WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
Patch for landing
bug-158728-20160905155621.patch (text/plain), 23.10 KB, created by
youenn fablet
on 2016-09-05 06:58:44 PDT
(
hide
)
Description:
Patch for landing
Filename:
MIME Type:
Creator:
youenn fablet
Created:
2016-09-05 06:58:44 PDT
Size:
23.10 KB
patch
obsolete
>Subversion Revision: 205450 >diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog >index b3700bf14932180979654b9418f5a397a102cfa3..538bcffb0880fbb039b11a8a48e7b5b97ae770fd 100644 >--- a/Source/WebCore/ChangeLog >+++ b/Source/WebCore/ChangeLog >@@ -1,5 +1,44 @@ > 2016-09-05 Youenn Fablet <youenn@apple.com> > >+ Clean CSS stylesheets should be accessible from JavaScript >+ https://bugs.webkit.org/show_bug.cgi?id=158728 >+ >+ Reviewed by Darin Adler. >+ >+ Covered by updated tests. >+ >+ Making use of the resource response type to evaluate whether to make the CSS stylesheets visible >+ for stylesheet link elements and for stylesheet processing instructions. >+ Ideally, the origin flag should be a boolean. >+ >+ To keep behavior consistent in cors-check-unaware cases, the flag might remain unset. >+ In that case, the behavior remains the same (checking of the stylesheet URL). >+ The origin flag is set to true or false only in case of fetch mode being set to cors using the crossorigin attribute. >+ >+ Updated CSSStyleSheet::create to take a Node reference. Updated callers accordingly. >+ >+ * contentextensions/ContentExtensionStyleSheet.cpp: >+ (WebCore::ContentExtensions::ContentExtensionStyleSheet::ContentExtensionStyleSheet): Updated to pass a Node reference and not pointer. >+ * css/CSSStyleSheet.cpp: >+ (WebCore::CSSStyleSheet::create): Makes origin flag undefined if boolean parameter is not passed. >+ Otherwise origin flag is set according given boolean value. >+ (WebCore::CSSStyleSheet::createInline): Makes origin flag set to true. >+ (WebCore::CSSStyleSheet::CSSStyleSheet): Adding origin flag initialization. >+ (WebCore::CSSStyleSheet::canAccessRules): Returning according the origin flag if set. >+ Returning as before in case the flag is not set. >+ * css/CSSStyleSheet.h: Adding origin clean flag. >+ * dom/ExtensionStyleSheets.cpp: >+ (WebCore::ExtensionStyleSheets::addUserStyleSheet): >+ (WebCore::ExtensionStyleSheets::addAuthorStyleSheetForTesting): >+ (WebCore::ExtensionStyleSheets::maybeAddContentExtensionSheet): >+ * html/HTMLLinkElement.cpp: >+ (WebCore::HTMLLinkElement::initializeStyleSheet): Helper routine used in setCSSStyleSheet. >+ Sets origin clean flag if the resource is clean. >+ (WebCore::HTMLLinkElement::setCSSStyleSheet): Making use of initializeStyleSheet. >+ * html/HTMLLinkElement.h: >+ >+2016-09-05 Youenn Fablet <youenn@apple.com> >+ > CachedResourceLoader is not taking into account fetch options to use or not cached resources > https://bugs.webkit.org/show_bug.cgi?id=161389 > >diff --git a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp >index 44d7c57380a50e58abf2daf3f7ff31dbb04dc97b..e24a3669d872f60c422506b286eafc3e6aff42e4 100644 >--- a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp >+++ b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp >@@ -38,7 +38,7 @@ namespace WebCore { > namespace ContentExtensions { > > ContentExtensionStyleSheet::ContentExtensionStyleSheet(Document& document) >- : m_styleSheet(CSSStyleSheet::create(StyleSheetContents::create(), &document)) >+ : m_styleSheet(CSSStyleSheet::create(StyleSheetContents::create(), document)) > { > m_styleSheet->contents().setIsUserStyleSheet(true); > } >diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp >index 173ebbd7cf99ad0e2587ecdfecab81fefb85615b..1167b0385bdde76be4a873116b833acce7f9d0db 100644 >--- a/Source/WebCore/css/CSSStyleSheet.cpp >+++ b/Source/WebCore/css/CSSStyleSheet.cpp >@@ -78,19 +78,19 @@ static bool isAcceptableCSSStyleSheetParent(Node* parentNode) > #endif > > Ref<CSSStyleSheet> CSSStyleSheet::create(Ref<StyleSheetContents>&& sheet, CSSImportRule* ownerRule) >-{ >+{ > return adoptRef(*new CSSStyleSheet(WTFMove(sheet), ownerRule)); > } > >-Ref<CSSStyleSheet> CSSStyleSheet::create(Ref<StyleSheetContents>&& sheet, Node* ownerNode) >-{ >- return adoptRef(*new CSSStyleSheet(WTFMove(sheet), ownerNode, TextPosition::minimumPosition(), false)); >+Ref<CSSStyleSheet> CSSStyleSheet::create(Ref<StyleSheetContents>&& sheet, Node& ownerNode, const Optional<bool>& isCleanOrigin) >+{ >+ return adoptRef(*new CSSStyleSheet(WTFMove(sheet), ownerNode, TextPosition::minimumPosition(), false, isCleanOrigin)); > } > > Ref<CSSStyleSheet> CSSStyleSheet::createInline(Node& ownerNode, const URL& baseURL, const TextPosition& startPosition, const String& encoding) > { > CSSParserContext parserContext(ownerNode.document(), baseURL, encoding); >- return adoptRef(*new CSSStyleSheet(StyleSheetContents::create(baseURL.string(), parserContext), &ownerNode, startPosition, true)); >+ return adoptRef(*new CSSStyleSheet(StyleSheetContents::create(baseURL.string(), parserContext), ownerNode, startPosition, true, true)); > } > > CSSStyleSheet::CSSStyleSheet(Ref<StyleSheetContents>&& contents, CSSImportRule* ownerRule) >@@ -105,16 +105,17 @@ CSSStyleSheet::CSSStyleSheet(Ref<StyleSheetContents>&& contents, CSSImportRule* > m_contents->registerClient(this); > } > >-CSSStyleSheet::CSSStyleSheet(Ref<StyleSheetContents>&& contents, Node* ownerNode, const TextPosition& startPosition, bool isInlineStylesheet) >+CSSStyleSheet::CSSStyleSheet(Ref<StyleSheetContents>&& contents, Node& ownerNode, const TextPosition& startPosition, bool isInlineStylesheet, const Optional<bool>& isOriginClean) > : m_contents(WTFMove(contents)) > , m_isInlineStylesheet(isInlineStylesheet) > , m_isDisabled(false) > , m_mutatedRules(false) >- , m_ownerNode(ownerNode) >+ , m_isOriginClean(isOriginClean) >+ , m_ownerNode(&ownerNode) > , m_ownerRule(0) > , m_startPosition(startPosition) > { >- ASSERT(isAcceptableCSSStyleSheetParent(ownerNode)); >+ ASSERT(isAcceptableCSSStyleSheetParent(&ownerNode)); > m_contents->registerClient(this); > } > >@@ -258,17 +259,16 @@ CSSRule* CSSStyleSheet::item(unsigned index) > > bool CSSStyleSheet::canAccessRules() const > { >- if (m_isInlineStylesheet) >- return true; >+ if (m_isOriginClean) >+ return m_isOriginClean.value(); >+ > URL baseURL = m_contents->baseURL(); > if (baseURL.isEmpty()) > return true; > Document* document = ownerDocument(); > if (!document) > return true; >- if (document->securityOrigin()->canRequest(baseURL)) >- return true; >- return false; >+ return document->securityOrigin()->canRequest(baseURL); > } > > RefPtr<CSSRuleList> CSSStyleSheet::rules() >diff --git a/Source/WebCore/css/CSSStyleSheet.h b/Source/WebCore/css/CSSStyleSheet.h >index e1225bec9cf545744c9f3ca4a538c177dbc55f3f..4bd11114f9da43e4fff2bfa67833243b55c8b42d 100644 >--- a/Source/WebCore/css/CSSStyleSheet.h >+++ b/Source/WebCore/css/CSSStyleSheet.h >@@ -49,7 +49,7 @@ typedef int ExceptionCode; > class CSSStyleSheet final : public StyleSheet { > public: > static Ref<CSSStyleSheet> create(Ref<StyleSheetContents>&&, CSSImportRule* ownerRule = 0); >- static Ref<CSSStyleSheet> create(Ref<StyleSheetContents>&&, Node* ownerNode); >+ static Ref<CSSStyleSheet> create(Ref<StyleSheetContents>&&, Node& ownerNode, const Optional<bool>& isOriginClean = Nullopt); > static Ref<CSSStyleSheet> createInline(Node&, const URL&, const TextPosition& startPosition = TextPosition::minimumPosition(), const String& encoding = String()); > > virtual ~CSSStyleSheet(); >@@ -125,16 +125,18 @@ public: > private: > CSSStyleSheet(Ref<StyleSheetContents>&&, CSSImportRule* ownerRule); > CSSStyleSheet(Ref<StyleSheetContents>&&, Node* ownerNode, const TextPosition& startPosition, bool isInlineStylesheet); >+ CSSStyleSheet(Ref<StyleSheetContents>&&, Node& ownerNode, const TextPosition& startPosition, bool isInlineStylesheet, const Optional<bool>&); > > bool isCSSStyleSheet() const final { return true; } > String type() const final { return ASCIILiteral("text/css"); } > > bool canAccessRules() const; >- >+ > Ref<StyleSheetContents> m_contents; > bool m_isInlineStylesheet; > bool m_isDisabled; > bool m_mutatedRules; >+ Optional<bool> m_isOriginClean; > String m_title; > RefPtr<MediaQuerySet> m_mediaQueries; > >diff --git a/Source/WebCore/dom/ExtensionStyleSheets.cpp b/Source/WebCore/dom/ExtensionStyleSheets.cpp >index e569e20559a0f2234840ce5a7fe00c4650e441ab..f9ec4ed7e69d5d335a217d11a684657c178b6759 100644 >--- a/Source/WebCore/dom/ExtensionStyleSheets.cpp >+++ b/Source/WebCore/dom/ExtensionStyleSheets.cpp >@@ -160,14 +160,14 @@ void ExtensionStyleSheets::invalidateInjectedStyleSheetCache() > void ExtensionStyleSheets::addUserStyleSheet(Ref<StyleSheetContents>&& userSheet) > { > ASSERT(userSheet.get().isUserStyleSheet()); >- m_userStyleSheets.append(CSSStyleSheet::create(WTFMove(userSheet), &m_document)); >+ m_userStyleSheets.append(CSSStyleSheet::create(WTFMove(userSheet), m_document)); > m_document.styleResolverChanged(RecalcStyleImmediately); > } > > void ExtensionStyleSheets::addAuthorStyleSheetForTesting(Ref<StyleSheetContents>&& authorSheet) > { > ASSERT(!authorSheet.get().isUserStyleSheet()); >- m_authorStyleSheetsForTesting.append(CSSStyleSheet::create(WTFMove(authorSheet), &m_document)); >+ m_authorStyleSheetsForTesting.append(CSSStyleSheet::create(WTFMove(authorSheet), m_document)); > m_document.styleResolverChanged(RecalcStyleImmediately); > } > >@@ -191,7 +191,7 @@ void ExtensionStyleSheets::maybeAddContentExtensionSheet(const String& identifie > if (m_contentExtensionSheets.contains(identifier)) > return; > >- Ref<CSSStyleSheet> cssSheet = CSSStyleSheet::create(sheet, &m_document); >+ Ref<CSSStyleSheet> cssSheet = CSSStyleSheet::create(sheet, m_document); > m_contentExtensionSheets.set(identifier, &cssSheet.get()); > m_userStyleSheets.append(adoptRef(cssSheet.leakRef())); > m_styleResolverChangedTimer.startOneShot(0); >diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp >index 312f66f5e8b293d93f7a95a71af3337237d3cd45..04f3499f3bc69edbc9d579745f677a9bb52cf0e2 100644 >--- a/Source/WebCore/html/HTMLLinkElement.cpp >+++ b/Source/WebCore/html/HTMLLinkElement.cpp >@@ -339,6 +339,18 @@ void HTMLLinkElement::finishParsingChildren() > HTMLElement::finishParsingChildren(); > } > >+void HTMLLinkElement::initializeStyleSheet(Ref<StyleSheetContents>&& styleSheet, const CachedCSSStyleSheet& cachedStyleSheet) >+{ >+ // FIXME: originClean should be turned to false except if fetch mode is CORS. >+ Optional<bool> originClean; >+ if (cachedStyleSheet.options().mode == FetchOptions::Mode::Cors) >+ originClean = cachedStyleSheet.isClean(); >+ >+ m_sheet = CSSStyleSheet::create(WTFMove(styleSheet), *this, originClean); >+ m_sheet->setMediaQueries(MediaQuerySet::createAllowingDescriptionSyntax(m_media)); >+ m_sheet->setTitle(title()); >+} >+ > void HTMLLinkElement::setCSSStyleSheet(const String& href, const URL& baseURL, const String& charset, const CachedCSSStyleSheet* cachedStyleSheet) > { > if (!inDocument()) { >@@ -358,10 +370,7 @@ void HTMLLinkElement::setCSSStyleSheet(const String& href, const URL& baseURL, c > if (RefPtr<StyleSheetContents> restoredSheet = const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->restoreParsedStyleSheet(parserContext, cachePolicy)) { > ASSERT(restoredSheet->isCacheable()); > ASSERT(!restoredSheet->isLoading()); >- >- m_sheet = CSSStyleSheet::create(restoredSheet.releaseNonNull(), this); >- m_sheet->setMediaQueries(MediaQuerySet::createAllowingDescriptionSyntax(m_media)); >- m_sheet->setTitle(title()); >+ initializeStyleSheet(restoredSheet.releaseNonNull(), *cachedStyleSheet); > > m_loading = false; > sheetLoaded(); >@@ -370,9 +379,7 @@ void HTMLLinkElement::setCSSStyleSheet(const String& href, const URL& baseURL, c > } > > auto styleSheet = StyleSheetContents::create(href, parserContext); >- m_sheet = CSSStyleSheet::create(styleSheet.copyRef(), this); >- m_sheet->setMediaQueries(MediaQuerySet::createAllowingDescriptionSyntax(m_media)); >- m_sheet->setTitle(title()); >+ initializeStyleSheet(styleSheet.copyRef(), *cachedStyleSheet); > > styleSheet.get().parseAuthorStyleSheet(cachedStyleSheet, document().securityOrigin()); > >diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h >index 9b0f694b023c42b28ca8d0b8894e30232350fc12..d1ea76d0dcbdedde9027fca4bda9af2957547444 100644 >--- a/Source/WebCore/html/HTMLLinkElement.h >+++ b/Source/WebCore/html/HTMLLinkElement.h >@@ -82,6 +82,8 @@ private: > InsertionNotificationRequest insertedInto(ContainerNode&) final; > void removedFrom(ContainerNode&) final; > >+ void initializeStyleSheet(Ref<StyleSheetContents>&&, const CachedCSSStyleSheet&); >+ > // from CachedResourceClient > void setCSSStyleSheet(const String& href, const URL& baseURL, const String& charset, const CachedCSSStyleSheet*) final; > bool sheetLoaded() final; >diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog >index b11045dedad55de1342abd1d81ae6d51d5eae270..9219724d9cb06b9f7953a8caa8f868f49ccf5126 100644 >--- a/LayoutTests/ChangeLog >+++ b/LayoutTests/ChangeLog >@@ -1,5 +1,19 @@ > 2016-09-05 Youenn Fablet <youenn@apple.com> > >+ Clean CSS stylesheets should be accessible from JavaScript >+ https://bugs.webkit.org/show_bug.cgi?id=158728 >+ >+ Reviewed by Darin Adler. >+ >+ * http/tests/security/cannot-read-cssrules-expected.txt: >+ * http/tests/security/cannot-read-cssrules-redirect-expected.txt: >+ * http/tests/security/cannot-read-cssrules-redirect.html: >+ * http/tests/security/cannot-read-cssrules.html: >+ * http/tests/security/cross-origin-css-9.html: >+ * http/tests/security/resources/xorigincss1-allow-star.php: Added. >+ >+2016-09-05 Youenn Fablet <youenn@apple.com> >+ > CachedResourceLoader is not taking into account fetch options to use or not cached resources > https://bugs.webkit.org/show_bug.cgi?id=161389 > >diff --git a/LayoutTests/http/tests/security/cannot-read-cssrules-expected.txt b/LayoutTests/http/tests/security/cannot-read-cssrules-expected.txt >index 7a78babc2a5d8447f04b594bb22d0e2ae4296435..76b3b9732a5299b52c8aa9252de3775e2c738101 100644 >--- a/LayoutTests/http/tests/security/cannot-read-cssrules-expected.txt >+++ b/LayoutTests/http/tests/security/cannot-read-cssrules-expected.txt >@@ -1,10 +1,21 @@ >+CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin. > This test whether a script can read the rules from a cross-origin style sheet. For more information on why we block this, please see https://bugs.webkit.org/show_bug.cgi?id=20527. > > Test begins. >-== Cross-Origin == >+== Cross-Origin resource, no-cors mode == > cssRules: null > rules: null >-== Same-Origin == >+== Same-Origin resource, no-cors mode == > cssRules: [object CSSRuleList] >+cssRules length: 1 > rules: [object CSSRuleList] >+rules length: 1 >+== Cross-Origin resource, cors mode, failing cors check == >+cssRules: null >+rules: null >+== Cross-Origin resource, cors mode, successful cors check == >+cssRules: [object CSSRuleList] >+cssRules length: 1 >+rules: [object CSSRuleList] >+rules length: 1 > Test ends. >diff --git a/LayoutTests/http/tests/security/cannot-read-cssrules-redirect-expected.txt b/LayoutTests/http/tests/security/cannot-read-cssrules-redirect-expected.txt >index 062646fd42d9feb8d3ce3efe80a7845d7e6a2396..f1f4c050863108e253d818c6e43831e53e5d408a 100644 >--- a/LayoutTests/http/tests/security/cannot-read-cssrules-redirect-expected.txt >+++ b/LayoutTests/http/tests/security/cannot-read-cssrules-redirect-expected.txt >@@ -1,10 +1,26 @@ >+CONSOLE MESSAGE: Cross-origin redirection to http://127.0.0.1:8000/security/resources/xorigincss1.css denied by Cross-Origin Resource Sharing policy: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin. > This test whether a script can read the rules from a cross-origin style sheet in the presence of redirects. For more information on why we block this, please see https://bugs.webkit.org/show_bug.cgi?id=20527. > > Test begins. >-== Same-Origin to Cross-Origin == >+== Same-Origin to Cross-Origin, no-cors mode == > cssRules: null > rules: null >-== Cross-Origin to Same-Origin == >+== Cross-Origin to Same-Origin, no-cors mode == > cssRules: [object CSSRuleList] >+cssRules length: 1 > rules: [object CSSRuleList] >+rules length: 1 >+== Same-Origin to Same-Origin, cors mode == >+cssRules: [object CSSRuleList] >+cssRules length: 1 >+rules: [object CSSRuleList] >+rules length: 1 >+== Cross-Origin to Same-Origin, cors mode, successful cors check == >+cssRules: [object CSSRuleList] >+cssRules length: 1 >+rules: [object CSSRuleList] >+rules length: 1 >+== Cross-Origin to Same-Origin, cors mode, failing cors check == >+cssRules: null >+rules: null > Test ends. >diff --git a/LayoutTests/http/tests/security/cannot-read-cssrules-redirect.html b/LayoutTests/http/tests/security/cannot-read-cssrules-redirect.html >index a45a3850b295c335c5ef03203bd679fdd1744f72..cfef9b56962ca758b947ddee3af486504f16ab0d 100644 >--- a/LayoutTests/http/tests/security/cannot-read-cssrules-redirect.html >+++ b/LayoutTests/http/tests/security/cannot-read-cssrules-redirect.html >@@ -5,6 +5,12 @@ > href="/resources/redirect.php?url=http://localhost:8000/security/resources/cssStyle.css"> > <link rel="stylesheet" > href="http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/security/resources/cssStyle.css"> >+<link