Commit 6093191a authored by jpfau@apple.com's avatar jpfau@apple.com

Change approach to third-party blocking for LocalStorage

https://bugs.webkit.org/show_bug.cgi?id=115004

Reviewed by Maciej Stachowiak.

Source/WebCore:

Instead of outright blocking LocalStorage that's used in a third-party
context, silently partition it based on the origin of the top context.
These partitions are then discarded when the page group is unloaded.

No new tests; modified existing tests to account for changes.

* page/DOMWindow.cpp:
(WebCore::DOMWindow::localStorage):
* page/PageGroup.cpp:
(WebCore::PageGroup::localStorage):
(WebCore):
(WebCore::PageGroup::transientLocalStorage):
* page/PageGroup.h:
(PageGroup):
* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::canAccessStorage):

LayoutTests:

* http/tests/security/cross-origin-local-storage-allowed-expected.txt:
* http/tests/security/cross-origin-local-storage-allowed.html:
* http/tests/security/cross-origin-local-storage-expected.txt:
* http/tests/security/cross-origin-local-storage-wk1.html:
* http/tests/security/cross-origin-local-storage-wk1-expected.txt:
* http/tests/security/cross-origin-local-storage.html:
* http/tests/security/resources/cross-origin-iframe-for-local-storage.html:
* http/tests/security/resources/load-local-storage.html: Added.
* platform/mac-wk2/http/tests/security/cross-origin-local-storage-wk1-expected.txt:
* platform/mac/http/tests/security/cross-origin-local-storage-wk1-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149326 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 71760f74
2013-04-22 Jeffrey Pfau <jpfau@apple.com>
Change approach to third-party blocking for LocalStorage
https://bugs.webkit.org/show_bug.cgi?id=115004
Reviewed by Maciej Stachowiak.
* http/tests/security/cross-origin-local-storage-allowed-expected.txt:
* http/tests/security/cross-origin-local-storage-allowed.html:
* http/tests/security/cross-origin-local-storage-expected.txt:
* http/tests/security/cross-origin-local-storage-wk1.html:
* http/tests/security/cross-origin-local-storage-wk1-expected.txt:
* http/tests/security/cross-origin-local-storage.html:
* http/tests/security/resources/cross-origin-iframe-for-local-storage.html:
* http/tests/security/resources/load-local-storage.html: Added.
* platform/mac-wk2/http/tests/security/cross-origin-local-storage-wk1-expected.txt:
* platform/mac/http/tests/security/cross-origin-local-storage-wk1-expected.txt:
2013-04-29 Yi Shen <max.hong.shen@gmail.com>
HTML Editing: Insertion point jumps when using link detection
......
This iframe should not return any errors:
This iframe should not return any errors:
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
No exception
--------
Frame: '<!--framePath //<!--frame1-->-->'
--------
No exception
Got value: value
......@@ -3,14 +3,16 @@
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.dumpChildFramesAsText();
testRunner.waitUntilDone();
internals.settings.setStorageBlockingPolicy('AllowAll');
}
function continueTest() {
window.location.href = 'http://localhost:8000/security/resources/load-local-storage.html';
}
</script>
</head>
<body>
<p>This iframe should not return any errors:</p>
<iframe src="http://localhost:8000/security/resources/cross-origin-iframe-for-local-storage.html"></iframe>
<p>This iframe should not return any errors:</p>
<iframe src="http://127.0.0.1:8000/security/resources/cross-origin-iframe-for-local-storage.html"></iframe>
<iframe src="http://localhost:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="continueTest()"></iframe>
</body>
</html>
This iframe should return a security error:
This iframe should not return any errors:
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
SecurityError
--------
Frame: '<!--framePath //<!--frame1-->-->'
--------
No exception
No value
This iframe should return a security error:
This iframe should not return any errors:
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
No exception
--------
Frame: '<!--framePath //<!--frame1-->-->'
--------
No exception
Got value: value
<html>
<head>
<script>
var frames = 2;
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.dumpChildFramesAsText();
testRunner.waitUntilDone();
testRunner.overridePreference('WebKitStorageBlockingPolicy', 1);
}
function decrement() {
--frames;
if (!frames && window.testRunner)
testRunner.overridePreference('WebKitStorageBlockingPolicy', 0);
function continueTest() {
window.location.href = 'http://localhost:8000/security/resources/load-local-storage.html';
}
</script>
</head>
<body>
<p>This iframe should return a security error:</p>
<iframe src="http://localhost:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="decrement()"></iframe>
<p>This iframe should not return any errors:</p>
<iframe src="http://127.0.0.1:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="decrement()"></iframe>
<iframe src="http://localhost:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="continueTest()"></iframe>
</body>
</html>
<html>
<head>
<script>
var frames = 2;
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.dumpChildFramesAsText();
testRunner.waitUntilDone();
internals.settings.setStorageBlockingPolicy('BlockThirdParty');
}
function decrement() {
--frames;
if (!frames && window.testRunner)
internals.settings.setStorageBlockingPolicy('AllowAll');
function continueTest() {
window.location.href = 'http://localhost:8000/security/resources/load-local-storage.html';
