Skip to content
This repository was archived by the owner on Jun 24, 2022. It is now read-only.

Commit 442f079

Browse files
author
[email protected]
committed
2011-01-01 Adam Barth <[email protected]>
 Reviewed by Eric Seidel. forbid sandboxed frames to call top.close() when allow-same-origin is not setted https://bugs.webkit.org/show_bug.cgi?id=38340 We now pass the ScriptExecutionContext to window.close so it can find the Frame and check whether navigation is allowed. This check will almost always pass because you can only close top-level frames, but the check will fail when the calling script is sandboxed. Tests: fast/frames/sandboxed-iframe-close-top-noclose.html fast/frames/sandboxed-iframe-close-top.html * page/DOMWindow.cpp: (WebCore::DOMWindow::close): * page/DOMWindow.h: * page/DOMWindow.idl: 2011-01-01 Adam Barth <[email protected]> Reviewed by Eric Seidel. forbid sandboxed frames to call top.close() when allow-same-origin is not setted https://bugs.webkit.org/show_bug.cgi?id=38340 Test the interaction between the HTML5 sandbox and window.close. * fast/frames/resources/close-top.html: Added. * fast/frames/resources/sandboxed-iframe-close-top-does-close.html: Added. * fast/frames/resources/sandboxed-iframe-close-top-does-not-close.html: Added. * fast/frames/sandboxed-iframe-close-top-expected.txt: Added. * fast/frames/sandboxed-iframe-close-top-noclose-expected.txt: Added. * fast/frames/sandboxed-iframe-close-top-noclose.html: Added. * fast/frames/sandboxed-iframe-close-top.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74854 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 14e0854 commit 442f079

12 files changed

+156
-3
lines changed

‎LayoutTests/ChangeLog

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1+
2011-01-01 Adam Barth <[email protected]>
2+
3+
Reviewed by Eric Seidel.
4+
5+
forbid sandboxed frames to call top.close() when allow-same-origin is not setted
6+
https://bugs.webkit.org/show_bug.cgi?id=38340
7+
8+
Test the interaction between the HTML5 sandbox and window.close.
9+
10+
* fast/frames/resources/close-top.html: Added.
11+
* fast/frames/resources/sandboxed-iframe-close-top-does-close.html: Added.
12+
* fast/frames/resources/sandboxed-iframe-close-top-does-not-close.html: Added.
13+
* fast/frames/sandboxed-iframe-close-top-expected.txt: Added.
14+
* fast/frames/sandboxed-iframe-close-top-noclose-expected.txt: Added.
15+
* fast/frames/sandboxed-iframe-close-top-noclose.html: Added.
16+
* fast/frames/sandboxed-iframe-close-top.html: Added.
17+
118
2011-01-01 Justin Schuh <[email protected]>
219

320
Reviewed by Eric Seidel.

‎LayoutTests/fast/frames/resources/close-top.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<script>
2+
top.close()
3+
</script>

‎LayoutTests/fast/frames/resources/sandboxed-iframe-close-top-does-close.html

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<script>
2+
var haveCalledDone = false;
3+
window.addEventListener('beforeunload', function() {
4+
if (!haveCalledDone) {
5+
haveCalledDone = true;
6+
opener.done();
7+
}
8+
}, false);
9+
</script>
10+
<iframe sandbox="allow-scripts allow-top-navigation"
11+
src="close-top.html">
12+
</iframe>

‎LayoutTests/fast/frames/resources/sandboxed-iframe-close-top-does-not-close.html

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<script>
2+
var waitingForClose = true;
3+
window.addEventListener('beforeunload', function() {
4+
if (waitingForClose)
5+
alert("FAIL");
6+
}, false);
7+
8+
window.onload = function() {
9+
// There's no real way to know whether the iframe's attempt to close us
10+
// actually failed because it would succeed asynchronously and there is no
11+
// failure event. The best we can do is wait around for a while. The one
12+
// saving grace is that this test is deterministic when it passes.
13+
window.setTimeout(function() {
14+
waitingForClose = false;
15+
opener.done();
16+
}, 100);
17+
}
18+
</script>
19+
<iframe sandbox="allow-scripts" src="close-top.html"></iframe>

‎LayoutTests/fast/frames/sandboxed-iframe-close-top-expected.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
ALERT: PASS
2+
This test verifies that a sandboxed IFrame can close a top-level frame with allow-top-navigation.
3+
4+
Start Test

