Diff
Modified: trunk/Source/WebKit/qt/Api/qwebsecurityorigin.cpp (153515 => 153516)
--- trunk/Source/WebKit/qt/Api/qwebsecurityorigin.cpp 2013-07-31 09:44:35 UTC (rev 153515)
+++ trunk/Source/WebKit/qt/Api/qwebsecurityorigin.cpp 2013-07-31 11:56:06 UTC (rev 153516)
@@ -25,6 +25,7 @@
#include "KURL.h"
#include "SchemeRegistry.h"
#include "SecurityOrigin.h"
+#include "SecurityPolicy.h"
#include "qwebdatabase.h"
#include "qwebdatabase_p.h"
#include "qwebsecurityorigin_p.h"
@@ -265,3 +266,35 @@
}
return list;
}
+
+
+/*!
+ Allows contruction of QWebSecurityOrigin() as per the specified \a url.
+*/
+QWebSecurityOrigin::QWebSecurityOrigin(const QUrl& url)
+{
+ d = new QWebSecurityOriginPrivate(SecurityOrigin::create(KURL(url)));
+}
+
+/*!
+ Allows the origin to access the specified \a host using the specified \a scheme.
+ Specifying AllowSubdomains in \a subdomainSetting will allow the source origin to access
+ the \a host's subdomains as well, whereas passing DisallowSubdomains would prevent this.
+
+ Such cross origin requests are otherwise restricted as per the same-origin-policy.
+*/
+void QWebSecurityOrigin::addAccessWhitelistEntry(const QString& scheme, const QString& host, SubdomainSetting subdomainSetting)
+{
+ SecurityPolicy::addOriginAccessWhitelistEntry(*(d->origin), scheme, host, subdomainSetting == AllowSubdomains);
+}
+
+/*!
+ Removes the origin's whitelisted access to the specified \a host using the specified \a scheme
+ as per the specified \a subdomainSetting.
+*/
+void QWebSecurityOrigin::removeAccessWhitelistEntry(const QString& scheme, const QString& host, SubdomainSetting subdomainSetting)
+{
+ SecurityPolicy::removeOriginAccessWhitelistEntry(*(d->origin), scheme, host, subdomainSetting == AllowSubdomains);
+}
+
+
Modified: trunk/Source/WebKit/qt/Api/qwebsecurityorigin.h (153515 => 153516)
--- trunk/Source/WebKit/qt/Api/qwebsecurityorigin.h 2013-07-31 09:44:35 UTC (rev 153515)
+++ trunk/Source/WebKit/qt/Api/qwebsecurityorigin.h 2013-07-31 11:56:06 UTC (rev 153516)
@@ -36,11 +36,20 @@
class QWEBKIT_EXPORT QWebSecurityOrigin {
public:
+ enum SubdomainSetting {
+ AllowSubdomains,
+ DisallowSubdomains
+ };
+
static QList<QWebSecurityOrigin> allOrigins();
static void addLocalScheme(const QString& scheme);
static void removeLocalScheme(const QString& scheme);
static QStringList localSchemes();
+ void addAccessWhitelistEntry(const QString& scheme, const QString& host, SubdomainSetting subdomainSetting);
+ void removeAccessWhitelistEntry(const QString& scheme, const QString& host, SubdomainSetting subdomainSetting);
+
+ explicit QWebSecurityOrigin(const QUrl& url);
~QWebSecurityOrigin();
QString scheme() const;
Modified: trunk/Source/WebKit/qt/Api/qwebsecurityorigin_p.h (153515 => 153516)
--- trunk/Source/WebKit/qt/Api/qwebsecurityorigin_p.h 2013-07-31 09:44:35 UTC (rev 153515)
+++ trunk/Source/WebKit/qt/Api/qwebsecurityorigin_p.h 2013-07-31 11:56:06 UTC (rev 153516)
@@ -25,7 +25,7 @@
class QWebSecurityOriginPrivate : public QSharedData {
public:
- QWebSecurityOriginPrivate(WebCore::SecurityOrigin* o)
+ QWebSecurityOriginPrivate(WTF::PassRefPtr<WebCore::SecurityOrigin> o)
{
Q_ASSERT(o);
origin = o;
Modified: trunk/Source/WebKit/qt/ChangeLog (153515 => 153516)
--- trunk/Source/WebKit/qt/ChangeLog 2013-07-31 09:44:35 UTC (rev 153515)
+++ trunk/Source/WebKit/qt/ChangeLog 2013-07-31 11:56:06 UTC (rev 153516)
@@ -1,3 +1,32 @@
+2013-07-31 Deepjyoti Saha <[email protected]>
+
+ [Qt] Add interface API for origin whitelisting
+ https://bugs.webkit.org/show_bug.cgi?id=117823
+
+ Reviewed by Jocelyn Turcotte.
