Diff
Modified: trunk/LayoutTests/ChangeLog (125735 => 125736)
--- trunk/LayoutTests/ChangeLog 2012-08-16 01:48:18 UTC (rev 125735)
+++ trunk/LayoutTests/ChangeLog 2012-08-16 02:14:16 UTC (rev 125736)
@@ -1,3 +1,18 @@
+2012-08-14 Jeffrey Pfau <[email protected]>
+
+ Allow blocking of Web SQL databases in third-party documents
+ https://bugs.webkit.org/show_bug.cgi?id=94057
+
+ Reviewed by Adam Barth.
+
+ Created tests for accessing openDatabase from a third party and first party context when third-party blocking is on and off.
+
+ * http/tests/security/cross-origin-websql-allowed-expected.txt: Added.
+ * http/tests/security/cross-origin-websql-allowed.html: Added.
+ * http/tests/security/cross-origin-websql-expected.txt: Added.
+ * http/tests/security/cross-origin-websql.html: Added.
+ * http/tests/security/resources/cross-origin-iframe-for-websql.html: Added.
+
2012-08-15 Kiran Muppala <[email protected]>
Fix TestExpectations line format for two fast/css tests failing on mac
Added: trunk/LayoutTests/http/tests/security/cross-origin-websql-allowed-expected.txt (0 => 125736)
--- trunk/LayoutTests/http/tests/security/cross-origin-websql-allowed-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/cross-origin-websql-allowed-expected.txt 2012-08-16 02:14:16 UTC (rev 125736)
@@ -0,0 +1,16 @@
+This iframe should not return any errors:
+
+
+This iframe should not return any errors:
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+No exception
+
+--------
+Frame: '<!--framePath //<!--frame1-->-->'
+--------
+No exception
Added: trunk/LayoutTests/http/tests/security/cross-origin-websql-allowed.html (0 => 125736)
--- trunk/LayoutTests/http/tests/security/cross-origin-websql-allowed.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/cross-origin-websql-allowed.html 2012-08-16 02:14:16 UTC (rev 125736)
@@ -0,0 +1,16 @@
+<html>
+<head>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpChildFramesAsText();
+}
+</script>
+</head>
+<body>
+<p>This iframe should not return any errors:</p>
+<iframe src=""
+<p>This iframe should not return any errors:</p>
+<iframe src=""
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/cross-origin-websql-expected.txt (0 => 125736)
--- trunk/LayoutTests/http/tests/security/cross-origin-websql-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/cross-origin-websql-expected.txt 2012-08-16 02:14:16 UTC (rev 125736)
@@ -0,0 +1,16 @@
+This iframe should return a security error:
+
+
+This iframe should not return any errors:
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+SECURITY_ERR
+
+--------
+Frame: '<!--framePath //<!--frame1-->-->'
+--------
+No exception
Added: trunk/LayoutTests/http/tests/security/cross-origin-websql.html (0 => 125736)
--- trunk/LayoutTests/http/tests/security/cross-origin-websql.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/cross-origin-websql.html 2012-08-16 02:14:16 UTC (rev 125736)
@@ -0,0 +1,24 @@
+<html>
+<head>
+<script>
+var frames = 2;
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpChildFramesAsText();
+ internals.settings.setThirdPartyStorageBlockingEnabled(true);
+}
+
+function decrement() {
+ --frames;
+ if (!frames && window.testRunner)
+ internals.settings.setThirdPartyStorageBlockingEnabled(false);
+}
+</script>
+</head>
+<body>
+<p>This iframe should return a security error:</p>
+<iframe src="" _onload_="decrement()"></iframe>
+<p>This iframe should not return any errors:</p>
+<iframe src="" _onload_="decrement()"></iframe>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/resources/cross-origin-iframe-for-websql.html (0 => 125736)
--- trunk/LayoutTests/http/tests/security/resources/cross-origin-iframe-for-websql.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/cross-origin-iframe-for-websql.html 2012-08-16 02:14:16 UTC (rev 125736)
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+try {
+ var c = window.openDatabase('testdb', '1.0', 'Testing database', 512 * 1024);
+ document.write('No exception');
+} catch (exception) {
+ document.write(exception.name);
+}
+</script>
+</head>
+<body>
+</body>
+</head>
Modified: trunk/Source/WebCore/ChangeLog (125735 => 125736)
--- trunk/Source/WebCore/ChangeLog 2012-08-16 01:48:18 UTC (rev 125735)
+++ trunk/Source/WebCore/ChangeLog 2012-08-16 02:14:16 UTC (rev 125736)
@@ -1,3 +1,24 @@
+2012-08-14 Jeffrey Pfau <[email protected]>
+
+ Allow blocking of Web SQL databases in third-party documents
+ https://bugs.webkit.org/show_bug.cgi?id=94057
+
+ Reviewed by Adam Barth.
