Attachment 178218 Details for Bug 104365 – Patch

[patch] Patch

bug-104365-20121207164521.patch (text/plain), 16.53 KB, created by Mike West on 2012-12-07 07:47:58 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Mike West

Created: 2012-12-07 07:47:58 PST

Size: 16.53 KB

patch

obsolete

>Subversion Revision: 136948
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 8b333fbe6c3be03c1ad44f9b7fdb646993430311..94c4da7090b9b6d8960b69ad09199e0899996b11 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2012-12-07  Mike West  <mkwst@chromium.org>
>+
>+        Log to console when script is blocked by sandbox attributes.
>+        https://bugs.webkit.org/show_bug.cgi?id=104365
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Adds a console message to cover script execution blocked within the
>+        context of a sandboxed frame which lacks the 'allow-scripts' permission.
>+
>+        * bindings/ScriptControllerBase.cpp:
>+        (WebCore::ScriptController::canExecuteScripts):
>+            Log a warning when sandboxing flags block script execution.
>+
> 2012-12-07  Alexander Pavlov  <apavlov@chromium.org>
> 
>         Web Inspector: the "Sources" column is always empty in CSS selector profiles
>diff --git a/Source/WebCore/bindings/ScriptControllerBase.cpp b/Source/WebCore/bindings/ScriptControllerBase.cpp
>index cc52463621e0410f7bb35c5b9bcbc9866c1b7f70..854d586a20ccddaf4f1d7b242dccae191931eaa3 100644
>--- a/Source/WebCore/bindings/ScriptControllerBase.cpp
>+++ b/Source/WebCore/bindings/ScriptControllerBase.cpp
>@@ -38,8 +38,12 @@ namespace WebCore {
> 
> bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reason)
> {
>-    if (m_frame->document() && m_frame->document()->isSandboxed(SandboxScripts))
>+    if (m_frame->document() && m_frame->document()->isSandboxed(SandboxScripts)) {
>+        // FIXME: This message should be moved off the console once a solution to https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
>+        if (reason == AboutToExecuteScript)
>+            m_frame->document()->addConsoleMessage(HTMLMessageSource, LogMessageType, ErrorMessageLevel, "Blocked script execution in '" + m_frame->document()->url().string() + "' because the document's frame is sandboxed and the 'allow-scripts' permission is not set."); 
>         return false;
>+    }
> 
>     if (m_frame->document() && m_frame->document()->isViewSource()) {
>         ASSERT(m_frame->document()->securityOrigin()->isUnique());
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index cee70c156d79e0e6f5fe64dabf9271ca5c2a8e70..27dfab5967f8e0d3504c6e70b668e2f1243b4b11 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,24 @@
>+2012-12-07  Mike West  <mkwst@chromium.org>
>+
>+        Log to console when script is blocked by sandbox attributes.
>+        https://bugs.webkit.org/show_bug.cgi?id=104365
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/frames/sandboxed-iframe-attribute-parsing-expected.txt:
>+        * fast/frames/sandboxed-iframe-autofocus-denied-expected.txt:
>+        * fast/frames/sandboxed-iframe-parsing-space-characters-expected.txt:
>+        * fast/frames/sandboxed-iframe-scripting-expected.txt:
>+        * http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt:
>+        * http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt:
>+        * http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt:
>+        * http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt:
>+        * http/tests/security/contentSecurityPolicy/sandbox-invalid-header-expected.txt:
>+        * http/tests/security/isolatedWorld/sandboxed-iframe-expected.txt:
>+        * http/tests/security/sandbox-inherit-to-initial-document-2-expected.txt:
>+        * media/video-controls-no-scripting-expected.txt:
>+            Rebaselining tests with new expectations.
>+
> 2012-12-07  Alexander Pavlov  <apavlov@chromium.org>
> 
>         Web Inspector: the "Sources" column is always empty in CSS selector profiles
>diff --git a/LayoutTests/fast/frames/sandboxed-iframe-attribute-parsing-expected.txt b/LayoutTests/fast/frames/sandboxed-iframe-attribute-parsing-expected.txt
>index e29e6b4f083274ca7bbff49e758df824fe2cf193..9b867a81bf130788bd329f05214363b1cae3070b 100644
>--- a/LayoutTests/fast/frames/sandboxed-iframe-attribute-parsing-expected.txt
>+++ b/LayoutTests/fast/frames/sandboxed-iframe-attribute-parsing-expected.txt
>@@ -11,6 +11,14 @@ CONSOLE MESSAGE: Blocked form submission to 'javascript:top.disallowedFormSubmit
> CONSOLE MESSAGE: Blocked form submission to 'javascript:top.disallowedFormSubmitted();' because the form's frame is sandboxed and the 'allow-forms' permission is not set.
