Diff
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104103 => 104104)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-05 01:13:39 UTC (rev 104103)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-05 01:17:46 UTC (rev 104104)
@@ -1,5 +1,25 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 97270
+
+ 2011-10-12 Sergey Glazunov <[email protected]>
+
+ ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads
+ https://bugs.webkit.org/show_bug.cgi?id=69777
+
+ Reviewed by Adam Barth.
+
+ Test: http/tests/security/xss-DENIED-synchronous-frame-load-in-_javascript_-url.html
+
+ * bindings/ScriptControllerBase.cpp:
+ (WebCore::ScriptController::executeIfJavaScriptURL):
+ * loader/DocumentWriter.cpp:
+ (WebCore::DocumentWriter::replaceDocument):
+ (WebCore::DocumentWriter::begin):
+ * loader/DocumentWriter.h:
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 97180
2011-10-11 Abhishek Arya <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/bindings/ScriptControllerBase.cpp (104103 => 104104)
--- branches/safari-534.54-branch/Source/WebCore/bindings/ScriptControllerBase.cpp 2012-01-05 01:13:39 UTC (rev 104103)
+++ branches/safari-534.54-branch/Source/WebCore/bindings/ScriptControllerBase.cpp 2012-01-05 01:17:46 UTC (rev 104104)
@@ -83,6 +83,7 @@
// We need to hold onto the Frame here because executing script can
// destroy the frame.
RefPtr<Frame> protector(m_frame);
+ RefPtr<Document> ownerDocument(m_frame->document());
const int _javascript_SchemeLength = sizeof("_javascript_:") - 1;
@@ -115,7 +116,7 @@
// DocumentWriter::replaceDocument can cause the DocumentLoader to get deref'ed and possible destroyed,
// so protect it with a RefPtr.
if (RefPtr<DocumentLoader> loader = m_frame->document()->loader())
- loader->writer()->replaceDocument(scriptResult);
+ loader->writer()->replaceDocument(scriptResult, ownerDocument.get());
}
return true;
}
Modified: branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.cpp (104103 => 104104)
--- branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.cpp 2012-01-05 01:13:39 UTC (rev 104103)
+++ branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.cpp 2012-01-05 01:17:46 UTC (rev 104104)
@@ -64,10 +64,10 @@
// This is only called by ScriptController::executeIfJavaScriptURL
// and always contains the result of evaluating a _javascript_: url.
// This is the <iframe src="" case.
-void DocumentWriter::replaceDocument(const String& source)
+void DocumentWriter::replaceDocument(const String& source, Document* ownerDocument)
{
m_frame->loader()->stopAllLoaders();
- begin(m_frame->document()->url(), true, InheritSecurityOrigin);
+ begin(m_frame->document()->url(), true, ownerDocument);
if (!source.isNull()) {
if (!m_receivedData) {
@@ -106,10 +106,8 @@
return DOMImplementation::createDocument(m_mimeType, m_frame, url, m_frame->inViewSourceMode());
}
-void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOriginSource originSource)
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, Document* ownerDocument)
{
- RefPtr<Document> oldDocument = m_frame->document();
-
// We grab a local copy of the URL because it's easy for callers to supply
// a URL that will be deallocated during the execution of this function.
// For example, see <https://bugs.webkit.org/show_bug.cgi?id=66360>.
@@ -137,9 +135,9 @@
if (m_decoder)
document->setDecoder(m_decoder.get());
- if (originSource == InheritSecurityOrigin) {
- document->setCookieURL(oldDocument->cookieURL());
- document->setSecurityOrigin(oldDocument->securityOrigin());
+ if (ownerDocument) {
+ document->setCookieURL(ownerDocument->cookieURL());
+ document->setSecurityOrigin(ownerDocument->securityOrigin());
}
m_frame->domWindow()->setURL(document->url());
Modified: branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.h (104103 => 104104)
--- branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.h 2012-01-05 01:13:39 UTC (rev 104103)
+++ branches/safari-534.54-branch/Source/WebCore/loader/DocumentWriter.h 2012-01-05 01:17:46 UTC (rev 104104)
@@ -46,12 +46,10 @@
// This is only called by ScriptController::executeIfJavaScriptURL
// and always contains the result of evaluating a _javascript_: url.
- void replaceDocument(const String&);
+ void replaceDocument(const String&, Document* ownerDocument);
- enum SecurityOriginSource { CreateNewSecurityOrigin, InheritSecurityOrigin };
-
void begin();
- void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOriginSource = CreateNewSecurityOrigin);
+ void begin(const KURL&, bool dispatchWindowObjectAvailable = true, Document* ownerDocument = 0);
void addData(const char* string, int length = -1, bool flush = false);
void end();
void endIfNotLoadingMainResource();
