Skip to content
  • abarth@webkit.org's avatar
    JavaScript URLs execute in sandboxed iframes · 29f0c1ad
    abarth@webkit.org authored
    https://bugs.webkit.org/show_bug.cgi?id=71599
    
    Reviewed by Eric Seidel.
    
    Source/WebCore: 
    
    This patch fixes the intentional regression I introduced earlier today
    by moving the sandbox bits from SecurityOrigin to Document. In the
    process, I renamed SecurityOrigin::createEmpty to
    SecurityOrigin::createUnique to better align with HTML5 terminology.
    
    * WebCore.exp.in:
    * bindings/ScriptControllerBase.cpp:
    (WebCore::ScriptController::canExecuteScripts):
    * dom/Document.cpp:
    (WebCore::Document::setIsViewSource):
    (WebCore::Document::initSecurityContext):
    * dom/ScriptExecutionContext.cpp:
    (WebCore::ScriptExecutionContext::ScriptExecutionContext):
    * dom/ScriptExecutionContext.h:
    (WebCore::ScriptExecutionContext::sandboxFlags):
    (WebCore::ScriptExecutionContext::enforceSandboxFlags):
    (WebCore::ScriptExecutionContext::isSandboxed):
    * html/HTMLAppletElement.cpp:
    (WebCore::HTMLAppletElement::canEmbedJava):
    * loader/DocumentWriter.cpp:
    (WebCore::DocumentWriter::begin):
    * loader/FrameLoader.cpp:
    (WebCore::isDocumentSandboxed):
    (WebCore::FrameLoader::addHTTPOriginIfNeeded):
    * loader/PolicyChecker.cpp:
    (WebCore::PolicyChecker::checkNewWindowPolicy):
    * loader/SubframeLoader.cpp:
    (WebCore::SubframeLoader::requestPlugin):
    * page/SecurityOrigin.cpp:
    (WebCore::SecurityOrigin::SecurityOrigin):
    (WebCore::SecurityOrigin::create):
    (WebCore::SecurityOrigin::createUnique):
    * page/SecurityOrigin.h:
    
    LayoutTests: 
    
    Update results to show progression.
    
    * fast/frames/sandboxed-iframe-scripting-expected.txt:
    * fast/frames/sandboxed-iframe-scripting.html:
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@99347 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    29f0c1ad