‎LayoutTests/fast/frames/sandboxed-iframe-close-top-noclose-expected.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
This test verifies that a sandboxed IFrame can close a top-level frame with allow-top-navigation.
2+
3+
Start Test

‎LayoutTests/fast/frames/sandboxed-iframe-close-top-noclose.html

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<html>
2+
<head>
3+
<script>
4+
if (window.layoutTestController) {
5+
layoutTestController.dumpAsText();
6+
layoutTestController.waitUntilDone();
7+
layoutTestController.setCanOpenWindows();
8+
layoutTestController.setCloseRemainingWindowsWhenComplete(true);
9+
}
10+
</script>
11+
</head>
12+
<body>
13+
<p>This test verifies that a sandboxed IFrame can close a top-level frame
14+
with allow-top-navigation.</p>
15+
<button onclick="start()">Start Test</button>
16+
<script>
17+
function start() {
18+
window.wnd = window.open("resources/sandboxed-iframe-close-top-does-not-close.html");
19+
}
20+
21+
function done() {
22+
if (window.layoutTestController)
23+
layoutTestController.notifyDone();
24+
}
25+
26+
// In LayoutTests mode we can start automagically.
27+
start();
28+
</script>
29+
</body>
30+
</html>

‎LayoutTests/fast/frames/sandboxed-iframe-close-top.html

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<html>
2+
<head>
3+
<script>
4+
if (window.layoutTestController) {
5+
layoutTestController.dumpAsText();
6+
layoutTestController.waitUntilDone();
7+
layoutTestController.setCanOpenWindows();
8+
layoutTestController.setCloseRemainingWindowsWhenComplete(true);
9+
}
10+
</script>
11+
</head>
12+
<body>
13+
<p>This test verifies that a sandboxed IFrame can close a top-level frame
14+
with allow-top-navigation.</p>
15+
<button onclick="start()">Start Test</button>
16+
<script>
17+
function start() {
18+
window.wnd = window.open("resources/sandboxed-iframe-close-top-does-close.html");
19+
}
20+
21+
function done() {
22+
alert("PASS");
23+
// We end the test asynchronously becaues this function is being called
24+
// from a strange callstack.
25+
window.setTimeout(function () {
26+
if (window.layoutTestController)
27+
layoutTestController.notifyDone();
28+
}, 0);
29+
}
30+
31+
// In LayoutTests mode we can start automagically.
32+
start();
33+
</script>
34+
</body>
35+
</html>

‎WebCore/ChangeLog

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
1+
2011-01-01 Adam Barth <[email protected]>
2+
3+
Reviewed by Eric Seidel.
4+
5+
forbid sandboxed frames to call top.close() when allow-same-origin is not setted
6+
https://bugs.webkit.org/show_bug.cgi?id=38340
7+
8+
We now pass the ScriptExecutionContext to window.close so it can find
9+
the Frame and check whether navigation is allowed. This check will
10+
almost always pass because you can only close top-level frames, but the
11+
check will fail when the calling script is sandboxed.
12+
13+
Tests: fast/frames/sandboxed-iframe-close-top-noclose.html
14+
fast/frames/sandboxed-iframe-close-top.html
15+
16+
* page/DOMWindow.cpp:
17+
(WebCore::DOMWindow::close):
18+
* page/DOMWindow.h:
19+
* page/DOMWindow.idl:
20+
121
2011-01-01 Adam Barth <[email protected]>
222

323
Reviewed by Eric Seidel.

‎WebCore/page/DOMWindow.cpp

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -860,7 +860,7 @@ void DOMWindow::blur()
860860
page->chrome()->unfocus();
861861
}
862862

863-
void DOMWindow::close()
863+
void DOMWindow::close(ScriptExecutionContext* context)
864864
{
865865
if (!m_frame)
866866
return;
@@ -872,6 +872,16 @@ void DOMWindow::close()
872872
if (m_frame != page->mainFrame())
873873
return;
874874

875+
if (context) {
876+
ASSERT(WTF::isMainThread());
877+
Frame* activeFrame = static_cast<Document*>(context)->frame();
878+
if (!activeFrame)
879+
return;
880+
881+
if (!activeFrame->loader()->shouldAllowNavigation(m_frame))
882+
return;
883+
}
884+
875885
Settings* settings = m_frame->settings();
876886
bool allowScriptsToCloseWindows = settings && settings->allowScriptsToCloseWindows();
877887

0 commit comments

Comments
 (0)