Title: [125222] trunk
- Revision
- 125222
- Author
- [email protected]
- Date
- 2012-08-09 16:59:52 -0700 (Thu, 09 Aug 2012)
Log Message
Sandboxing view source documents is ineffective
https://bugs.webkit.org/show_bug.cgi?id=93660
Reviewed by Eric Seidel.
Prior to this patch, Document::setIsViewSource changed the
SecurityOrigin object on Document but didn't update the copy on
DOMWindow. As a consequence, the security checks that use the copy on
DOMWindow didn't notice the change and acted as if the document wasn't
sandboxed.
This bug wasn't present for most view source documents because
HTMLViewSourceDocument sets the flag in its constructor. However, for
view source documents created by the XMLTreeViewer, the bit was set at
the end of parsing rather than during construction.
This mechansim is really more of a mitigation than an important
security check, and I was tempted to remove the sandboxing entirely
given that sandboxing a document at the end of parsing isn't overly
effective anyway. However, we can worry about that issue in a future
patch.
For the time being, this patch just synchronizes DOMWindow and
Document's copy of the SecurityOrigin. The long-term solution here, of
course, is to keep working on fixing
https://bugs.webkit.org/show_bug.cgi?id=75793, which this patch gets us
one (small) step closer to fixing.
* dom/Document.cpp:
(WebCore::Document::setIsViewSource):
Modified Paths
Added Paths
Removed Paths
Diff
Deleted: trunk/LayoutTests/http/tests/xmlviewer/extensions-api-expected.txt (125221 => 125222)
--- trunk/LayoutTests/http/tests/xmlviewer/extensions-api-expected.txt 2012-08-09 23:49:49 UTC (rev 125221)
+++ trunk/LayoutTests/http/tests/xmlviewer/extensions-api-expected.txt 2012-08-09 23:59:52 UTC (rev 125222)
@@ -1,3 +0,0 @@
-Tests extensions hooks in xml viewer.
-
-SUCCESS
Deleted: trunk/LayoutTests/http/tests/xmlviewer/extensions-api.html (125221 => 125222)
--- trunk/LayoutTests/http/tests/xmlviewer/extensions-api.html 2012-08-09 23:49:49 UTC (rev 125221)
+++ trunk/LayoutTests/http/tests/xmlviewer/extensions-api.html 2012-08-09 23:59:52 UTC (rev 125222)
@@ -1,40 +0,0 @@
-<html>
-<head>
- <script>
- if (window.testRunner) {
- testRunner.dumpAsText();
- testRunner.setCanOpenWindows();
- testRunner.waitUntilDone();
- }
-
- var xmlWindow;
-
- function print(str)
- {
- document.getElementById('output').textContent = str;
- xmlWindow.close();
- testRunner.notifyDone();
- }
-
- function checkSourceXML()
- {
- var sourceXML = xmlWindow.document.getElementById('webkit-xml-viewer-source-xml');
- if (sourceXML && sourceXML.firstChild.nodeName == 'root')
- print('SUCCESS');
- else
- print('FAIL');
- }
-
- function onload()
- {
- xmlWindow = window.open('resources/sample.xml', "XMLViewerTestWindow");
- xmlWindow._onAfterWebkitXMLViewerLoaded_ = checkSourceXML;
- }
-
- </script>
-</head>
-<body _onload_="onload();">
- <p>Tests extensions hooks in xml viewer.</p>
- <div id='output'></div>
-</body>
-</html>
Copied: trunk/LayoutTests/xmlviewer/extensions-api-expected.txt (from rev 125221, trunk/LayoutTests/http/tests/xmlviewer/extensions-api-expected.txt) (0 => 125222)
--- trunk/LayoutTests/xmlviewer/extensions-api-expected.txt (rev 0)
+++ trunk/LayoutTests/xmlviewer/extensions-api-expected.txt 2012-08-09 23:59:52 UTC (rev 125222)
@@ -0,0 +1,3 @@
+Tests extensions hooks in xml viewer.
