Diff
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (288541 => 288542)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2022-01-25 07:00:01 UTC (rev 288542)
@@ -1,3 +1,12 @@
+2022-01-24 Youenn Fablet <[email protected]>
+
+ A sandboxed document should not reuse its service worker client ID
+ https://bugs.webkit.org/show_bug.cgi?id=235310
+
+ Reviewed by Alex Christensen.
+
+ * web-platform-tests/service-workers/service-worker/clients-get-resultingClientId.https-expected.txt:
+
2022-01-24 Yusuke Suzuki <[email protected]>
[JSC] Support import assertion syntax
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/clients-get-resultingClientId.https-expected.txt (288541 => 288542)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/clients-get-resultingClientId.https-expected.txt 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/clients-get-resultingClientId.https-expected.txt 2022-01-25 07:00:01 UTC (rev 288542)
@@ -2,7 +2,7 @@
PASS global setup
PASS get(resultingClientId) for same-origin document
PASS get(resultingClientId) on cross-origin redirect
-FAIL get(resultingClientId) for document sandboxed by CSP header assert_equals: promiseValue expected "undefinedValue" but got "client"
+PASS get(resultingClientId) for document sandboxed by CSP header
PASS get(resultingClientId) for document sandboxed by CSP header with allow-same-origin
PASS global cleanup
Modified: trunk/Source/WebCore/ChangeLog (288541 => 288542)
--- trunk/Source/WebCore/ChangeLog 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/Source/WebCore/ChangeLog 2022-01-25 07:00:01 UTC (rev 288542)
@@ -1,3 +1,19 @@
+2022-01-24 Youenn Fablet <[email protected]>
+
+ A sandboxed document should not reuse its service worker client ID
+ https://bugs.webkit.org/show_bug.cgi?id=235310
+
+ Reviewed by Alex Christensen.
+
+ Create a new identifier when the current identifier, already exposed to service workers, cannot be reused.
+ Covered by updated test.
+
+ * dom/Document.cpp:
+ * dom/Document.h:
+ * dom/ScriptExecutionContext.cpp:
+ * dom/ScriptExecutionContext.h:
+ * loader/DocumentLoader.cpp:
+
2022-01-24 Mark Lam <[email protected]>
Rename Vector and FixedVector::findMatching to findIf to match stl naming.
Modified: trunk/Source/WebCore/dom/Document.cpp (288541 => 288542)
--- trunk/Source/WebCore/dom/Document.cpp 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/Source/WebCore/dom/Document.cpp 2022-01-25 07:00:01 UTC (rev 288542)
@@ -631,6 +631,13 @@
InspectorInstrumentation::addEventListenersToNode(*this);
}
+void Document::createNewIdentifier()
+{
+ removeFromDocumentsMap();
+ regenerateIdentifier();
+ addToDocumentsMap();
+}
+
Ref<Document> Document::create(Document& contextDocument)
{
auto document = adoptRef(*new Document(nullptr, contextDocument.m_settings, URL(), { }));
Modified: trunk/Source/WebCore/dom/Document.h (288541 => 288542)
--- trunk/Source/WebCore/dom/Document.h 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/Source/WebCore/dom/Document.h 2022-01-25 07:00:01 UTC (rev 288542)
@@ -1674,6 +1674,8 @@
WEBCORE_EXPORT ModalContainerObserver* modalContainerObserver();
ModalContainerObserver* modalContainerObserverIfExists() const;
+ void createNewIdentifier();
+
protected:
enum ConstructionFlags { Synthesized = 1, NonRenderedPlaceholder = 1 << 1 };
WEBCORE_EXPORT Document(Frame*, const Settings&, const URL&, DocumentClasses = { }, unsigned constructionFlags = 0, ScriptExecutionContextIdentifier = { });
Modified: trunk/Source/WebCore/dom/ScriptExecutionContext.cpp (288541 => 288542)
--- trunk/Source/WebCore/dom/ScriptExecutionContext.cpp 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/Source/WebCore/dom/ScriptExecutionContext.cpp 2022-01-25 07:00:01 UTC (rev 288542)
@@ -119,6 +119,19 @@
allScriptExecutionContextsMap().add(m_identifier, this);
}
+void ScriptExecutionContext::regenerateIdentifier()
+{
+ Locker locker { allScriptExecutionContextsMapLock };
+
+ ASSERT(allScriptExecutionContextsMap().contains(m_identifier));
+ allScriptExecutionContextsMap().remove(m_identifier);
+
+ m_identifier = ScriptExecutionContextIdentifier::generate();
+
+ ASSERT(!allScriptExecutionContextsMap().contains(m_identifier));
+ allScriptExecutionContextsMap().add(m_identifier, this);
+}
+
void ScriptExecutionContext::removeFromContextsMap()
{
Locker locker { allScriptExecutionContextsMapLock };
Modified: trunk/Source/WebCore/dom/ScriptExecutionContext.h (288541 => 288542)
--- trunk/Source/WebCore/dom/ScriptExecutionContext.h 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/Source/WebCore/dom/ScriptExecutionContext.h 2022-01-25 07:00:01 UTC (rev 288542)
@@ -307,6 +307,7 @@
bool hasPendingActivity() const;
void removeFromContextsMap();
void removeRejectedPromiseTracker();
+ void regenerateIdentifier();
private:
// The following addMessage function is deprecated.
Modified: trunk/Source/WebCore/loader/DocumentLoader.cpp (288541 => 288542)
--- trunk/Source/WebCore/loader/DocumentLoader.cpp 2022-01-25 06:15:32 UTC (rev 288541)
+++ trunk/Source/WebCore/loader/DocumentLoader.cpp 2022-01-25 07:00:01 UTC (rev 288542)
@@ -1244,6 +1244,10 @@
if (shouldUseActiveServiceWorkerFromParent(document, *parent))
document.setActiveServiceWorker(parent->activeServiceWorker());
}
+ } else if (m_resultingClientId) {
+ // In case document has a unique origin, say due to sandboxing, we should have created a new context, let's create a new identifier instead.
+ if (document.securityOrigin().isUnique())
+ document.createNewIdentifier();
}
if (m_frame->document()->activeServiceWorker() || document.url().protocolIsInHTTPFamily() || (document.page() && document.page()->isServiceWorkerPage()))
