Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104078 => 104079)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:40:36 UTC (rev 104078)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:47:49 UTC (rev 104079)
@@ -1,5 +1,20 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96260
+
+ 2011-09-28 Sergey Glazunov <[email protected]>
+
+ _javascript_ generated documents don't inherit the cookie URL
+ https://bugs.webkit.org/show_bug.cgi?id=69003
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/cookies/cookie-theft-with-_javascript_-doc-expected.txt: Added.
+ * http/tests/security/cookies/cookie-theft-with-_javascript_-doc.html: Added.
+ * http/tests/security/cookies/resources/innocent-victim-with-cookies.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95959
2011-09-26 Abhishek Arya <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc-expected.txt (from rev 96260, trunk/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc-expected.txt) (0 => 104079)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc-expected.txt 2012-01-04 22:47:49 UTC (rev 104079)
@@ -0,0 +1 @@
+SUCCESS
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc.html (from rev 96260, trunk/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc.html) (0 => 104079)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/cookie-theft-with-_javascript_-doc.html 2012-01-04 22:47:49 UTC (rev 104079)
@@ -0,0 +1,38 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ layoutTestController.setCanOpenWindows();
+ layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+}
+
+window._onload_ = function()
+{
+ frame = document.body.appendChild(document.createElement("iframe"));
+ frame.src = ""
+ frame._onload_ = function() {
+ frame._onload_ = null;
+
+ wnd = frame.contentWindow.open();
+ frame.src = ""
+ window._onmessage_ = function(e) {
+ key = e.data;
+ wnd.location = "_javascript_:('bar')";
+ setTimeout(finishTest, 0);
+ }
+ }
+}
+
+function finishTest()
+{
+ document.body.textContent = wnd.document.cookie.indexOf(key) != -1 ? "FAILURE" : "SUCCESS";
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body>
+</body>
+</html>
\ No newline at end of file
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/resources/innocent-victim-with-cookies.html (from rev 96260, trunk/LayoutTests/http/tests/security/cookies/resources/innocent-victim-with-cookies.html) (0 => 104079)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/resources/innocent-victim-with-cookies.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/cookies/resources/innocent-victim-with-cookies.html 2012-01-04 22:47:49 UTC (rev 104079)
@@ -0,0 +1,9 @@
+<html>
+<body>
+<script>
+k = Math.floor(Math.random() * 1000000);
+document.cookie = "secretcookie=" + k + ";path=/";
+parent.postMessage(k, "*");
+</script>
+</body>
+</html>
\ No newline at end of file
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104078 => 104079)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:40:36 UTC (rev 104078)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:47:49 UTC (rev 104079)
@@ -1,5 +1,25 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96260
+
+ 2011-09-28 Sergey Glazunov <[email protected]>
+
+ _javascript_ generated documents don't inherit the cookie URL
+ https://bugs.webkit.org/show_bug.cgi?id=69003
+
+ Reviewed by Adam Barth.
+
+ Test: http/tests/security/cookies/cookie-theft-with-_javascript_-doc.html
+
+ * dom/Document.h:
+ (WebCore::Document::setCookieURL):
+ * loader/DocumentWriter.cpp:
+ (WebCore::DocumentWriter::replaceDocument):
+ (WebCore::DocumentWriter::begin):
+ * loader/DocumentWriter.h:
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95985
2011-09-26 Dan Bernstein <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/dom/Document.h (104078 => 104079)
--- branches/safari-534.54-branch/Source/WebCore/dom/Document.h 2012-01-04 22:40:36 UTC (rev 104078)
+++ branches/safari-534.54-branch/Source/WebCore/dom/Document.h 2012-01-04 22:47:49 UTC (rev 104079)
@@ -844,6 +844,7 @@
// inherits its cookieURL but not its URL.
//
const KURL& cookieURL() const { return m_cookieURL; }
+ void setCookieURL(const KURL& url) { m_cookieURL = url; }
// The firstPartyForCookies is used to compute whether this document
// appears in a "third-party" context for the purpose of third-party
Modified: branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.cpp (104078 => 104079)
--- branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.cpp 2012-01-04 22:40:36 UTC (rev 104078)
+++ branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.cpp 2012-01-04 22:47:49 UTC (rev 104079)
@@ -67,7 +67,7 @@
void DocumentWriter::replaceDocument(const String& source)
{
m_frame->loader()->stopAllLoaders();
- begin(m_frame->document()->url(), true, m_frame->document()->securityOrigin());
+ begin(m_frame->document()->url(), true, InheritSecurityOrigin);
if (!source.isNull()) {
if (!m_receivedData) {
@@ -106,11 +106,9 @@
return DOMImplementation::createDocument(m_mimeType, m_frame, url, m_frame->inViewSourceMode());
}
-void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOrigin* origin)
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOriginSource originSource)
{
- // We need to take a reference to the security origin because |clear|
- // might destroy the document that owns it.
- RefPtr<SecurityOrigin> forcedSecurityOrigin = origin;
+ RefPtr<Document> oldDocument = m_frame->document();
// We grab a local copy of the URL because it's easy for callers to supply
// a URL that will be deallocated during the execution of this function.
@@ -139,8 +137,10 @@
if (m_decoder)
document->setDecoder(m_decoder.get());
- if (forcedSecurityOrigin)
- document->setSecurityOrigin(forcedSecurityOrigin.get());
+ if (originSource == InheritSecurityOrigin) {
+ document->setCookieURL(oldDocument->cookieURL());
+ document->setSecurityOrigin(oldDocument->securityOrigin());
+ }
m_frame->domWindow()->setURL(document->url());
m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
Modified: branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.h (104078 => 104079)
--- branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.h 2012-01-04 22:40:36 UTC (rev 104078)
+++ branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.h 2012-01-04 22:47:49 UTC (rev 104079)
@@ -48,8 +48,10 @@
// and always contains the result of evaluating a _javascript_: url.
void replaceDocument(const String&);
+ enum SecurityOriginSource { CreateNewSecurityOrigin, InheritSecurityOrigin };
+
void begin();
- void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
+ void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOriginSource = CreateNewSecurityOrigin);
void addData(const char* string, int length = -1, bool flush = false);
void end();
void endIfNotLoadingMainResource();
