Title: [104092] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104091 => 104092)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-05 00:15:09 UTC (rev 104091)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-05 00:19:09 UTC (rev 104092)
@@ -1,5 +1,19 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96984
+
+ 2011-10-07 Sergey Glazunov <[email protected]>
+
+ XSLT-generated document should inherit its SecurityOrigin from the source document
+ https://bugs.webkit.org/show_bug.cgi?id=69661
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt: Added.
+ * http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96868
2011-10-06 Abhishek Arya <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt (from rev 96984, trunk/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt) (0 => 104092)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt 2012-01-05 00:19:09 UTC (rev 104092)
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: line 1: Unsafe _javascript_ attempt to access frame with URL http://localhost:8080/security/resources/innocent-victim.html from frame with URL about:blank. Domains, protocols and ports must match.
+
+This test passes if it doesn't alert the contents of innocent-victim.html.
Copied: branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml (from rev 96984, trunk/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml) (0 => 104092)
--- branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml 2012-01-05 00:19:09 UTC (rev 104092)
@@ -0,0 +1,45 @@
+<?xml-stylesheet type="text/xsl" href=""
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:template match="/">
+<html>
+<head>
+<script>
+<![CDATA[
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ layoutTestController.setCanOpenWindows();
+ layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+ }
+
+window._onload_ = function()
+{
+ if (!opener) {
+ victim = document.body.appendChild(document.createElement("iframe"));
+ wnd = victim.contentWindow.open();
+ victim.src = ""
+ victim._onload_ = function() { wnd.eval("location = '" + location + "'"); }
+ } else if (location != "about:blank") {
+ url = ""
+ blank = document.body.appendChild(document.createElement("iframe"));
+ blank.contentWindow.eval("parent.document.open()");
+ location = "_javascript_:(\"<?xml version='1.0'?><?xml-stylesheet type='text/xsl' href=''?><root/>\")";
+ } else {
+ victim = opener;
+ open("_javascript_:void(0)", "_self");
+ if (victim.eval)
+ victim.eval("alert(document.body.innerHTML)");
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+}
+]]>
+</script>
+</head>
+<body>
+This test passes if it doesn't alert the contents of innocent-victim.html.
+</body>
+</html>
+</xsl:template>
+</xsl:stylesheet>
\ No newline at end of file
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104091 => 104092)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-05 00:15:09 UTC (rev 104091)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-05 00:19:09 UTC (rev 104092)
@@ -1,5 +1,21 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96984
+
+ 2011-10-07 Sergey Glazunov <[email protected]>
+
+ XSLT-generated document should inherit its SecurityOrigin from the source document
+ https://bugs.webkit.org/show_bug.cgi?id=69661
+
+ Reviewed by Adam Barth.
+
+ Test: http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml
+
+ * xml/XSLTProcessor.cpp:
+ (WebCore::XSLTProcessor::createDocumentFromSource):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96868
2011-10-06 Abhishek Arya <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/xml/XSLTProcessor.cpp (104091 => 104092)
--- branches/safari-534.54-branch/Source/WebCore/xml/XSLTProcessor.cpp 2012-01-05 00:15:09 UTC (rev 104091)
+++ branches/safari-534.54-branch/Source/WebCore/xml/XSLTProcessor.cpp 2012-01-05 00:19:09 UTC (rev 104092)
@@ -84,7 +84,13 @@
if (frame) {
if (FrameView* view = frame->view())
view->clear();
- result->setTransformSourceDocument(frame->document());
+
+ if (Document* oldDocument = frame->document()) {
+ result->setTransformSourceDocument(oldDocument);
+ result->setSecurityOrigin(oldDocument->securityOrigin());
+ result->setCookieURL(oldDocument->cookieURL());
+ }
+
frame->setDocument(result);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