}
</script>
</head>
<body>
<p>This iframe should return a security error:</p>
<iframe src="http://localhost:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="decrement()"></iframe>
<p>This iframe should not return any errors:</p>
<iframe src="http://127.0.0.1:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="decrement()"></iframe>
<iframe src="http://localhost:8000/security/resources/cross-origin-iframe-for-local-storage.html" onload="continueTest()"></iframe>
</body>
</html>
......@@ -3,6 +3,7 @@
<script>
try {
var c = window.localStorage;
c['test'] = 'value';
document.write('No exception');
} catch (exception) {
document.write(exception.name);
......
<html>
<head>
<script>
try {
var c = window.localStorage;
var value = c['test'];
if (value) {
c.clear();
document.write('Got value: ' + value);
} else {
document.write('No value');
}
} catch (exception) {
document.write(exception.name);
}
if (window.testRunner) {
internals.settings.setStorageBlockingPolicy('AllowAll');
testRunner.overridePreference('WebKitStorageBlockingPolicy', 0);
testRunner.notifyDone();
}
</script>
</head>
<body>
</body>
</head>
This iframe should return a security error:
This iframe should not return any errors:
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
No exception
--------
Frame: '<!--framePath //<!--frame1-->-->'
--------
No exception
Got value: value
This iframe should return a security error:
This iframe should not return any errors:
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
SecurityError
--------
Frame: '<!--framePath //<!--frame1-->-->'
--------
No exception
No value
2013-04-22 Jeffrey Pfau <jpfau@apple.com>
Change approach to third-party blocking for LocalStorage
https://bugs.webkit.org/show_bug.cgi?id=115004
Reviewed by Maciej Stachowiak.
Instead of outright blocking LocalStorage that's used in a third-party
context, silently partition it based on the origin of the top context.
These partitions are then discarded when the page group is unloaded.
No new tests; modified existing tests to account for changes.
* page/DOMWindow.cpp:
(WebCore::DOMWindow::localStorage):
* page/PageGroup.cpp:
(WebCore::PageGroup::localStorage):
(WebCore):
(WebCore::PageGroup::transientLocalStorage):
* page/PageGroup.h:
(PageGroup):
* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::canAccessStorage):
2013-04-29 Yi Shen <max.hong.shen@gmail.com>
HTML Editing: Insertion point jumps when using link detection
......
......@@ -791,7 +791,7 @@ Storage* DOMWindow::localStorage(ExceptionCode& ec) const
if (!document)
return 0;
if (!document->securityOrigin()->canAccessLocalStorage(document->topOrigin())) {
if (!document->securityOrigin()->canAccessLocalStorage(0)) {
ec = SECURITY_ERR;
return 0;
}
......@@ -811,7 +811,12 @@ Storage* DOMWindow::localStorage(ExceptionCode& ec) const
if (!page->settings()->localStorageEnabled())
return 0;
RefPtr<StorageArea> storageArea = page->group().localStorage()->storageArea(document->securityOrigin());
RefPtr<StorageArea> storageArea;
if (!document->securityOrigin()->canAccessLocalStorage(document->topOrigin()))
storageArea = page->group().transientLocalStorage(document->topOrigin())->storageArea(document->securityOrigin());
else
storageArea = page->group().localStorage()->storageArea(document->securityOrigin());
if (!storageArea->canAccessStorage(m_frame)) {
ec = SECURITY_ERR;
return 0;
......
......@@ -263,6 +263,15 @@ StorageNamespace* PageGroup::localStorage()
return m_localStorage.get();
}
StorageNamespace* PageGroup::transientLocalStorage(const SecurityOrigin* topOrigin)
{
String topOriginString = topOrigin->toString();
if (!m_transientLocalStorage.get(topOriginString))
m_transientLocalStorage.set(topOriginString, StorageNamespace::sessionStorageNamespace(*this->pages().begin()));
return m_transientLocalStorage.get(topOriginString).get();
}
void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,
const Vector<String>& whitelist, const Vector<String>& blacklist,
UserScriptInjectionTime injectionTime, UserContentInjectedFrames injectedFrames)
......
......@@ -87,6 +87,8 @@ namespace WebCore {
StorageNamespace* localStorage();
bool hasLocalStorage() { return m_localStorage; }
StorageNamespace* transientLocalStorage(const SecurityOrigin* topOrigin);
void addUserScriptToWorld(DOMWrapperWorld*, const String& source, const KURL&,
const Vector<String>& whitelist, const Vector<String>& blacklist,
UserScriptInjectionTime, UserContentInjectedFrames);
......@@ -128,6 +130,7 @@ namespace WebCore {
unsigned m_identifier;
RefPtr<StorageNamespace> m_localStorage;
HashMap<String, RefPtr<StorageNamespace> > m_transientLocalStorage;
OwnPtr<UserScriptMap> m_userScripts;
OwnPtr<UserStyleSheetMap> m_userStyleSheets;
......
......@@ -388,11 +388,14 @@ bool SecurityOrigin::canAccessStorage(const SecurityOrigin* topOrigin) const
if (isUnique())
return false;
if (m_storageBlockingPolicy == BlockAllStorage)
return false;
// FIXME: This check should be replaced with an ASSERT once we can guarantee that topOrigin is not null.
if (!topOrigin)
return true;
if (m_storageBlockingPolicy == BlockAllStorage || topOrigin->m_storageBlockingPolicy == BlockAllStorage)
if (topOrigin->m_storageBlockingPolicy == BlockAllStorage)
return false;
if ((m_storageBlockingPolicy == BlockThirdPartyStorage || topOrigin->m_storageBlockingPolicy == BlockThirdPartyStorage) && topOrigin->isThirdParty(this))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment