Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195212 => 195213)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-18 12:56:10 UTC (rev 195212)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-18 13:06:47 UTC (rev 195213)
@@ -1,3 +1,14 @@
+2016-01-06 Brent Fulgham <[email protected]>
+
+ Port blocking bypass issue using 307 redirect
+ https://bugs.webkit.org/show_bug.cgi?id=152801
+ <rdar://problem/24048554>
+
+ Reviewed by Anders Carlsson.
+
+ * http/tests/security/blocked-on-redirect-expected.txt: Added.
+ * http/tests/security/blocked-on-redirect.html: Added.
+
2016-01-06 Zalan Bujtas <[email protected]>
Float with media query positioned incorrectly after window resize.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/blocked-on-redirect-expected.txt (0 => 195213)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/blocked-on-redirect-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/blocked-on-redirect-expected.txt 2016-01-18 13:06:47 UTC (rev 195213)
@@ -0,0 +1,5 @@
+http://127.0.0.1:8000/resources/redirect.php?code=307&url="" - willSendRequest <NSURLRequest URL http://127.0.0.1:8000/resources/redirect.php?code=307&url="" main document URL http://127.0.0.1:8000/security/blocked-on-redirect.html, http method GET> redirectResponse (null)
+http://127.0.0.1:8000/security/blocked-on-redirect.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port: http://localhost:25/security/resources/post-done.html
+http://127.0.0.1:8000/resources/redirect.php?code=307&url="" - didFailLoadingWithError: <NSError domain WebKitErrorDomain, code 103, failing URL "http://localhost:25/security/resources/post-done.html">
+This test produces output in the console. Only the initial URL should be logged.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/blocked-on-redirect.html (0 => 195213)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/blocked-on-redirect.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/blocked-on-redirect.html 2016-01-18 13:06:47 UTC (rev 195213)
@@ -0,0 +1,10 @@
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpResourceLoadCallbacks();
+}
+</script>
+
+This test produces output in the console. Only the initial URL should be logged.
+
+<iframe src = ""
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195212 => 195213)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-18 12:56:10 UTC (rev 195212)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-18 13:06:47 UTC (rev 195213)
@@ -1,3 +1,23 @@
+2016-01-06 Brent Fulgham <[email protected]>
+
+ Port blocking bypass issue using 307 redirect
+ https://bugs.webkit.org/show_bug.cgi?id=152801
+ <rdar://problem/24048554>
+
+ Reviewed by Anders Carlsson.
+
+ Tested by http/tests/security/blocked-on-redirect.html.
+
+ Make sure that 307 redirects check the requested URL via 'portAllowed'.
+
+ * loader/DocumentLoader.cpp:
+ (WebCore::DocumentLoader::willSendRequest): Confirm that the requested port
+ is valid, and block load if it is not.
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::reportBlockedPortFailed): Added.
+ (WebCore::FrameLoader::blockedError): Added.
+ * loader/FrameLoader.h:
+
2016-01-06 Zalan Bujtas <[email protected]>
Float with media query positioned incorrectly after window resize.
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentLoader.cpp (195212 => 195213)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentLoader.cpp 2016-01-18 12:56:10 UTC (rev 195212)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/DocumentLoader.cpp 2016-01-18 13:06:47 UTC (rev 195213)
@@ -520,6 +520,11 @@
cancelMainResourceLoad(frameLoader()->cancelledError(newRequest));
return;
}
+ if (!portAllowed(newRequest.url())) {
+ FrameLoader::reportBlockedPortFailed(m_frame, newRequest.url().string());
+ cancelMainResourceLoad(frameLoader()->blockedError(newRequest));
+ return;
+ }
timing().addRedirect(redirectResponse.url(), newRequest.url());
}
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/FrameLoader.cpp (195212 => 195213)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/FrameLoader.cpp 2016-01-18 12:56:10 UTC (rev 195212)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/FrameLoader.cpp 2016-01-18 13:06:47 UTC (rev 195213)
@@ -1465,6 +1465,15 @@
frame->document()->addConsoleMessage(MessageSource::Security, MessageLevel::Error, "Not allowed to load local resource: " + url);
}
+void FrameLoader::reportBlockedPortFailed(Frame* frame, const String& url)
+{
+ ASSERT(!url.isEmpty());
+ if (!frame)
+ return;
+
+ frame->document()->addConsoleMessage(MessageSource::Security, MessageLevel::Error, "Not allowed to use restricted network port: " + url);
+}
+
const ResourceRequest& FrameLoader::initialRequest() const
{
return activeDocumentLoader()->originalRequest();
@@ -3358,6 +3367,13 @@
return error;
}
+ResourceError FrameLoader::blockedError(const ResourceRequest& request) const
+{
+ ResourceError error = m_client.blockedError(request);
+ error.setIsCancellation(true);
+ return error;
+}
+
#if PLATFORM(IOS)
RetainPtr<CFDictionaryRef> FrameLoader::connectionProperties(ResourceLoader* loader)
{
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/FrameLoader.h (195212 => 195213)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/FrameLoader.h 2016-01-18 12:56:10 UTC (rev 195212)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/FrameLoader.h 2016-01-18 13:06:47 UTC (rev 195213)
@@ -133,6 +133,7 @@
void retryAfterFailedCacheOnlyMainResourceLoad();
static void reportLocalLoadFailed(Frame*, const String& url);
+ static void reportBlockedPortFailed(Frame*, const String& url);
// FIXME: These are all functions which stop loads. We have too many.
WEBCORE_EXPORT void stopAllLoaders(ClearProvisionalItemPolicy = ShouldClearProvisionalItem);
@@ -170,6 +171,7 @@
void handleFallbackContent();
WEBCORE_EXPORT ResourceError cancelledError(const ResourceRequest&) const;
+ ResourceError blockedError(const ResourceRequest&) const;
bool isHostedByObjectElement() const;