+
+ Adding interface APIs in QWebSecurityOrigin to add and remove whiteList entires.
+
+ Re-used most of the test cases written by Carol Szabo <[email protected]>
+ for https://bugs.webkit.org/show_bug.cgi?id=31875 and added the same.
+
+ * Api/qwebsecurityorigin.cpp:
+ (QWebSecurityOrigin::addAccessWhitelistEntry):
+ (QWebSecurityOrigin::removeAccessWhitelistEntry):
+ * Api/qwebsecurityorigin.h:
+ * tests/qwebsecurityorigin: Added.
+ * tests/qwebsecurityorigin/qwebsecurityorigin.pro: Added.
+ * tests/qwebsecurityorigin/resources: Added.
+ * tests/qwebsecurityorigin/resources/test.html: Added.
+ * tests/qwebsecurityorigin/tst_qwebsecurityorigin.cpp: Added.
+ (tst_QWebSecurityOrigin::tst_QWebSecurityOrigin):
+ (tst_QWebSecurityOrigin::~tst_QWebSecurityOrigin):
+ (tst_QWebSecurityOrigin::init):
+ (tst_QWebSecurityOrigin::cleanup):
+ (tst_QWebSecurityOrigin::whiteList_data):
+ (tst_QWebSecurityOrigin::whiteList):
+ * tests/qwebsecurityorigin/tst_qwebsecurityorigin.qrc: Added.
+
2013-07-27 Jacky Jiang <[email protected]>
Replace all uses of GraphicsLayer::create function with the one that takes a GraphicsLayerFactory
Added: trunk/Source/WebKit/qt/tests/qwebsecurityorigin/qwebsecurityorigin.pro (0 => 153516)
--- trunk/Source/WebKit/qt/tests/qwebsecurityorigin/qwebsecurityorigin.pro (rev 0)
+++ trunk/Source/WebKit/qt/tests/qwebsecurityorigin/qwebsecurityorigin.pro 2013-07-31 11:56:06 UTC (rev 153516)
@@ -0,0 +1,2 @@
+include(../tests.pri)
+exists($${TARGET}.qrc):RESOURCES += $${TARGET}.qrc
Added: trunk/Source/WebKit/qt/tests/qwebsecurityorigin/resources/test.html (0 => 153516)
--- trunk/Source/WebKit/qt/tests/qwebsecurityorigin/resources/test.html (rev 0)
+++ trunk/Source/WebKit/qt/tests/qwebsecurityorigin/resources/test.html 2013-07-31 11:56:06 UTC (rev 153516)
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>QWebSecurityOrigin test page</title>
+ <script Language="_javascript_">
+ function runTest(url)
+ {
+ var result = "";
+ function trace(point)
+ {
+ var el = document.createElement("P");
+ el.innerHTML = point + ": Result is:\"" + result + "\""
+ document.getElementById("Console").appendChild(el);
+ }
+ try {
+ var xmlhttp = new XMLHttpRequest();
+ xmlhttp.open('GET',url, false);
+ xmlhttp._onreadystatechange_ = done;
+ xmlhttp._onerror_ = error;
+ xmlhttp.send(null);
+ result = xmlhttp.responseText;
+ } catch (e) {
+ if (result == "") {
+ result = e;
+ trace("Catch1");
+ } else
+ trace("Catch2");
+ }
+
+ function done()
+ {
+ if (result.length < 5) {
+ result = "" + xmlhttp.readyState;
+ trace("Done1");
+ } else
+ trace("Done2");
+ }
+ function error()
+ {
+ result = "FAILED";
+ trace("Error");
+ }
+ trace("Exit");
+ return result == "Test";
+ }
+ </script>
+ </head>
+ <body>
+ <input type="button" _onclick_="_javascript_:alert(runTest('http://www.google.com'))" value="Run Test"/><br/>
+ <div id="Console"/>
+ </body>
+ </html>
\ No newline at end of file
Added: trunk/Source/WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.cpp (0 => 153516)
--- trunk/Source/WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.cpp (rev 0)
+++ trunk/Source/WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.cpp 2013-07-31 11:56:06 UTC (rev 153516)
@@ -0,0 +1,192 @@
+/*
+ Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ Copyright (C) 2013 Cisco Systems, Inc. All rights reserved.