+
+SUCCESS
Copied: trunk/LayoutTests/xmlviewer/extensions-api.html (from rev 125221, trunk/LayoutTests/http/tests/xmlviewer/extensions-api.html) (0 => 125222)
--- trunk/LayoutTests/xmlviewer/extensions-api.html (rev 0)
+++ trunk/LayoutTests/xmlviewer/extensions-api.html 2012-08-09 23:59:52 UTC (rev 125222)
@@ -0,0 +1,40 @@
+<html>
+<head>
+ <script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.setCanOpenWindows();
+ testRunner.waitUntilDone();
+ }
+
+ var xmlWindow;
+
+ function print(str)
+ {
+ document.getElementById('output').textContent = str;
+ xmlWindow.close();
+ testRunner.notifyDone();
+ }
+
+ function checkSourceXML()
+ {
+ var sourceXML = xmlWindow.document.getElementById('webkit-xml-viewer-source-xml');
+ if (sourceXML && sourceXML.firstChild.nodeName == 'root')
+ print('SUCCESS');
+ else
+ print('FAIL');
+ }
+
+ function onload()
+ {
+ xmlWindow = window.open('resources/sample.xml', "XMLViewerTestWindow");
+ xmlWindow._onAfterWebkitXMLViewerLoaded_ = checkSourceXML;
+ }
+
+ </script>
+</head>
+<body _onload_="onload();">
+ <p>Tests extensions hooks in xml viewer.</p>
+ <div id='output'></div>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (125221 => 125222)
--- trunk/Source/WebCore/ChangeLog 2012-08-09 23:49:49 UTC (rev 125221)
+++ trunk/Source/WebCore/ChangeLog 2012-08-09 23:59:52 UTC (rev 125222)
@@ -1,3 +1,36 @@
+2012-08-09 Adam Barth <[email protected]>
+
+ Sandboxing view source documents is ineffective
+ https://bugs.webkit.org/show_bug.cgi?id=93660
+
+ Reviewed by Eric Seidel.
+
+ Prior to this patch, Document::setIsViewSource changed the
+ SecurityOrigin object on Document but didn't update the copy on
+ DOMWindow. As a consequence, the security checks that use the copy on
+ DOMWindow didn't notice the change and acted as if the document wasn't
+ sandboxed.
+
+ This bug wasn't present for most view source documents because
+ HTMLViewSourceDocument sets the flag in its constructor. However, for
+ view source documents created by the XMLTreeViewer, the bit was set at
+ the end of parsing rather than during construction.
+
+ This mechansim is really more of a mitigation than an important
+ security check, and I was tempted to remove the sandboxing entirely
+ given that sandboxing a document at the end of parsing isn't overly
+ effective anyway. However, we can worry about that issue in a future
+ patch.
+
+ For the time being, this patch just synchronizes DOMWindow and
+ Document's copy of the SecurityOrigin. The long-term solution here, of
+ course, is to keep working on fixing
+ https://bugs.webkit.org/show_bug.cgi?id=75793, which this patch gets us
+ one (small) step closer to fixing.
+
+ * dom/Document.cpp:
+ (WebCore::Document::setIsViewSource):
+
2012-08-09 Benjamin Poulain <[email protected]>
Append the unit in place when generating the text value of a CSSPrimitiveValue
Modified: trunk/Source/WebCore/dom/Document.cpp (125221 => 125222)
--- trunk/Source/WebCore/dom/Document.cpp 2012-08-09 23:49:49 UTC (rev 125221)
+++ trunk/Source/WebCore/dom/Document.cpp 2012-08-09 23:59:52 UTC (rev 125222)
@@ -2043,6 +2043,7 @@
return;
setSecurityOrigin(SecurityOrigin::createUnique());
+ didUpdateSecurityOrigin();
}
void Document::combineCSSFeatureFlags()
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
