Skip to content
  • jpfau@apple.com's avatar
    Make plugins respect third-party storage blocking setting · 45aa6587
    jpfau@apple.com authored
    https://bugs.webkit.org/show_bug.cgi?id=94888
    
    Reviewed by Brady Eidson.
    
    Source/WebCore:
    
    Added functions for discerning if a plugin should be able to access its storage in its current origin.
    
    Tests: http/tests/security/cross-origin-plugin-allowed.html
           http/tests/security/cross-origin-plugin.html
    
    * WebCore.exp.in: Export FrameTree::top and SecurityOrigin::canAccessStorage
    * page/SecurityOrigin.h: Added canAccessPluginStorage
    (WebCore::SecurityOrigin::canAccessPluginStorage):
    
    Source/WebKit2:
    
    Plugins that are in a third-party context should be put into private browsing mode so their storage is temporary.
    
    * WebProcess/Plugins/PluginView.cpp:
    (WebKit::PluginView::isPrivateBrowsingEnabled): Put the plugin into private browsing mode if it is in a third-party context.
    (WebKit::PluginView::privateBrowsingStateChanged): Make sure a plugin doesn't leave private browsing mode if it's in a third-party context.
    
    LayoutTests:
    
    Created tests for plugins in a third party and first party context when third-party blocking is on and off.
    
    * http/tests/security/cross-origin-plugin-allowed-expected.txt: Added.
    * http/tests/security/cross-origin-plugin-allowed.html: Added.
    * http/tests/security/cross-origin-plugin-expected.txt: Added.
    * http/tests/security/cross-origin-plugin-private-browsing-toggled-allowed-expected.txt: Added.
    * http/tests/security/cross-origin-plugin-private-browsing-toggled-allowed.html: Added.
    * http/tests/security/cross-origin-plugin-private-browsing-toggled-expected.txt: Added.
    * http/tests/security/cross-origin-plugin-private-browsing-toggled.html: Added.
    * http/tests/security/cross-origin-plugin.html: Added.
    * http/tests/security/resources/cross-origin-iframe-for-plugin.html: Added.
    * http/tests/security/resources/cross-origin-iframe-for-plugin-async.html: Added.
    * platform/mac-wk2/http/tests/security/cross-origin-plugin-expected.txt: Added.
    * platform/mac-wk2/http/tests/security/cross-origin-plugin-private-browsing-toggled-expected.txt: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127513 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    45aa6587