Skip to content
This repository was archived by the owner on Jun 24, 2022. It is now read-only.

Commit 14e0854

Browse files
author
[email protected]
committed
2011-01-01 Adam Barth <[email protected]>
 Reviewed by Eric Seidel. sandbox iframes have access to top.history methods https://bugs.webkit.org/show_bug.cgi?id=38152 To enforce the sandbox restrictions on History, we need to pass the ScriptExecutionContext to WebCore. This patch leaves the original History methods in place because they are used directly by folks who don't care about security checks. Test: fast/frames/sandboxed-iframe-history-denied.html * page/History.cpp: (WebCore::History::back): (WebCore::History::forward): (WebCore::History::go): * page/History.h: * page/History.idl: 2011-01-01 Justin Schuh <[email protected]> Reviewed by Eric Seidel. sandbox iframes have access to top.history methods https://bugs.webkit.org/show_bug.cgi?id=38152 Test that sandboxed iframes cannot use history to navigate the top frame. This test is less than ideal, as described in the test itself. If I was really on top of things, I'd add a test for successful use of the history API when allow-top-navigation is set, but that test would be complicated and I'm lazy (enough to copy directly from abarth). * fast/frames/sandboxed-iframe-history-denied-expected.txt: Added. * fast/frames/sandboxed-iframe-history-denied.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74853 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent c2a176a commit 14e0854

File tree

7 files changed

+110
-8
lines changed

7 files changed

+110
-8
lines changed

‎LayoutTests/ChangeLog

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
2011-01-01 Justin Schuh <[email protected]>
2+
3+
Reviewed by Eric Seidel.
4+
5+
sandbox iframes have access to top.history methods
6+
https://bugs.webkit.org/show_bug.cgi?id=38152
7+
8+
Test that sandboxed iframes cannot use history to navigate the top
9+
frame. This test is less than ideal, as described in the test itself.
10+
If I was really on top of things, I'd add a test for successful use of
11+
the history API when allow-top-navigation is set, but that test would
12+
be complicated and I'm lazy (enough to copy directly from abarth).
13+
14+
* fast/frames/sandboxed-iframe-history-denied-expected.txt: Added.
15+
* fast/frames/sandboxed-iframe-history-denied.html: Added.
16+
117
2011-01-01 Kent Tamura <[email protected]>
218

319
Unreviewed, test expectation update.

‎LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
ALERT: PASS
2+
This test verifies that a sandboxed IFrame cannot navigate the top-level frame using the history API.
3+
4+

‎LayoutTests/fast/frames/sandboxed-iframe-history-denied.html

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<html>
2+
<head>
3+
<script>
4+
if (window.layoutTestController) {
5+
layoutTestController.dumpAsText();
6+
layoutTestController.waitUntilDone();
7+
}
8+
9+
window.unload = function() {
10+
alert("FAIL");
11+
}
12+
13+
window.onload = function() {
14+
// There's no way to write a test that determinstically fails because the
15+
// history API is asynchronous. There's no way to know whether the
16+
// asynchronous haven't yet happened or never will. Consequently, we just
17+
// wait for a bit.
18+
setTimeout(function() {
19+
alert("PASS");
20+
if (window.layoutTestController)
21+
layoutTestController.notifyDone();
22+
}, 20);
23+
}
24+
</script>
25+
</head>
26+
<body>
27+
<p>This test verifies that a sandboxed IFrame cannot navigate the top-level frame using the history API.</p>
28+
<iframe sandbox="allow-scripts" src="data:text/html,<script>top.history.back()</script>">
29+
<iframe sandbox="allow-scripts" src="data:text/html,<script>top.history.forward()</script>">
30+
<iframe sandbox="allow-scripts" src="data:text/html,<script>top.history.go(-1)</script>">
31+
</body>
32+
</html>

‎WebCore/ChangeLog

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
2011-01-01 Adam Barth <[email protected]>
2+
3+
Reviewed by Eric Seidel.
4+
5+
sandbox iframes have access to top.history methods
6+
https://bugs.webkit.org/show_bug.cgi?id=38152
7+
8+
To enforce the sandbox restrictions on History, we need to pass the
9+
ScriptExecutionContext to WebCore. This patch leaves the original
10+
History methods in place because they are used directly by folks who
11+
don't care about security checks.
12+
13+
Test: fast/frames/sandboxed-iframe-history-denied.html
14+
15+
* page/History.cpp:
16+
(WebCore::History::back):
17+
(WebCore::History::forward):
18+
(WebCore::History::go):
19+
* page/History.h:
20+
* page/History.idl:
21+
122
2011-01-01 Adam Barth <[email protected]>
223

324
Remove empty file.

‎WebCore/page/History.cpp

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
#include "History.h"
2828

2929
#include "BackForwardController.h"
30+
#include "Document.h"
3031
#include "ExceptionCode.h"
3132
#include "Frame.h"
3233
#include "FrameLoader.h"
@@ -62,22 +63,45 @@ unsigned History::length() const
6263

6364
void History::back()
6465
{
65-
if (!m_frame)
66-
return;
67-
m_frame->navigationScheduler()->scheduleHistoryNavigation(-1);
66+
go(-1);
67+
}
68+
69+
void History::back(ScriptExecutionContext* context)
70+
{
71+
go(context, -1);
6872
}
6973

7074
void History::forward()
75+
{
76+
go(1);
77+
}
78+
79+
void History::forward(ScriptExecutionContext* context)
80+
{
81+
go(context, 1);
82+
}
83+
84+
void History::go(int distance)
7185
{
7286
if (!m_frame)
7387
return;
74-
m_frame->navigationScheduler()->scheduleHistoryNavigation(1);
88+
89+
m_frame->navigationScheduler()->scheduleHistoryNavigation(distance);
7590
}
7691

77-
void History::go(int distance)
92+
void History::go(ScriptExecutionContext* context, int distance)
7893
{
7994
if (!m_frame)
8095
return;
96+
97+
ASSERT(WTF::isMainThread());
98+
Frame* activeFrame = static_cast<Document*>(context)->frame();
99+
if (!activeFrame)
100+
return;
101+
102+
if (!activeFrame->loader()->shouldAllowNavigation(m_frame))
103+
return;
104+
81105
m_frame->navigationScheduler()->scheduleHistoryNavigation(distance);
82106
}
83107

‎WebCore/page/History.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
namespace WebCore {
3535

3636
class Frame;
37+
class ScriptExecutionContext;
3738
class SerializedScriptValue;
3839
typedef int ExceptionCode;
3940

@@ -49,6 +50,10 @@ class History : public RefCounted<History> {
4950
void forward();
5051
void go(int distance);
5152

53+
void back(ScriptExecutionContext*);
54+
void forward(ScriptExecutionContext*);
55+
void go(ScriptExecutionContext*, int distance);
56+
5257
enum StateObjectType {
5358
StateObjectPush,
5459
StateObjectReplace

‎WebCore/page/History.idl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,9 @@ module window {
3737
] History {
3838
readonly attribute unsigned long length;
3939

40-
[DoNotCheckDomainSecurity] void back();
41-
[DoNotCheckDomainSecurity] void forward();
42-
[DoNotCheckDomainSecurity] void go(in long distance);
40+
[DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void back();
41+
[DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void forward();
42+
[DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void go(in long distance);
4343

4444
[Custom, EnabledAtRuntime] void pushState(in any data, in DOMString title, in optional DOMString url)
4545
raises(DOMException);

0 commit comments

Comments
 (0)