> CONSOLE MESSAGE: Blocked form submission to 'javascript:top.disallowedFormSubmitted();' because the form's frame is sandboxed and the 'allow-forms' permission is not set.
> CONSOLE MESSAGE: Blocked form submission to 'javascript:top.disallowedFormSubmitted();' because the form's frame is sandboxed and the 'allow-forms' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: Blocked script execution in 'sandboxed-iframe-attribute-parsing-disallowed.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> This test case verifies the parsing of the iframe sandbox attribute. Two sets of iframes are used: one where scripting is allowed, and another one where it is disallowed. The test verifies that the allowed frames execute scripts (but other sandboxed properties still apply -- specifically, forms are disabled), and the disallowed ones do not. If successful the test prints "PASS".
> 
>                   
>diff --git a/LayoutTests/fast/frames/sandboxed-iframe-autofocus-denied-expected.txt b/LayoutTests/fast/frames/sandboxed-iframe-autofocus-denied-expected.txt
>index 0a94ce86c7f983c1824d82a50ecdaae2c9236f05..0ce83937504ad1b52054410b8610010f76e1c2c0 100644
>--- a/LayoutTests/fast/frames/sandboxed-iframe-autofocus-denied-expected.txt
>+++ b/LayoutTests/fast/frames/sandboxed-iframe-autofocus-denied-expected.txt
>@@ -1,3 +1,4 @@
>+CONSOLE MESSAGE: line 1: Blocked script execution in 'about:srcdoc' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> CONSOLE MESSAGE: line 1: Blocked autofocusing on a form control because the form's frame is sandboxed and the 'allow-scripts' permission is not set.
> CONSOLE MESSAGE: line 13: PASS: The input element is not focused.
> This test passes if the input element in the sandboxed frame is not automatically focused upon, as it should be blocked by the sandboxed scripts flag. A console warning to that effect should also be present.
>diff --git a/LayoutTests/fast/frames/sandboxed-iframe-parsing-space-characters-expected.txt b/LayoutTests/fast/frames/sandboxed-iframe-parsing-space-characters-expected.txt
>index 9bbfdffc485d75292d928768801cf3d2525f6fa9..46858a4c7b120b839e9d4a65234e5fbfd4394181 100644
>--- a/LayoutTests/fast/frames/sandboxed-iframe-parsing-space-characters-expected.txt
>+++ b/LayoutTests/fast/frames/sandboxed-iframe-parsing-space-characters-expected.txt
>@@ -1,8 +1,10 @@
> ALERT: PASS: Form feed is a delimiter.
> CONSOLE MESSAGE: Error while parsing the 'sandbox' attribute: 'allow-scriptsallow-forms' is an invalid sandbox flag.
>+CONSOLE MESSAGE: Blocked script execution in 'data:text/html,<script>alert('FAIL: Vertical tab is not a delimiter.');</script>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> ALERT: PASS: Newline is a delimiter.
> ALERT: PASS: Return is a delimiter.
> CONSOLE MESSAGE: Error while parsing the 'sandbox' attribute: 'allow-scriptsxallow-forms' is an invalid sandbox flag.
>+CONSOLE MESSAGE: Blocked script execution in 'data:text/html,<script>alert('FAIL: x is not a delimiter.');</script>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> ALERT: PASS: Tab is a delimiter.
> ALERT: PASS: Space is a delimiter character.
> This tests whether we correct parse various space characters in the sandbox attribute.
>diff --git a/LayoutTests/fast/frames/sandboxed-iframe-scripting-expected.txt b/LayoutTests/fast/frames/sandboxed-iframe-scripting-expected.txt
>index fd4dd3971abafe8cced77e17db24f0ffb2273095..1cf85bb25bbcdc7b73b768e52aa54d9181d96f77 100644
>--- a/LayoutTests/fast/frames/sandboxed-iframe-scripting-expected.txt
>+++ b/LayoutTests/fast/frames/sandboxed-iframe-scripting-expected.txt
>@@ -1,4 +1,6 @@
>+CONSOLE MESSAGE: Blocked script execution in 'about:blank' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> ALERT: PASS: Executed script in data URL
>+CONSOLE MESSAGE: Blocked script execution in 'data:text/html,<script> alert('FAIL: Executed script without allow-scripts in data URL'); </script>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> Verify that sandboxed frames with sandbox="allow-scripts" can execute scripts, but other sandboxed frames cannot. Also verify that removing the sandbox="allow-scripts" attribute at runtime prevents new scripts from launching, but existing ones keep running.
> 
> On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt
>index 76e561d50a3d00d65ff9def289469c2cd401fcb3..d489c2ea6f882e02f969e3562601e069925f4a6b 100644
>--- a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt
>@@ -1 +1,2 @@
>+CONSOLE MESSAGE: Blocked script execution in 'http://127.0.0.1:8000/security/contentSecurityPolicy/sandbox-empty.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> This test passes if it doesn't alert fail.
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt
>index a8589f6afd937d96201f3a7b7422d04f7da7514c..a638752e27b227ed6b5048054347461bd55ea68e 100644
