Diff
Modified: trunk/LayoutTests/ChangeLog (280869 => 280870)
--- trunk/LayoutTests/ChangeLog 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/LayoutTests/ChangeLog 2021-08-10 23:19:03 UTC (rev 280870)
@@ -1,3 +1,14 @@
+2021-08-10 Chris Dumez <[email protected]>
+
+ Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
+ https://bugs.webkit.org/show_bug.cgi?id=228965
+
+ Reviewed by Darin Adler.
+
+ Unskip tests that should no longer be flaky now that they are passing.
+
+ * TestExpectations:
+
2021-08-10 Ayumi Kojima <[email protected]>
[ Win EWS ] fast/forms/search/search-zoom-computed-style-height.html is flaky crashing.
Modified: trunk/LayoutTests/TestExpectations (280869 => 280870)
--- trunk/LayoutTests/TestExpectations 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/LayoutTests/TestExpectations 2021-08-10 23:19:03 UTC (rev 280870)
@@ -1505,10 +1505,6 @@
# Flaky tests at import time
imported/w3c/web-platform-tests/css/css-scoping/css-scoping-shadow-host-namespace.html [ ImageOnlyFailure ]
-# Those WPT tests are flaky when failing.
-imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1.html [ Pass Failure ]
-imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2.html [ Pass Failure ]
-
# WPT tests for custom elements
webkit.org/b/187800 imported/w3c/web-platform-tests/custom-elements/Document-createElement-svg.svg [ Skip ]
webkit.org/b/187800 imported/w3c/web-platform-tests/custom-elements/parser/parser-uses-create-an-element-for-a-token-svg.svg [ Skip ]
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (280869 => 280870)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2021-08-10 23:19:03 UTC (rev 280870)
@@ -1,5 +1,17 @@
2021-08-10 Chris Dumez <[email protected]>
+ Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
+ https://bugs.webkit.org/show_bug.cgi?id=228965
+
+ Reviewed by Darin Adler.
+
+ Rebaseline WPT tests that are now passing.
+
+ * web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt:
+ * web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt:
+
+2021-08-10 Chris Dumez <[email protected]>
+
Document.baseURI is inaccurate for iframe srcdoc documents
https://bugs.webkit.org/show_bug.cgi?id=228933
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt (280869 => 280870)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt 2021-08-10 23:19:03 UTC (rev 280870)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
+CONSOLE MESSAGE: Unable to do meta refresh due to sandboxing
-FAIL Meta refresh is blocked by the allow-scripts sandbox flag at its creation time, not when refresh comes due TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
+PASS Meta refresh is blocked by the allow-scripts sandbox flag at its creation time, not when refresh comes due
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt (280869 => 280870)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt 2021-08-10 23:19:03 UTC (rev 280870)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
+CONSOLE MESSAGE: Unable to do meta refresh due to sandboxing
-FAIL Meta refresh of the original iframe is not blocked if moved into a sandboxed iframe TypeError: Argument 1 ('node') to Node.appendChild must be an instance of Node
+PASS Meta refresh of the original iframe is not blocked if moved into a sandboxed iframe
Modified: trunk/Source/WebCore/ChangeLog (280869 => 280870)
--- trunk/Source/WebCore/ChangeLog 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/ChangeLog 2021-08-10 23:19:03 UTC (rev 280870)
@@ -1,3 +1,34 @@
+2021-08-10 Chris Dumez <[email protected]>
+
+ Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
+ https://bugs.webkit.org/show_bug.cgi?id=228965
+
+ Reviewed by Darin Adler.
+
+ Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set:
+ - https://html.spec.whatwg.org/multipage/semantics.html#shared-declarative-refresh-steps (Step 13)
+
+ Firefox and Chrome already behave this way.
+
+ No new tests, rebaselined existing tests.
+
+ * dom/Document.cpp:
+ (WebCore::Document::processMetaHttpEquiv):
+ * dom/Document.h:
+ * html/HTMLMetaElement.cpp:
+ (WebCore::HTMLMetaElement::process):
+ * loader/DocumentLoader.cpp:
+ (WebCore::DocumentLoader::responseReceived):
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::receivedFirstData):
+ (WebCore::FrameLoader::scheduleRefreshIfNeeded):
+ * loader/FrameLoader.h:
+ * loader/FrameLoaderTypes.h:
+ * loader/NavigationScheduler.cpp:
+ (WebCore::ScheduledRedirect::ScheduledRedirect):
+ (WebCore::NavigationScheduler::scheduleRedirect):
+ * loader/NavigationScheduler.h:
+
2021-08-10 Ryosuke Niwa <[email protected]>
Deploy some more smart pointers in DOMWindow.cpp
Modified: trunk/Source/WebCore/dom/Document.cpp (280869 => 280870)
--- trunk/Source/WebCore/dom/Document.cpp 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/dom/Document.cpp 2021-08-10 23:19:03 UTC (rev 280870)
@@ -3736,7 +3736,7 @@
m_hasElementUsingStyleBasedEditability = true;
}
-void Document::processHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead)
+void Document::processMetaHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead)
{
ASSERT(!equiv.isNull());
ASSERT(!content.isNull());
@@ -3781,7 +3781,7 @@
case HTTPHeaderName::Refresh:
if (frame)
- frame->loader().scheduleRefreshIfNeeded(*this, content);
+ frame->loader().scheduleRefreshIfNeeded(*this, content, IsMetaRefresh::Yes);
break;
case HTTPHeaderName::SetCookie:
Modified: trunk/Source/WebCore/dom/Document.h (280869 => 280870)
--- trunk/Source/WebCore/dom/Document.h 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/dom/Document.h 2021-08-10 23:19:03 UTC (rev 280870)
@@ -892,7 +892,7 @@
// when a meta tag is encountered during document parsing, and also when a script dynamically changes or adds a meta
// tag. This enables scripts to use meta tags to perform refreshes and set expiry dates in addition to them being
// specified in an HTML file.