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB. If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+*/
+
+
+#include <QDebug>
+#include <QNetworkReply>
+#include <QtTest>
+#include <qwebframe.h>
+#include <qwebpage.h>
+#include <qwebsecurityorigin.h>
+#include <qwebview.h>
+
+class tst_QWebSecurityOrigin : public QObject {
+ Q_OBJECT
+public:
+ tst_QWebSecurityOrigin();
+ virtual ~tst_QWebSecurityOrigin();
+
+private slots:
+ void init();
+ void cleanup();
+ void whiteList_data();
+ void whiteList();
+private:
+ QWebView* m_view;
+ QWebPage* m_page;
+};
+
+tst_QWebSecurityOrigin::tst_QWebSecurityOrigin()
+{
+}
+
+tst_QWebSecurityOrigin::~tst_QWebSecurityOrigin()
+{
+}
+
+void tst_QWebSecurityOrigin::init()
+{
+ m_view = new QWebView();
+ m_page = m_view->page();
+}
+
+void tst_QWebSecurityOrigin::cleanup()
+{
+ delete m_view;
+}
+
+void tst_QWebSecurityOrigin::whiteList_data()
+{
+ QTest::addColumn<QString>("source");
+ QTest::addColumn<QString>("scheme");
+ QTest::addColumn<QString>("host");
+ QTest::addColumn<bool>("includeSubDomains");
+ QTest::addColumn<QString>("testUrl");
+ QTest::addColumn<bool>("successBeforeAdd");
+ QTest::addColumn<bool>("successAfterAdd");
+ QTest::addColumn<bool>("successAfterRemove");
+
+ QTest::newRow("scheme") << "http://www.source.com" << "https" << "www.target.com" << false << "https://www.target.com/other" << false << true << false;
+ QTest::newRow("schemeFail") << "http://www.source.com" << "https" << "www.target.com" << false << "http://www.target.com/other" << false << false << false;
+ QTest::newRow("schemeSubDom") << "http://www.source.com" << "https" << "target.com" << true << "https://www.target.com/other" << false << true << false;
+ QTest::newRow("schemeSubDomFail") << "http://www.source.com" << "https" << "target.com" << true << "https://wwwtarget.com/other" << false << false << false;
+ QTest::newRow("schemeSubDomFail") << "http://www.source.com" << "https" << "target.com" << true << "http://www.target.com/other" << false << false << false;
+ QTest::newRow("host") << "http://www.source.com" << "http" << "www.target.com" << false << "http://www.target.com/target" << false << true << false;
+ QTest::newRow("hostFail") << "http://www.source.com" << "http" << "www.target.com" << false << "http://www.newtarget.com" << false << false << false;
+ QTest::newRow("hostSubDom") << "http://www.source.com" << "http" << "target.com" << true << "http://www.new.target.com" << false << true << false;
+ QTest::newRow("hostSubDomFail") << "http://www.source.com" << "http" << "target.com" << false << "http://www.new.target.com" << false << false << false;
+ QTest::newRow("hostSubDomFailCountry") << "http://www.source.com" << "http" << "target.com" << true << "http://www.target.com.tw" << false << false << false;
+}
+
+class CannedResponseNetworkReply: public QNetworkReply {
+ Q_OBJECT
+public:
+ CannedResponseNetworkReply(QObject* parent, QNetworkAccessManager::Operation op, const QNetworkRequest& req, const QBuffer& body): QNetworkReply(parent)
+ {
+ setRequest(req);
+ setUrl(req.url());
+ setOperation(op);
+ m_buffer.setData(body.data());
+ connect(&m_buffer, SIGNAL(readyRead()), SLOT(emitReadyRead()));
+ connect(&m_buffer, SIGNAL(readChannelFinished()), SLOT(emitReadChannelFinished()));
+ connect(&m_buffer, SIGNAL(readChannelFinished()), SLOT(emitReadChannelFinished()));
+ m_buffer.open(QIODevice::ReadOnly);
+ open(QIODevice::ReadOnly);
+ QTimer::singleShot(10, this, SLOT(update()));
+ }
+protected:
+ qint64 readData(char * data, qint64 maxSize)
+ {
