Diff
Modified: trunk/LayoutTests/ChangeLog (274732 => 274733)
--- trunk/LayoutTests/ChangeLog 2021-03-19 19:22:26 UTC (rev 274732)
+++ trunk/LayoutTests/ChangeLog 2021-03-19 19:30:57 UTC (rev 274733)
@@ -1,3 +1,16 @@
+2021-03-19 Youenn Fablet <[email protected]>
+
+ Custom scheme handled origins should be considered secure
+ https://bugs.webkit.org/show_bug.cgi?id=223423
+
+ Reviewed by Alex Christensen.
+
+ Add a new test to check device orientation in insecure context now that we cannot do that anymore with custom schemes.
+
+ * http/tests/events/device-orientation-motion-insecure-context-expected.txt: Added.
+ * http/tests/events/device-orientation-motion-insecure-context.html: Added.
+ * platform/ios/http/tests/events/device-orientation-motion-insecure-context-expected.txt: Added.
+
2021-03-19 Jer Noble <[email protected]>
[GPUP] platform/mac/media/encrypted-media/fps-clearkey-crash.html is a flaky timeout
Added: trunk/LayoutTests/http/tests/events/device-orientation-motion-insecure-context-expected.txt (0 => 274733)
--- trunk/LayoutTests/http/tests/events/device-orientation-motion-insecure-context-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/events/device-orientation-motion-insecure-context-expected.txt 2021-03-19 19:30:57 UTC (rev 274733)
@@ -0,0 +1,12 @@
+CONSOLE MESSAGE: Device Orientation API is not supported
+CONSOLE MESSAGE: Device Motion API is not supported
+Tests that trying to set an event listener for deviceorientation and deviceorientation does not log an error in secure contexts.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/http/tests/events/device-orientation-motion-insecure-context.html (0 => 274733)
--- trunk/LayoutTests/http/tests/events/device-orientation-motion-insecure-context.html (rev 0)
+++ trunk/LayoutTests/http/tests/events/device-orientation-motion-insecure-context.html 2021-03-19 19:30:57 UTC (rev 274733)
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+description("Tests that trying to set an event listener for deviceorientation and deviceorientation does not log an error in secure contexts.");
+jsTestIsAsync = true;
+
+if (window.testRunner) {
+ if (testRunner.setShouldAllowDeviceOrientationAndMotionAccess)
+ testRunner.setShouldAllowDeviceOrientationAndMotionAccess(true);
+}
+
+// localhost is secure by default.
+if (window.internals)
+ internals.markContextAsInsecure();
+
+let lastConsoleMessage = null;
+internals.setConsoleMessageListener((message) => {
+ lastConsoleMessage = message;
+});
+
+function runDeviceMotionTest()
+{
+ debug("");
+ if (!window.DeviceMotionEvent) {
+ console.log("Device Motion API is not supported");
+ finishJSTest();
+ return;
+ }
+
+ debug("* Requesting device motion access...");
+ internals.withUserGesture(() => {
+ DeviceMotionEvent.requestPermission().then((_result) => {
+ result = _result;
+ shouldBeEqualToString("result", "denied");
+ finishJSTest();
+ });
+ });
+}
+
+function runDeviceOrientationTest()
+{
+ if (!window.DeviceOrientationEvent) {
+ console.log("Device Orientation API is not supported");
+ runDeviceMotionTest();
+ return;
+ }
+
+ debug("* Requesting device orientation access...");
+ internals.withUserGesture(() => {
+ DeviceOrientationEvent.requestPermission().then((_result) => {
+ result = _result;
+ shouldBeEqualToString("result", "denied");
+
+ runDeviceMotionTest();
+ });
+ });
+}
+
+_onload_ = runDeviceOrientationTest;
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/platform/ios/http/tests/events/device-orientation-motion-insecure-context-expected.txt (0 => 274733)
--- trunk/LayoutTests/platform/ios/http/tests/events/device-orientation-motion-insecure-context-expected.txt (rev 0)
+++ trunk/LayoutTests/platform/ios/http/tests/events/device-orientation-motion-insecure-context-expected.txt 2021-03-19 19:30:57 UTC (rev 274733)
@@ -0,0 +1,16 @@
+CONSOLE MESSAGE: Call to requestPermission() failed, reason: Browsing context is not secure.
+CONSOLE MESSAGE: Call to requestPermission() failed, reason: Browsing context is not secure.
+Tests that trying to set an event listener for deviceorientation and deviceorientation does not log an error in secure contexts.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+* Requesting device orientation access...
+PASS result is "denied"
+
+* Requesting device motion access...