- void processHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead);
+ void processMetaHttpEquiv(const String& equiv, const String& content, bool isInDocumentHead);
#if PLATFORM(IOS_FAMILY)
void processFormatDetection(const String&);
Modified: trunk/Source/WebCore/html/HTMLMetaElement.cpp (280869 => 280870)
--- trunk/Source/WebCore/html/HTMLMetaElement.cpp 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/html/HTMLMetaElement.cpp 2021-08-10 23:19:03 UTC (rev 280870)
@@ -181,7 +181,7 @@
const AtomString& httpEquivValue = attributeWithoutSynchronization(http_equivAttr);
if (!httpEquivValue.isNull())
- document().processHttpEquiv(httpEquivValue, contentValue, isDescendantOf(document().head()));
+ document().processMetaHttpEquiv(httpEquivValue, contentValue, isDescendantOf(document().head()));
}
const AtomString& HTMLMetaElement::content() const
Modified: trunk/Source/WebCore/loader/DocumentLoader.cpp (280869 => 280870)
--- trunk/Source/WebCore/loader/DocumentLoader.cpp 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/loader/DocumentLoader.cpp 2021-08-10 23:19:03 UTC (rev 280870)
@@ -927,7 +927,7 @@
auto firstPartyDomain = RegistrableDomain(response.url());
if (auto loginDomains = NetworkStorageSession::subResourceDomainsInNeedOfStorageAccessForFirstParty(firstPartyDomain)) {
if (!Quirks::hasStorageAccessForAllLoginDomains(*loginDomains, firstPartyDomain)) {
- m_frame->navigationScheduler().scheduleRedirect(document, 0, microsoftTeamsRedirectURL());
+ m_frame->navigationScheduler().scheduleRedirect(document, 0, microsoftTeamsRedirectURL(), IsMetaRefresh::No);
return;
}
}
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (280869 => 280870)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2021-08-10 23:19:03 UTC (rev 280870)
@@ -713,7 +713,7 @@
LinkLoader::loadLinksFromHeader(documentLoader.response().httpHeaderField(HTTPHeaderName::Link), document.url(), document, LinkLoader::MediaAttributeCheck::MediaAttributeEmpty);
- scheduleRefreshIfNeeded(document, documentLoader.response().httpHeaderField(HTTPHeaderName::Refresh));
+ scheduleRefreshIfNeeded(document, documentLoader.response().httpHeaderField(HTTPHeaderName::Refresh), IsMetaRefresh::No);
}
void FrameLoader::setOutgoingReferrer(const URL& url)
@@ -2968,7 +2968,7 @@
request.setIsAppInitiated(m_frame.mainFrame().loader().documentLoader()->lastNavigationWasAppInitiated());
}
-void FrameLoader::scheduleRefreshIfNeeded(Document& document, const String& content)
+void FrameLoader::scheduleRefreshIfNeeded(Document& document, const String& content, IsMetaRefresh isMetaRefresh)
{
double delay = 0;
String urlString;
@@ -2975,7 +2975,7 @@
if (parseMetaHTTPEquivRefresh(content, delay, urlString)) {
auto completedURL = urlString.isEmpty() ? document.url() : document.completeURL(urlString);
if (!completedURL.protocolIsJavaScript())
- m_frame.navigationScheduler().scheduleRedirect(document, delay, completedURL);
+ m_frame.navigationScheduler().scheduleRedirect(document, delay, completedURL, isMetaRefresh);
else {
String message = "Refused to refresh " + document.url().stringCenterEllipsizedToLength() + " to a _javascript_: URL";
document.addConsoleMessage(MessageSource::Security, MessageLevel::Error, message);
Modified: trunk/Source/WebCore/loader/FrameLoader.h (280869 => 280870)
--- trunk/Source/WebCore/loader/FrameLoader.h 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/loader/FrameLoader.h 2021-08-10 23:19:03 UTC (rev 280870)
@@ -319,7 +319,7 @@
// For subresource requests the FrameLoadType parameter has no effect and can be skipped.
