- Revision
- 141938
- Author
- [email protected]
- Date
- 2013-02-05 14:39:00 -0800 (Tue, 05 Feb 2013)
Log Message
Continue making XSSAuditor thread safe: Remove dependency on the parser's tokenizer
https://bugs.webkit.org/show_bug.cgi?id=108666
Reviewed by Adam Barth.
This is the final dependency on the parser, so we remove that as well. Yay!
No new tests because no new functionality.
* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::HTMLDocumentParser):
(WebCore::HTMLDocumentParser::pumpTokenizer): Pass m_tokenizer->shouldAllowCDATA()
* html/parser/XSSAuditor.cpp:
(WebCore::XSSAuditor::XSSAuditor): Remove isMainThread() check because we have one in init() anyway.
Move m_isEnabled and m_documentURL initialization to init() because we have a Document* there.
(WebCore::XSSAuditor::init):
(WebCore::XSSAuditor::filterToken):
(WebCore::XSSAuditor::filterStartToken):
(WebCore::XSSAuditor::filterEndToken):
(WebCore::XSSAuditor::filterScriptToken):
(WebCore::XSSAuditor::decodedSnippetForJavaScript):
* html/parser/XSSAuditor.h:
(WebCore::FilterTokenRequest::FilterTokenRequest):
(FilterTokenRequest):
(XSSAuditor):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (141937 => 141938)
--- trunk/Source/WebCore/ChangeLog 2013-02-05 22:37:18 UTC (rev 141937)
+++ trunk/Source/WebCore/ChangeLog 2013-02-05 22:39:00 UTC (rev 141938)
@@ -1,3 +1,31 @@
+2013-02-05 Tony Gentilcore <[email protected]>
+
+ Continue making XSSAuditor thread safe: Remove dependency on the parser's tokenizer
+ https://bugs.webkit.org/show_bug.cgi?id=108666
+
+ Reviewed by Adam Barth.
+
+ This is the final dependency on the parser, so we remove that as well. Yay!
+
+ No new tests because no new functionality.
+
+ * html/parser/HTMLDocumentParser.cpp:
+ (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+ (WebCore::HTMLDocumentParser::pumpTokenizer): Pass m_tokenizer->shouldAllowCDATA()
+ * html/parser/XSSAuditor.cpp:
+ (WebCore::XSSAuditor::XSSAuditor): Remove isMainThread() check because we have one in init() anyway.
+ Move m_isEnabled and m_documentURL initialization to init() because we have a Document* there.
+ (WebCore::XSSAuditor::init):
+ (WebCore::XSSAuditor::filterToken):
+ (WebCore::XSSAuditor::filterStartToken):
+ (WebCore::XSSAuditor::filterEndToken):
+ (WebCore::XSSAuditor::filterScriptToken):
+ (WebCore::XSSAuditor::decodedSnippetForJavaScript):
+ * html/parser/XSSAuditor.h:
+ (WebCore::FilterTokenRequest::FilterTokenRequest):
+ (FilterTokenRequest):
+ (XSSAuditor):
+
2013-02-05 Enrica Casucci <[email protected]>
Make baseWritingDirectionForSelectionStart available to all platforms in the Editor class.
Modified: trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp (141937 => 141938)
--- trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp 2013-02-05 22:37:18 UTC (rev 141937)
+++ trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp 2013-02-05 22:39:00 UTC (rev 141938)
@@ -82,7 +82,6 @@
, m_scriptRunner(HTMLScriptRunner::create(document, this))
, m_treeBuilder(HTMLTreeBuilder::create(this, document, reportErrors, m_options))
, m_parserScheduler(HTMLParserScheduler::create(this))
- , m_xssAuditor(this)
, m_xssAuditorDelegate(document)
#if ENABLE(THREADED_HTML_PARSER)
, m_weakFactory(this)
@@ -102,7 +101,6 @@
, m_token(adoptPtr(new HTMLToken))
, m_tokenizer(HTMLTokenizer::create(m_options))
, m_treeBuilder(HTMLTreeBuilder::create(this, fragment, contextElement, scriptingPermission, m_options))
- , m_xssAuditor(this)
, m_xssAuditorDelegate(fragment->document())
#if ENABLE(THREADED_HTML_PARSER)
, m_weakFactory(this)
@@ -378,8 +376,7 @@
// We do not XSS filter innerHTML, which means we (intentionally) fail
// http/tests/security/xssAuditor/dom-write-innerHTML.html
- OwnPtr<DidBlockScriptRequest> request = m_xssAuditor.filterToken(FilterTokenRequest(token(), m_sourceTracker, document()->decoder()));
- if (request)
+ if (OwnPtr<DidBlockScriptRequest> request = m_xssAuditor.filterToken(FilterTokenRequest(token(), m_sourceTracker, document()->decoder(), m_tokenizer->shouldAllowCDATA())))
m_xssAuditorDelegate.didBlockScript(request.release());
}
Modified: trunk/Source/WebCore/html/parser/XSSAuditor.cpp (141937 => 141938)
--- trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2013-02-05 22:37:18 UTC (rev 141937)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2013-02-05 22:39:00 UTC (rev 141938)
@@ -174,21 +174,12 @@
return workingString;
}
-XSSAuditor::XSSAuditor(HTMLDocumentParser* parser)
- : m_parser(parser)
- , m_documentURL(parser->document()->url())
- , m_isEnabled(false)
+XSSAuditor::XSSAuditor()
+ : m_isEnabled(false)
, m_xssProtection(XSSProtectionEnabled)
, m_state(Uninitialized)
- , m_shouldAllowCDATA(false)
, m_scriptTagNestingLevel(0)
{
- ASSERT(isMainThread());
- ASSERT(m_parser);
- if (Frame* frame = parser->document()->frame()) {
- if (Settings* settings = frame->settings())
- m_isEnabled = settings->xssAuditorEnabled();
- }
// Although tempting to call init() at this point, the various objects
// we want to reference might not all have been constructed yet.
