Title: [104083] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104082 => 104083)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:59:15 UTC (rev 104082)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 23:06:27 UTC (rev 104083)
@@ -1,5 +1,19 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96826
+
+ 2011-10-06 Sergey Glazunov <[email protected]>
+
+ Add check for _javascript_ URLs in HTMLPlugInImageElement::allowedToLoadFrameURL
+ https://bugs.webkit.org/show_bug.cgi?id=68813
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/xss-DENIED-object-element-expected.txt: Added.
+ * http/tests/security/xss-DENIED-object-element.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96632
2011-09-21 Cris Neckar <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-object-element-expected.txt (from rev 96826, trunk/LayoutTests/http/tests/security/xss-DENIED-object-element-expected.txt) (0 => 104083)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-object-element-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-object-element-expected.txt 2012-01-04 23:06:27 UTC (rev 104083)
@@ -0,0 +1 @@
+There should be no alert displayed.
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-object-element.html (from rev 96826, trunk/LayoutTests/http/tests/security/xss-DENIED-object-element.html) (0 => 104083)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-object-element.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-object-element.html 2012-01-04 23:06:27 UTC (rev 104083)
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+}
+
+window._onload_ = function()
+{
+ object = document.createElement("object");
+ object.data = ""
+ document.body.appendChild(object);
+ object._onload_ = function() {
+ object._onload_ = null;
+ object.data = ""
+ object.innerHTML = "foo";
+
+ if (window.layoutTestController)
+ setTimeout("layoutTestController.notifyDone()", 50);
+ }
+}
+</script>
+</head>
+<body>
+There should be no alert displayed.
+</body>
+</html>
\ No newline at end of file
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104082 => 104083)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:59:15 UTC (rev 104082)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 23:06:27 UTC (rev 104083)
@@ -1,5 +1,21 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96826
+
+ 2011-10-06 Sergey Glazunov <[email protected]>
+
+ Add check for _javascript_ URLs in HTMLPlugInImageElement::allowedToLoadFrameURL
+ https://bugs.webkit.org/show_bug.cgi?id=68813
+
+ Reviewed by Adam Barth.
+
+ Test: http/tests/security/xss-DENIED-object-element.html
+
+ * html/HTMLPlugInImageElement.cpp:
+ (WebCore::HTMLPlugInImageElement::allowedToLoadFrameURL):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96632
2011-09-21 Cris Neckar <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/html/HTMLPlugInImageElement.cpp (104082 => 104083)
--- branches/safari-534.54-branch/Source/WebCore/html/HTMLPlugInImageElement.cpp 2012-01-04 22:59:15 UTC (rev 104082)
+++ branches/safari-534.54-branch/Source/WebCore/html/HTMLPlugInImageElement.cpp 2012-01-04 23:06:27 UTC (rev 104083)
@@ -30,6 +30,7 @@
#include "Page.h"
#include "RenderEmbeddedObject.h"
#include "RenderImage.h"
+#include "SecurityOrigin.h"
namespace WebCore {
@@ -75,9 +76,14 @@
if (document()->frame()->page()->frameCount() >= Page::maxNumberOfFrames)
return false;
+ KURL completeURL = document()->completeURL(url);
+
+ if (contentFrame() && protocolIsJavaScript(completeURL)
+ && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))
+ return false;
+
// We allow one level of self-reference because some sites depend on that.
// But we don't allow more than one.
- KURL completeURL = document()->completeURL(url);
bool foundSelfReference = false;
for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
