Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195272 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 09:33:57 UTC (rev 195272)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 09:36:10 UTC (rev 195273)
@@ -1,3 +1,26 @@
+2016-01-15 Youenn Fablet <[email protected]>
+
+ CORS: Fix the handling of redirected request containing Origin null.
+ https://bugs.webkit.org/show_bug.cgi?id=128816
+
+ Reviewed by Brent Fulgham.
+
+ Merging Blink patch from George Ancil (https://chromiumcodereview.appspot.com/20735002)
+
+ Added two tests to check CORS with Origin null in HTTP redirect and iframe cases.
+ Updated two test sandboxed iframes test expectations (requests are still denied but error messages are different).
+
+ * http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null-expected.txt: Added.
+ * http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html: Added.
+ * http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-expected.txt:
+ * http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard-expected.txt:
+ * http/tests/xmlhttprequest/redirect-cors-origin-null-expected.txt: Added.
+ * http/tests/xmlhttprequest/redirect-cors-origin-null.html: Added.
+ * http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null-iframe.html: Added.
+ * http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null.cgi: Added.
+ * http/tests/xmlhttprequest/resources/redirect-cors-origin-null-pass.php: Added.
+ * http/tests/xmlhttprequest/resources/redirect-cors-origin-null.php: Added.
+
2016-01-14 Daniel Bates <[email protected]>
Disallow use of Geolocation service from unique origins
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null-expected.txt (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null-expected.txt 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,9 @@
+This test verifies that sandboxed iframe has XmlHttpRequest access to the server that accepts all domains. It will print "PASS" on success.
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+PASS: Sandboxed iframe XHR access allowed.
+
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,18 @@
+<html>
+<script>
+
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpChildFramesAsText();
+}
+
+</script>
+<body>
+ <p>This test verifies that sandboxed iframe has XmlHttpRequest access
+ to the server that accepts all domains. It will print "PASS" on success.</p>
+
+ <iframe sandbox="allow-scripts" src="" style="width: 500px;">
+ </iframe>
+
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-expected.txt (195272 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-expected.txt 2016-01-19 09:33:57 UTC (rev 195272)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-expected.txt 2016-01-19 09:36:10 UTC (rev 195273)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: line 17: XMLHttpRequest cannot load http://127.0.0.1:8000/xmlhttprequest/resources/access-control-sandboxed-iframe-denied.cgi. Cannot make any requests from null.
+CONSOLE MESSAGE: line 17: XMLHttpRequest cannot load http://127.0.0.1:8000/xmlhttprequest/resources/access-control-sandboxed-iframe-denied.cgi. Origin null is not allowed by Access-Control-Allow-Origin.
This test verifies that sandboxed iframe does not have XmlHttpRequest access to its server. It will print "PASS" on success.
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard-expected.txt (195272 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard-expected.txt 2016-01-19 09:33:57 UTC (rev 195272)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard-expected.txt 2016-01-19 09:36:10 UTC (rev 195273)
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: line 16: XMLHttpRequest cannot load http://127.0.0.1:8000/xmlhttprequest/resources/access-control-sandboxed-iframe-denied-without-wildcard.cgi. Cannot make any requests from null.
+CONSOLE MESSAGE: line 16: XMLHttpRequest cannot load http://127.0.0.1:8000/xmlhttprequest/resources/access-control-sandboxed-iframe-denied-without-wildcard.cgi. Origin null is not allowed by Access-Control-Allow-Origin.
This test verifies that sandboxed iframe does not have XmlHttpRequest access to its server with "Access-Control-Allow-Origin" set to its own origin (127.0.0.1).
This test will print "PASS" on success.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null-expected.txt (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null-expected.txt 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,5 @@
+Test opera W3C test suite(http://w3c-test.org/webappsec/tests/cors/submitted/opera/staging/redirect-origin.htm) test case 13 for redirection.
+Request URL origin is not same origin with the original URL origin. Final response contains "Access-Control-Allow-Origin: null". Should print PASS.
