.
+
+ Add layout test coverage.
+
+ * http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
+ * http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245509. rdar://problem/51264845
Wait to get frame until after layout has been run
Added: branches/safari-607-branch/LayoutTests/http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt (0 => 245925)
--- branches/safari-607-branch/LayoutTests/http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt 2019-05-31 00:30:13 UTC (rev 245925)
@@ -0,0 +1,2 @@
+This test passes if it does not alert the fail.html's content when clicking the button.
+
Added: branches/safari-607-branch/LayoutTests/http/tests/security/showModalDialog-sync-cross-origin-page-load2.html (0 => 245925)
--- branches/safari-607-branch/LayoutTests/http/tests/security/showModalDialog-sync-cross-origin-page-load2.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/http/tests/security/showModalDialog-sync-cross-origin-page-load2.html 2019-05-31 00:30:13 UTC (rev 245925)
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html>
+<body>
+<b>This test passes if it does not alert the fail.html's content when clicking the button.</b><br>
+<input id="testButton" type="button" value="Click me"></input>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.setCanOpenWindows();
+ testRunner.waitUntilDone();
+}
+
+let counter = 0;
+function run(event) {
+ ++counter;
+ if (counter == 2) {
+ event.target.src = ""
+ } else if (counter == 3) {
+ frame = event.target;
+
+ a = frame.contentDocument.createElement("a");
+ a.href = ""
+ a.click();
+
+ showModalDialog(URL.createObjectURL(new Blob([`
+ <script>
+ timeout = 0;
+ let intervalID = setInterval(() => {
+ try {
+ opener.frame.contentWindow.foo;
+ timeout++;
+ if (timeout == 200)
+ throw "";
+ } catch (e) {
+ clearInterval(intervalID);
+
+ window.close();
+ if (window.testRunner)
+ testRunner.abortModal();
+ }
+ }, 10);
+ </scr` + "ipt>"], {type: "text/html"})));
+
+ setTimeout(() => {
+ setTimeout(() => {
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+ }, 0);
+ }
+}
+
+testButton._onclick_ = _ => {
+ frame = document.body.appendChild(document.createElement("iframe"));
+ frame.contentWindow.location = `_javascript_:'<b><p><iframe`
+ + ` _onload_="top.run(event)"></iframe></b></p>'`;
+}
+
+cache_frame = document.body.appendChild(document.createElement("iframe"));
+cache_frame.src = ""
+cache_frame.style.display = "none";
+
+_onload_ = function() {
+ if (!window.internals)
+ return;
+
+ internals.withUserGesture(() => {
+ testButton.click();
+ });
+}
+</script>
+</body>
+</html>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (245924 => 245925)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:10 UTC (rev 245924)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:13 UTC (rev 245925)
@@ -1,5 +1,66 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245538. rdar://problem/50753927
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin()
+ https://bugs.webkit.org/show_bug.cgi?id=196730
+ <rdar://problem/49731231>
+
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
+ current JS exec state. Instead of returning true unconditionally, we now fall back to
+ using the accessing document's origin for the security check. The new behavior is
+ aligned with Blink:
+ https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
+
+ This fix is based on a patch from Sergei Glazunov <[email protected]>.
+
+ Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
+
+ * bindings/js/ScriptController.cpp:
+ (WebCore::ScriptController::canAccessFromCurrentOrigin):
+ * bindings/js/ScriptController.h:
+ * html/HTMLFrameElementBase.cpp:
+ (WebCore::HTMLFrameElementBase::isURLAllowed const):
+
+ LayoutTests:
+
+ Add layout test coverage.
+
+ * http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
+ * http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-20 Chris Dumez <[email protected]>
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin()
+ https://bugs.webkit.org/show_bug.cgi?id=196730
+ <rdar://problem/49731231>
+
+ Reviewed by Ryosuke Niwa.
+
+ Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
+ current JS exec state. Instead of returning true unconditionally, we now fall back to
+ using the accessing document's origin for the security check. The new behavior is
+ aligned with Blink:
+ https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62
+
+ This fix is based on a patch from Sergei Glazunov <[email protected]>.
+
+ Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html
+
+ * bindings/js/ScriptController.cpp:
+ (WebCore::ScriptController::canAccessFromCurrentOrigin):
+ * bindings/js/ScriptController.h:
+ * html/HTMLFrameElementBase.cpp:
+ (WebCore::HTMLFrameElementBase::isURLAllowed const):
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245509. rdar://problem/51264845
Wait to get frame until after layout has been run
Modified: branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.cpp (245924 => 245925)
--- branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.cpp 2019-05-31 00:30:10 UTC (rev 245924)
+++ branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.cpp 2019-05-31 00:30:13 UTC (rev 245925)
@@ -378,13 +378,15 @@
jsWindowProxy->window()->setWebAssemblyEnabled(false, errorMessage);
}
-bool ScriptController::canAccessFromCurrentOrigin(Frame* frame)
+bool ScriptController::canAccessFromCurrentOrigin(Frame* frame, Document& accessingDocument)
{
auto* state = JSExecState::currentState();
- // If the current state is null we're in a call path where the DOM security check doesn't apply (eg. parser).
- if (!state)
- return true;
+ // If the current state is null we should use the accessing document for the security check.
+ if (!state) {
+ auto* targetDocument = frame ? frame->document() : nullptr;
+ return targetDocument && accessingDocument.securityOrigin().canAccess(targetDocument->securityOrigin());
+ }
return BindingSecurity::shouldAllowAccessToFrame(state, frame);
}
Modified: branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.h (245924 => 245925)
--- branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.h 2019-05-31 00:30:10 UTC (rev 245924)
+++ branches/safari-607-branch/Source/WebCore/bindings/js/ScriptController.h 2019-05-31 00:30:13 UTC (rev 245925)
@@ -119,7 +119,7 @@
void disableEval(const String& errorMessage);
void disableWebAssembly(const String& errorMessage);
- static bool canAccessFromCurrentOrigin(Frame*);
+ static bool canAccessFromCurrentOrigin(Frame*, Document& accessingDocument);
WEBCORE_EXPORT bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
void setPaused(bool b) { m_paused = b; }
Modified: branches/safari-607-branch/Source/WebCore/html/HTMLFrameElementBase.cpp (245924 => 245925)
--- branches/safari-607-branch/Source/WebCore/html/HTMLFrameElementBase.cpp 2019-05-31 00:30:10 UTC (rev 245924)
+++ branches/safari-607-branch/Source/WebCore/html/HTMLFrameElementBase.cpp 2019-05-31 00:30:13 UTC (rev 245925)
@@ -73,7 +73,7 @@
if (WTF::protocolIsJavaScript(completeURL)) {
RefPtr<Document> contentDoc = this->contentDocument();
- if (contentDoc && !ScriptController::canAccessFromCurrentOrigin(contentDoc->frame()))
+ if (contentDoc && !ScriptController::canAccessFromCurrentOrigin(contentDoc->frame(), document()))
return false;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