void updateRequestAndAddExtraFields(ResourceRequest&, IsMainResource, FrameLoadType = FrameLoadType::Standard, ShouldUpdateAppInitiatedValue = ShouldUpdateAppInitiatedValue::Yes);
- void scheduleRefreshIfNeeded(Document&, const String& content);
+ void scheduleRefreshIfNeeded(Document&, const String& content, IsMetaRefresh);
void switchBrowsingContextsGroup();
Modified: trunk/Source/WebCore/loader/FrameLoaderTypes.h (280869 => 280870)
--- trunk/Source/WebCore/loader/FrameLoaderTypes.h 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/loader/FrameLoaderTypes.h 2021-08-10 23:19:03 UTC (rev 280870)
@@ -69,6 +69,7 @@
ReloadExpiredOnly
};
+enum class IsMetaRefresh : bool { No, Yes };
enum class WillContinueLoading : bool { No, Yes };
class PolicyCheckIdentifier {
Modified: trunk/Source/WebCore/loader/NavigationScheduler.cpp (280869 => 280870)
--- trunk/Source/WebCore/loader/NavigationScheduler.cpp 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/loader/NavigationScheduler.cpp 2021-08-10 23:19:03 UTC (rev 280870)
@@ -167,8 +167,9 @@
class ScheduledRedirect : public ScheduledURLNavigation {
public:
- ScheduledRedirect(Document& initiatingDocument, double delay, SecurityOrigin* securityOrigin, const URL& url, LockHistory lockHistory, LockBackForwardList lockBackForwardList)
+ ScheduledRedirect(Document& initiatingDocument, double delay, SecurityOrigin* securityOrigin, const URL& url, LockHistory lockHistory, LockBackForwardList lockBackForwardList, IsMetaRefresh isMetaRefresh)
: ScheduledURLNavigation(initiatingDocument, delay, securityOrigin, url, String(), lockHistory, lockBackForwardList, false, false)
+ , m_isMetaRefresh(isMetaRefresh)
{
clearUserGesture();
}
@@ -180,6 +181,13 @@
void fire(Frame& frame) override
{
+ if (m_isMetaRefresh == IsMetaRefresh::Yes) {
+ if (auto document = frame.document(); document && document->isSandboxed(SandboxAutomaticFeatures)) {
+ document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, "Unable to do meta refresh due to sandboxing"_s);
+ return;
+ }
+ }
+
UserGestureIndicator gestureIndicator { userGestureToForward() };
bool refresh = equalIgnoringFragmentIdentifier(frame.document()->url(), url());
@@ -194,6 +202,9 @@
frame.loader().changeLocation(WTFMove(frameLoadRequest));
}
+
+private:
+ IsMetaRefresh m_isMetaRefresh;
};
class ScheduledLocationChange : public ScheduledURLNavigation {
@@ -407,7 +418,7 @@
return NavigationDisabler::isNavigationAllowed(m_frame);
}
-void NavigationScheduler::scheduleRedirect(Document& initiatingDocument, double delay, const URL& url)
+void NavigationScheduler::scheduleRedirect(Document& initiatingDocument, double delay, const URL& url, IsMetaRefresh isMetaRefresh)
{
if (!shouldScheduleNavigation(url))
return;
@@ -419,7 +430,7 @@
// We want a new back/forward list item if the refresh timeout is > 1 second.
if (!m_redirect || delay <= m_redirect->delay()) {
auto lockBackForwardList = delay <= 1 ? LockBackForwardList::Yes : LockBackForwardList::No;
- schedule(makeUnique<ScheduledRedirect>(initiatingDocument, delay, &m_frame.document()->securityOrigin(), url, LockHistory::Yes, lockBackForwardList));
+ schedule(makeUnique<ScheduledRedirect>(initiatingDocument, delay, &m_frame.document()->securityOrigin(), url, LockHistory::Yes, lockBackForwardList, isMetaRefresh));
}
}
Modified: trunk/Source/WebCore/loader/NavigationScheduler.h (280869 => 280870)
--- trunk/Source/WebCore/loader/NavigationScheduler.h 2021-08-10 22:41:13 UTC (rev 280869)
+++ trunk/Source/WebCore/loader/NavigationScheduler.h 2021-08-10 23:19:03 UTC (rev 280870)
@@ -54,7 +54,7 @@
bool redirectScheduledDuringLoad();
bool locationChangePending();
- void scheduleRedirect(Document& initiatingDocument, double delay, const URL&);
+ void scheduleRedirect(Document& initiatingDocument, double delay, const URL&, IsMetaRefresh);
void scheduleLocationChange(Document& initiatingDocument, SecurityOrigin&, const URL&, const String& referrer, LockHistory = LockHistory::Yes, LockBackForwardList = LockBackForwardList::Yes, CompletionHandler<void()>&& = [] { });
void scheduleFormSubmission(Ref<FormSubmission>&&);
void scheduleRefresh(Document& initiatingDocument);