+
+PASS
+
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null-expected.txt
___________________________________________________________________
Added: svn:executable
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null.html (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null.html 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,33 @@
+<html>
+<body>
+<p>Test opera W3C test suite(http://w3c-test.org/webappsec/tests/cors/submitted/opera/staging/redirect-origin.htm) test case 13 for redirection.<br>
+Request URL origin is not same origin with the original URL origin. Final response contains "Access-Control-Allow-Origin: null". Should print PASS.</p>
+<div id="log"></div>
+<script>
+function log(message) {
+ document.getElementById("log").innerHTML += message + "<br>";
+}
+
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+var xhr = new XMLHttpRequest();
+xhr.open("GET", "http://localhost:8080/xmlhttprequest/resources/redirect-cors-origin-null.php");
+xhr._onerror_ = function () {
+ log("FAIL");
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+};
+xhr._onreadystatechange_ = function () {
+ if (xhr.readyState == 4) {
+ log(xhr.responseText);
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+};
+xhr.send();
+
+</script>
+</html>
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/redirect-cors-origin-null.html
___________________________________________________________________
Added: svn:executable
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null-iframe.html (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null-iframe.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null-iframe.html 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,25 @@
+<html>
+<body>
+<pre id='console'></pre>
+<script type="text/_javascript_">
+
+document.getElementById('console').innerHTML = (function() {
+ var xhr = new XMLHttpRequest;
+
+ try {
+ xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null.cgi", false);
+ } catch(e) {
+ return "FAIL: Exception thrown. Sandboxed iframe XHR access is not allowed in 'open'. [" + e.message + "].";
+ }
+
+ try {
+ xhr.send();
+ } catch(e) {
+ return "FAIL: Exception thrown. Sandboxed iframe XHR access is not allowed in 'send'. [" + e.message + "].";
+ }
+
+ return xhr.responseText;
+})();
+</script>
+</body>
+</html>
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null.cgi (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null.cgi (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null.cgi 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,8 @@
+#!/usr/bin/perl -wT
+use strict;
+
+print "Content-Type: text/plain\n";
+print "Access-Control-Allow-Credentials: true\n";
+print "Access-Control-Allow-Origin: null\n\n";
+
+print "PASS: Sandboxed iframe XHR access allowed.\n";
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/access-control-sandboxed-iframe-allow-origin-null.cgi
___________________________________________________________________
Added: svn:executable
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null-pass.php (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null-pass.php (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null-pass.php 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,7 @@
+<?php
+ $request_origin_value = $_SERVER["HTTP_ORIGIN"];
+ if (!is_null($request_origin_value)) {
+ header("Access-Control-Allow-Origin: null");
+ echo "PASS";
+ }
+?>
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null-pass.php
___________________________________________________________________
Added: svn:executable
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null.php (0 => 195273)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null.php (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null.php 2016-01-19 09:36:10 UTC (rev 195273)
@@ -0,0 +1,11 @@
+<?php
+ $request_origin_value = $_SERVER["HTTP_ORIGIN"];
+
+ if ($_SERVER['REQUEST_METHOD'] == "GET") {
+ header("HTTP/1.1 302");
+ header("Location: http://localhost:8000/xmlhttprequest/resources/redirect-cors-origin-null-pass.php");
+ }
+ if (!is_null($request_origin_value)) {
+ header("Access-Control-Allow-Origin: $request_origin_value");
+ }
+?>
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/xmlhttprequest/resources/redirect-cors-origin-null.php
___________________________________________________________________
Added: svn:executable
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195272 => 195273)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 09:33:57 UTC (rev 195272)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 09:36:10 UTC (rev 195273)
@@ -1,3 +1,22 @@
+2016-01-15 Youenn Fablet <[email protected]>
+
+ CORS: Fix the handling of redirected request containing Origin null.
+ https://bugs.webkit.org/show_bug.cgi?id=128816
+
+ Reviewed by Brent Fulgham.
+
+ Merging Blink patch from George Ancil (https://chromiumcodereview.appspot.com/20735002).
+
+ This patch removes the check for securityOrigin->isUnique() in passesAccessControlCheck().
+ This check prevented a redirected request with "Origin: null" from being
+ successful even when the response contains "Access-Control-Allow-Origin: null"
+
+ Tests: http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html
+ http/tests/xmlhttprequest/redirect-cors-origin-null.html
+
+ * loader/CrossOriginAccessControl.cpp:
+ (WebCore::passesAccessControlCheck):
+
2016-01-14 Daniel Bates <[email protected]>
Disallow use of Geolocation service from unique origins
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/CrossOriginAccessControl.cpp (195272 => 195273)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/CrossOriginAccessControl.cpp 2016-01-19 09:33:57 UTC (rev 195272)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/loader/CrossOriginAccessControl.cpp 2016-01-19 09:36:10 UTC (rev 195273)
@@ -141,11 +141,6 @@
if (accessControlOriginString == "*" && includeCredentials == DoNotAllowStoredCredentials)
return true;
- if (securityOrigin->isUnique()) {
- errorDescription = "Cannot make any requests from " + securityOrigin->toString() + ".";
- return false;
- }
-
// FIXME: Access-Control-Allow-Origin can contain a list of origins.
if (accessControlOriginString != securityOrigin->toString()) {
if (accessControlOriginString == "*")