+PASS result is "denied"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Modified: trunk/Source/WebCore/ChangeLog (274732 => 274733)
--- trunk/Source/WebCore/ChangeLog 2021-03-19 19:22:26 UTC (rev 274732)
+++ trunk/Source/WebCore/ChangeLog 2021-03-19 19:30:57 UTC (rev 274733)
@@ -1,3 +1,21 @@
+2021-03-19 Youenn Fablet <[email protected]>
+
+ Custom scheme handled origins should be considered secure
+ https://bugs.webkit.org/show_bug.cgi?id=223423
+
+ Reviewed by Alex Christensen.
+
+ If an app registers 'custom' as scheme handler, 'custom://localhost/page.html' is considered secure context
+ but 'custom://test/page.html' is not.
+ This patch makes it so that any 'custom://XXX/' origin will be considered secure context if 'custom' is a registered scheme handler.
+ Covered by API test and new test.
+
+ Test: http/tests/events/device-orientation-motion-insecure-context.html
+
+ * WebCore.xcodeproj/project.pbxproj:
+ * page/SecurityOrigin.cpp:
+ (WebCore::shouldTreatAsPotentiallyTrustworthy):
+
2021-03-19 ChangSeok Oh <[email protected]>
Animated AVIF support
Modified: trunk/Source/WebCore/page/SecurityOrigin.cpp (274732 => 274733)
--- trunk/Source/WebCore/page/SecurityOrigin.cpp 2021-03-19 19:22:26 UTC (rev 274732)
+++ trunk/Source/WebCore/page/SecurityOrigin.cpp 2021-03-19 19:30:57 UTC (rev 274733)
@@ -165,6 +165,9 @@
if (LegacySchemeRegistry::shouldTreatURLSchemeAsLocal(protocol))
return true;
+ if (LegacySchemeRegistry::schemeIsHandledBySchemeHandler(protocol))
+ return true;
+
return false;
}
Modified: trunk/Tools/ChangeLog (274732 => 274733)
--- trunk/Tools/ChangeLog 2021-03-19 19:22:26 UTC (rev 274732)
+++ trunk/Tools/ChangeLog 2021-03-19 19:30:57 UTC (rev 274733)
@@ -1,3 +1,14 @@
+2021-03-19 Youenn Fablet <[email protected]>
+
+ Custom scheme handled origins should be considered secure
+ https://bugs.webkit.org/show_bug.cgi?id=223423
+
+ Reviewed by Alex Christensen.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/DeviceOrientation.mm:
+ * TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
+ (-[URLSchemeHandlerMessageHandler userContentController:didReceiveScriptMessage:]):
+
2021-03-19 Aakash Jain <[email protected]>
Fix broken contributors.json after r274720
Modified: trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/DeviceOrientation.mm (274732 => 274733)
--- trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/DeviceOrientation.mm 2021-03-19 19:22:26 UTC (rev 274732)
+++ trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/DeviceOrientation.mm 2021-03-19 19:30:57 UTC (rev 274733)
@@ -334,35 +334,22 @@
</script>
)TESTRESOURCE";
-enum class ShouldEnableSecureContextChecks { No, Yes };
-static void runPermissionSecureContextCheckTest(ShouldEnableSecureContextChecks shouldEnableSecureContextChecks)
+TEST(DeviceOrientation, PermissionSecureContextCheck)
{
+ TestWebKitAPI::HTTPServer server({
+ { "/", { mainBytes } }
+ });
auto configuration = adoptNS([[WKWebViewConfiguration alloc] init]);
configuration.get().websiteDataStore = [WKWebsiteDataStore defaultDataStore];
- auto preferences = [configuration preferences];
- [preferences _setSecureContextChecksEnabled:shouldEnableSecureContextChecks == ShouldEnableSecureContextChecks::Yes ? YES : NO];
-
auto messageHandler = adoptNS([[DeviceOrientationMessageHandler alloc] init]);
[[configuration userContentController] addScriptMessageHandler:messageHandler.get() name:@"testHandler"];
- auto schemeHandler = adoptNS([[TestURLSchemeHandler alloc] init]);
- [configuration setURLSchemeHandler:schemeHandler.get() forURLScheme:@"test"];
-
- [schemeHandler setStartURLSchemeTaskHandler:^(WKWebView *, id<WKURLSchemeTask> task) {
- auto response = adoptNS([[NSURLResponse alloc] initWithURL:task.request.URL MIMEType:@"text/html" expectedContentLength:0 textEncodingName:nil]);
- [task didReceiveResponse:response.get()];
- [task didReceiveData:[NSData dataWithBytes:mainBytes length:strlen(mainBytes)]];
- [task didFinish];
- }];
-
auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSMakeRect(0, 0, 800, 600) configuration:configuration.get()]);
RetainPtr<DeviceOrientationPermissionUIDelegate> uiDelegate = adoptNS([[DeviceOrientationPermissionUIDelegate alloc] initWithHandler:[] { return true; }]);
[webView setUIDelegate:uiDelegate.get()];
- NSURLRequest *request = [NSURLRequest requestWithURL:[NSURL URLWithString:@"test://host/main.html"]];
-
- [webView loadRequest:request];
+ [webView loadRequest:server.request()];
[webView _test_waitForDidFinishNavigation];
[webView evaluateJavaScript:@"requestPermission();" completionHandler:nil];
@@ -370,11 +357,6 @@
TestWebKitAPI::Util::run(&didReceiveMessage);
didReceiveMessage = false;
- if (shouldEnableSecureContextChecks == ShouldEnableSecureContextChecks::Yes) {
- EXPECT_WK_STREQ(@"denied", receivedMessages.get()[0]);
- return;
- }
-
EXPECT_WK_STREQ(@"granted", receivedMessages.get()[0]);
bool addedEventListener = false;
@@ -393,16 +375,6 @@
EXPECT_WK_STREQ(@"received-event", receivedMessages.get()[1]);
}
-TEST(DeviceOrientation, PermissionSecureContextCheck)
-{
- runPermissionSecureContextCheckTest(ShouldEnableSecureContextChecks::Yes);
-}
-
-TEST(DeviceOrientation, PermissionSecureContextCheckDisabled)
-{
- runPermissionSecureContextCheckTest(ShouldEnableSecureContextChecks::No);
-}
-
@interface DeviceOrientationPermissionValidationDelegate : NSObject <WKUIDelegatePrivate>
- (void)setValidationHandler:(Function<void(WKSecurityOrigin*, WKFrameInfo*)>&&)validationHandler;
@end
Modified: trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm (274732 => 274733)
--- trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm 2021-03-19 19:22:26 UTC (rev 274732)
+++ trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm 2021-03-19 19:30:57 UTC (rev 274733)
@@ -1389,3 +1389,47 @@
[webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"registered:///"]]];
EXPECT_WK_STREQ([delegate waitForAlert], "registered://host:123, null");
}
+
+
+static bool receivedScriptMessage = false;
+static RetainPtr<WKScriptMessage> lastScriptMessage;
+@interface URLSchemeHandlerMessageHandler : NSObject <WKScriptMessageHandler>
+@end
+
+@implementation URLSchemeHandlerMessageHandler
+
+- (void)userContentController:(WKUserContentController *)userContentController didReceiveScriptMessage:(WKScriptMessage *)message
+{
+ lastScriptMessage = message;
+ receivedScriptMessage = true;
+}
+@end
+
+TEST(URLSchemeHandler, isSecureContext)
+{
+ auto configuration = adoptNS([[WKWebViewConfiguration alloc] init]);
+ auto schemeHandler = adoptNS([TestURLSchemeHandler new]);
+ [schemeHandler setStartURLSchemeTaskHandler:^(WKWebView *, id<WKURLSchemeTask> task) {
+ NSString *responseString = @"<script>window.webkit.messageHandlers.testHandler.postMessage(window.isSecureContext ? 'secure': 'not secure');</script>";
+ [task didReceiveResponse:adoptNS([[NSURLResponse alloc] initWithURL:task.request.URL MIMEType:@"text/html" expectedContentLength:responseString.length textEncodingName:nil]).get()];
+ [task didReceiveData:[responseString dataUsingEncoding:NSUTF8StringEncoding]];
+ [task didFinish];
+ }];
+
+ [configuration setURLSchemeHandler:schemeHandler.get() forURLScheme:@"testing"];
+
+ auto messageHandler = adoptNS([[URLSchemeHandlerMessageHandler alloc] init]);
+ [[configuration userContentController] addScriptMessageHandler:messageHandler.get() name:@"testHandler"];
+
+ auto webView = adoptNS([[WKWebView alloc] initWithFrame:NSMakeRect(0, 0, 800, 600) configuration:configuration.get()]);
+
+ receivedScriptMessage = false;
+ [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"testing://localhost/test.html"]]];
+ TestWebKitAPI::Util::run(&receivedScriptMessage);
+ EXPECT_WK_STREQ(@"secure", [lastScriptMessage body]);
+
+ receivedScriptMessage = false;
+ [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"testing://main/test.html"]]];
+ TestWebKitAPI::Util::run(&receivedScriptMessage);
+ EXPECT_WK_STREQ(@"secure", [lastScriptMessage body]);
+}