}
@@ -204,9 +195,15 @@
ASSERT(m_state == Uninitialized);
m_state = Initialized;
+ if (Frame* frame = document->frame())
+ if (Settings* settings = frame->settings())
+ m_isEnabled = settings->xssAuditorEnabled();
+
if (!m_isEnabled)
return;
+ m_documentURL = document->url();
+
// In theory, the Document could have detached from the Frame after the
// XSSAuditor was constructed.
if (!document->frame()) {
@@ -291,7 +288,7 @@
if (request.token.type() == HTMLTokenTypes::Character)
didBlockScript = filterCharacterToken(request);
else if (request.token.type() == HTMLTokenTypes::EndTag)
- filterEndToken(request.token);
+ filterEndToken(request);
}
if (didBlockScript) {
@@ -313,7 +310,7 @@
if (hasName(request.token, scriptTag)) {
didBlockScript |= filterScriptToken(request);
- ASSERT(m_shouldAllowCDATA || !m_scriptTagNestingLevel);
+ ASSERT(request.shouldAllowCDATA || !m_scriptTagNestingLevel);
m_scriptTagNestingLevel++;
} else if (hasName(request.token, objectTag))
didBlockScript |= filterObjectToken(request);
@@ -335,12 +332,12 @@
return didBlockScript;
}
-void XSSAuditor::filterEndToken(HTMLToken& token)
+void XSSAuditor::filterEndToken(const FilterTokenRequest& request)
{
ASSERT(m_scriptTagNestingLevel);
- if (hasName(token, scriptTag)) {
+ if (hasName(request.token, scriptTag)) {
m_scriptTagNestingLevel--;
- ASSERT(m_shouldAllowCDATA || !m_scriptTagNestingLevel);
+ ASSERT(request.shouldAllowCDATA || !m_scriptTagNestingLevel);
}
}
@@ -361,7 +358,6 @@
ASSERT(hasName(request.token, scriptTag));
m_cachedDecodedSnippet = decodedSnippetForName(request);
- m_shouldAllowCDATA = m_parser->tokenizer()->shouldAllowCDATA();
bool didBlockScript = false;
if (isContainedInRequest(decodedSnippetForName(request))) {
@@ -588,7 +584,7 @@
// Under SVG/XML rules, only HTML comment syntax matters and the parser returns
// these as a separate comment tokens. Having consumed whitespace, we need not look
// further for these.
- if (m_shouldAllowCDATA)
+ if (request.shouldAllowCDATA)
break;
// Under HTML rules, both the HTML and JS comment synatx matters, and the HTML
@@ -615,7 +611,7 @@
// not stopping inside a (possibly multiply encoded) %-esacpe sequence by breaking on
// whitespace only. We should have enough text in these cases to avoid false positives.
for (foundPosition = startPosition; foundPosition < endPosition; foundPosition++) {
- if (!m_shouldAllowCDATA) {
+ if (!request.shouldAllowCDATA) {
if (startsSingleLineCommentAt(string, foundPosition) || startsMultiLineCommentAt(string, foundPosition)) {
foundPosition += 2;
break;
Modified: trunk/Source/WebCore/html/parser/XSSAuditor.h (141937 => 141938)
--- trunk/Source/WebCore/html/parser/XSSAuditor.h 2013-02-05 22:37:18 UTC (rev 141937)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.h 2013-02-05 22:39:00 UTC (rev 141938)
@@ -40,21 +40,23 @@
class TextResourceDecoder;
struct FilterTokenRequest {
- FilterTokenRequest(HTMLToken& token, HTMLSourceTracker& sourceTracker, const TextResourceDecoder* decoder)
+ FilterTokenRequest(HTMLToken& token, HTMLSourceTracker& sourceTracker, const TextResourceDecoder* decoder, bool shouldAllowCDATA)
: token(token)
, sourceTracker(sourceTracker)
, decoder(decoder)
+ , shouldAllowCDATA(shouldAllowCDATA)
{ }
HTMLToken& token;
HTMLSourceTracker& sourceTracker;
const TextResourceDecoder* decoder;
+ bool shouldAllowCDATA;
};
class XSSAuditor {
WTF_MAKE_NONCOPYABLE(XSSAuditor);
public:
- explicit XSSAuditor(HTMLDocumentParser*);
+ XSSAuditor();
void init(Document*);
PassOwnPtr<DidBlockScriptRequest> filterToken(const FilterTokenRequest&);
@@ -74,7 +76,7 @@
};
bool filterStartToken(const FilterTokenRequest&);
- void filterEndToken(HTMLToken&);
+ void filterEndToken(const FilterTokenRequest&);
bool filterCharacterToken(const FilterTokenRequest&);
bool filterScriptToken(const FilterTokenRequest&);
bool filterObjectToken(const FilterTokenRequest&);
@@ -97,8 +99,6 @@
bool isContainedInRequest(const String&);
bool isLikelySafeResource(const String& url);
- // FIXME: Remove this dependency.
- HTMLDocumentParser* m_parser;
KURL m_documentURL;
bool m_isEnabled;
XSSProtectionDisposition m_xssProtection;
@@ -111,7 +111,6 @@
State m_state;
String m_cachedDecodedSnippet;
- bool m_shouldAllowCDATA;
unsigned m_scriptTagNestingLevel;
KURL m_reportURL;
};