+ qint64 result = m_buffer.read(data, maxSize);
+ if (!m_buffer.bytesAvailable())
+ QTimer::singleShot(10, this, SLOT(emitReadChannelFinished()));
+ return result;
+ }
+
+ virtual qint64 bytesAvailable() const
+ {
+ return m_buffer.bytesAvailable();
+ }
+
+private slots:
+ void emitReadyRead()
+ {
+ emit readyRead();
+ }
+
+ void emitReadChannelFinished()
+ {
+ emit readChannelFinished();
+ emit finished();
+ }
+ void abort() { };
+
+ void update()
+ {
+ setHeader(QNetworkRequest::ContentTypeHeader, "text/plain");
+ setHeader(QNetworkRequest::ContentLengthHeader, m_buffer.size());
+ setError(QNetworkReply::NoError, "");
+ setAttribute(QNetworkRequest::HttpStatusCodeAttribute, 200);
+ setAttribute(QNetworkRequest::HttpReasonPhraseAttribute, QString("Ok").toLatin1());
+ emit metaDataChanged();
+ emit readyRead();
+ }
+public:
+ QBuffer m_buffer;
+};
+
+class CannedResponseNetworkAccessManager: public QNetworkAccessManager {
+ Q_OBJECT
+protected:
+ virtual QNetworkReply* createRequest(Operation op, const QNetworkRequest& req, QIODevice* outgoingData = 0)
+ {
+ return new CannedResponseNetworkReply(this, op, req, *m_buffer);
+ };
+public:
+ QBuffer* m_buffer;
+};
+
+static const char cannedResponse[] = "Test";
+
+void tst_QWebSecurityOrigin::whiteList()
+{
+ QFETCH(QString, source);
+ QFETCH(QString, scheme);
+ QFETCH(QString, host);
+ QFETCH(bool, includeSubDomains);
+ QFETCH(QString, testUrl);
+ QFETCH(bool, successBeforeAdd);
+ QFETCH(bool, successAfterAdd);
+ QFETCH(bool, successAfterRemove);
+
+ QWebSecurityOrigin* origin = new QWebSecurityOrigin(source);
+ CannedResponseNetworkAccessManager manager;
+ QBuffer buffer;
+ QWebSecurityOrigin::SubdomainSetting subdomainSetting = includeSubDomains ? QWebSecurityOrigin::AllowSubdomains : QWebSecurityOrigin::DisallowSubdomains;
+ buffer.setData(cannedResponse, sizeof(cannedResponse)-1);
+ manager.m_buffer = &buffer;
+ QFile testPageFile(":/resources/test.html");
+ QVERIFY(testPageFile.open(QIODevice::ReadOnly));
+ uchar* testPage = testPageFile.map(0, testPageFile.size());
+ QVERIFY(testPage);
+ m_view->setHtml(QString((const char*)testPage), QUrl(source));
+ m_view->page()->setNetworkAccessManager(&manager);
+ QString testJS="runTest(\"" + testUrl + "\")";
+ QCOMPARE(m_view->page()->mainFrame()->evaluateJavaScript(testJS), QVariant(successBeforeAdd));
+ origin->addAccessWhitelistEntry(scheme, host, subdomainSetting);
+ QCOMPARE(m_view->page()->mainFrame()->evaluateJavaScript(testJS), QVariant(successAfterAdd));
+ origin->removeAccessWhitelistEntry(scheme, host, subdomainSetting);
+ QCOMPARE(m_view->page()->mainFrame()->evaluateJavaScript(testJS), QVariant(successAfterRemove));
+ m_view->page()->setNetworkAccessManager(0);
+}
+
+QTEST_MAIN(tst_QWebSecurityOrigin)
+#include "tst_qwebsecurityorigin.moc"
+
Added: trunk/Source/WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.qrc (0 => 153516)
--- trunk/Source/WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.qrc (rev 0)
+++ trunk/Source/WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.qrc 2013-07-31 11:56:06 UTC (rev 153516)
@@ -0,0 +1,6 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource>
+ <file>resources/test.html</file>
+</qresource>
+</RCC>
+
Modified: trunk/Source/tests.pri (153515 => 153516)
--- trunk/Source/tests.pri 2013-07-31 09:44:35 UTC (rev 153515)
+++ trunk/Source/tests.pri 2013-07-31 11:56:06 UTC (rev 153516)
@@ -20,6 +20,7 @@
$$WEBKIT_TESTS_DIR/qwebview \
$$WEBKIT_TESTS_DIR/qwebhistory \
$$WEBKIT_TESTS_DIR/qwebinspector \
+ $$WEBKIT_TESTS_DIR/qwebsecurityorigin \
$$WEBKIT_TESTS_DIR/hybridPixmap
linux-* {