+
+ Add a check for pages in third-party pages to allow third-party storage blocking of Web SQL databases.
+
+ Tests: http/tests/security/cross-origin-websql-allowed.html
+ http/tests/security/cross-origin-websql.html
+
+ * Modules/webdatabase/DOMWindowWebDatabase.cpp:
+ (WebCore::DOMWindowWebDatabase::openDatabase): Pass top origin to canAccessDatabase
+ * page/SecurityOrigin.cpp:
+ (WebCore::SecurityOrigin::canAccessStorage): Common method for various types of storage that use the same criteria
+ * page/SecurityOrigin.h:
+ (WebCore::SecurityOrigin::canAccessDatabase): Use canAccessStorage
+ (WebCore::SecurityOrigin::canAccessLocalStorage): Change to using canAccessStorage
+ (SecurityOrigin):
+
2012-08-15 Nikhil Bhargava <[email protected]>
Improve Document.h compile time - reduce includes of ScriptCallStack.h
Modified: trunk/Source/WebCore/Modules/webdatabase/DOMWindowWebDatabase.cpp (125735 => 125736)
--- trunk/Source/WebCore/Modules/webdatabase/DOMWindowWebDatabase.cpp 2012-08-16 01:48:18 UTC (rev 125735)
+++ trunk/Source/WebCore/Modules/webdatabase/DOMWindowWebDatabase.cpp 2012-08-16 02:14:16 UTC (rev 125736)
@@ -46,7 +46,7 @@
return 0;
RefPtr<Database> database = 0;
- if (AbstractDatabase::isAvailable() && window->document()->securityOrigin()->canAccessDatabase())
+ if (AbstractDatabase::isAvailable() && window->document()->securityOrigin()->canAccessDatabase(window->document()->topDocument()->securityOrigin()))
database = Database::openDatabase(window->document(), name, version, displayName, estimatedSize, creationCallback, ec);
if (!database && !ec)
Modified: trunk/Source/WebCore/page/SecurityOrigin.cpp (125735 => 125736)
--- trunk/Source/WebCore/page/SecurityOrigin.cpp 2012-08-16 01:48:18 UTC (rev 125735)
+++ trunk/Source/WebCore/page/SecurityOrigin.cpp 2012-08-16 02:14:16 UTC (rev 125736)
@@ -391,11 +391,15 @@
return true;
}
-bool SecurityOrigin::canAccessLocalStorage(const SecurityOrigin* topOrigin) const
+bool SecurityOrigin::canAccessStorage(const SecurityOrigin* topOrigin) const
{
if (isUnique())
return false;
+ // FIXME: This check should be replaced with an ASSERT once we can guarantee that topOrigin is not null.
+ if (!topOrigin)
+ return true;
+
if (m_blockThirdPartyStorage && topOrigin->isThirdParty(this))
return false;
Modified: trunk/Source/WebCore/page/SecurityOrigin.h (125735 => 125736)
--- trunk/Source/WebCore/page/SecurityOrigin.h 2012-08-16 01:48:18 UTC (rev 125735)
+++ trunk/Source/WebCore/page/SecurityOrigin.h 2012-08-16 02:14:16 UTC (rev 125736)
@@ -123,8 +123,8 @@
void blockThirdPartyStorage() { m_blockThirdPartyStorage = true; }
- bool canAccessDatabase() const { return !isUnique(); }
- bool canAccessLocalStorage(const SecurityOrigin* topOrigin) const;
+ bool canAccessDatabase(const SecurityOrigin* topOrigin = 0) const { return canAccessStorage(topOrigin); };
+ bool canAccessLocalStorage(const SecurityOrigin* topOrigin) const { return canAccessStorage(topOrigin); };
bool canAccessCookies() const { return !isUnique(); }
bool canAccessPasswordManager() const { return !isUnique(); }
bool canAccessFileSystem() const { return !isUnique(); }
@@ -192,6 +192,7 @@
// FIXME: Rename this function to something more semantic.
bool passesFileCheck(const SecurityOrigin*) const;
bool isThirdParty(const SecurityOrigin*) const;
+ bool canAccessStorage(const SecurityOrigin*) const;
String m_protocol;
String m_host;