>--- a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt
>@@ -1 +1,2 @@
>+CONSOLE MESSAGE: Blocked script execution in 'data:text/html,<script>alert('FAIL');</script>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> This test passes if it doesn't alert fail. 
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt
>index 2178e28b5c8db01c080db80dd394270d5c21ec1e..ab6c0d0700f4bdc6ededfcdab1fab6887e0e1e30 100644
>--- a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-control-expected.txt
>@@ -1,2 +1,3 @@
>+CONSOLE MESSAGE: Blocked script execution in 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/sandbox.php?sandbox=allow-top-navigation%20allow-same-origin' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> ALERT: PASS: Iframe was not in a unique origin
> 
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt
>index 68f65a596d7ca65d9ce3c771489e6c98e7aec513..23a890df130d09ed390bd03d13f0fc57fdd0e5da 100644
>--- a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt
>@@ -1,3 +1,4 @@
>+CONSOLE MESSAGE: Blocked script execution in 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/sandbox.php?sandbox=allow-top-navigation' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> CONSOLE MESSAGE: Sandbox access violation: Unsafe JavaScript attempt to access frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/resources/sandbox.php?sandbox=allow-top-navigation from frame with URL http://127.0.0.1:8000/security/contentSecurityPolicy/sandbox-in-http-header.html. The frame being accessed is sandboxed into a unique origin.
> 
> ALERT: PASS: Iframe was in a unique origin
>diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-invalid-header-expected.txt b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-invalid-header-expected.txt
>index f97c7c5e3bde7d194652fe060fe38dc111490d3a..8b9260af2883641f26e375079289661b559b1590 100644
>--- a/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-invalid-header-expected.txt
>+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-invalid-header-expected.txt
>@@ -1,2 +1,3 @@
> CONSOLE MESSAGE: Error while parsing the 'sandbox' Content Security Policy directive: 'allowScript' is an invalid sandbox flag.
>+CONSOLE MESSAGE: Blocked script execution in 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/sandbox.php?sandbox=allowScript' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> 
>diff --git a/LayoutTests/http/tests/security/isolatedWorld/sandboxed-iframe-expected.txt b/LayoutTests/http/tests/security/isolatedWorld/sandboxed-iframe-expected.txt
>index 4545e94e2baf6a7dcefdd04ec1866799961ec092..622a16735e6893cc0adea40a837083b7d5f9c201 100644
>--- a/LayoutTests/http/tests/security/isolatedWorld/sandboxed-iframe-expected.txt
>+++ b/LayoutTests/http/tests/security/isolatedWorld/sandboxed-iframe-expected.txt
>@@ -1,3 +1,4 @@
>+CONSOLE MESSAGE: Blocked script execution in 'http://127.0.0.1:8000/security/isolatedWorld/resources/fail.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> ALERT: PASS
> Test that executing scripts in an isolated world works even inside sandboxed iframes. The test passes, if an alert with the text "PASS" is shown.
> 
>diff --git a/LayoutTests/http/tests/security/sandbox-inherit-to-initial-document-2-expected.txt b/LayoutTests/http/tests/security/sandbox-inherit-to-initial-document-2-expected.txt
>index 00b2dc5654be65c8e3e083e87da8ab7479daa758..3c4b6b3d7f59d12a4b78d687ab8b3ab7f4096e79 100644
>--- a/LayoutTests/http/tests/security/sandbox-inherit-to-initial-document-2-expected.txt
>+++ b/LayoutTests/http/tests/security/sandbox-inherit-to-initial-document-2-expected.txt
>@@ -1,3 +1,4 @@
>+CONSOLE MESSAGE: Blocked script execution in 'about:blank' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> Test how sandbox flags get inherited to initial document in subframe.
> 
> PASS
>diff --git a/LayoutTests/media/video-controls-no-scripting-expected.txt b/LayoutTests/media/video-controls-no-scripting-expected.txt
>index 4b245bb77ae3908620f6e9dd4bd15616e841cc57..021e60a282054f750c9dea8d4954a9652cc30f3a 100644
>--- a/LayoutTests/media/video-controls-no-scripting-expected.txt
>+++ b/LayoutTests/media/video-controls-no-scripting-expected.txt
>@@ -1,3 +1,5 @@
>+CONSOLE MESSAGE: Blocked script execution in 'video-controls-no-scripting-iframe.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
>+CONSOLE MESSAGE: line 13: Blocked script execution in 'video-controls-no-scripting-iframe.html' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
> 
> Tests that the built-in controls are always enabled when JavaScript is disabled.
>

Actions: View | Formatted Diff | Diff

Attachments on bug 104365: 178205 | 178218 | 178376 | 178520