rel="stylesheet" >+ href="/resources/redirect.php?url=http://127.0.0.1:8000/security/resources/cssStyle.css" crossorigin=""> >+<link rel="stylesheet" >+ href="http://localhost:8000/security/resources/redirect-allow-star.php?url=http://127.0.0.1:8000/security/resources/xorigincss1-allow-star.php" crossorigin=""> >+<link rel="stylesheet" >+ href="http://localhost:8000/resources/redirect.php?url=http://127.0.0.1:8000/security/resources/xorigincss1.css" crossorigin=""> > <script> > if (window.testRunner) > testRunner.dumpAsText(); >@@ -15,16 +21,38 @@ function log(msg) { > document.getElementById("console").appendChild(div); > } > >+function checkCSSRules(sheet) >+{ >+ try { >+ var cssRules = sheet.cssRules; >+ log("cssRules: " + cssRules); >+ if (cssRules) >+ log("cssRules length: " + cssRules.length); >+ } catch(e) { >+ log("exception thrown for cssRules: " + e); >+ } >+ try { >+ var rules = sheet.rules; >+ log("rules: " + rules); >+ if (rules) >+ log("rules length: " + rules.length); >+ } catch(e) { >+ log("exception thrown for rules: " + e); >+ } >+} >+ > window.onload = function() { > log("Test begins."); >- log("== Same-Origin to Cross-Origin =="); >- var sheet1 = document.styleSheets[0]; >- log("cssRules: " + sheet1.cssRules); >- log("rules: " + sheet1.rules); >- log("== Cross-Origin to Same-Origin =="); >- var sheet2 = document.styleSheets[1]; >- log("cssRules: " + sheet2.cssRules); >- log("rules: " + sheet2.rules); >+ log("== Same-Origin to Cross-Origin, no-cors mode =="); >+ checkCSSRules(document.styleSheets[0]); >+ log("== Cross-Origin to Same-Origin, no-cors mode =="); >+ checkCSSRules(document.styleSheets[1]); >+ log("== Same-Origin to Same-Origin, cors mode =="); >+ checkCSSRules(document.styleSheets[2]); >+ log("== Cross-Origin to Same-Origin, cors mode, successful cors check =="); >+ checkCSSRules(document.styleSheets[3]); >+ log("== Cross-Origin to Same-Origin, cors mode, failing cors check =="); >+ checkCSSRules(document.styleSheets[4]); > log("Test ends."); > } > </script> >diff --git a/LayoutTests/http/tests/security/cannot-read-cssrules.html b/LayoutTests/http/tests/security/cannot-read-cssrules.html >index 626092bd43d985f180d4fcfca8987d70d61040b5..63fd6ce180968e43810bdef8378aede03f6e51bb 100644 >--- a/LayoutTests/http/tests/security/cannot-read-cssrules.html >+++ b/LayoutTests/http/tests/security/cannot-read-cssrules.html >@@ -4,6 +4,10 @@ > <link rel="stylesheet" > href="http://localhost:8000/security/resources/cssStyle.css"> > <link rel="stylesheet" href="resources/cssStyle.css"> >+<link rel="stylesheet" >+ href="http://localhost:8000/security/resources/cssStyle.css" crossorigin=""> >+<link rel="stylesheet" >+ href="http://localhost:8000/security/resources/xorigincss1-allow-star.php" crossorigin=""> > <script> > if (window.testRunner) > testRunner.dumpAsText(); >@@ -14,16 +18,36 @@ function log(msg) { > document.getElementById("console").appendChild(div); > } > >+function checkCSSRules(sheet) >+{ >+ try { >+ var cssRules = sheet.cssRules; >+ log("cssRules: " + cssRules); >+ if (cssRules) >+ log("cssRules length: " + cssRules.length); >+ } catch(e) { >+ log("exception thrown for cssRules: " + e); >+ } >+ try { >+ var rules = sheet.rules; >+ log("rules: " + rules); >+ if (rules) >+ log("rules length: " + rules.length); >+ } catch(e) { >+ log("exception thrown for rules: " + e); >+ } >+} >+ > window.onload = function() { > log("Test begins."); >- log("== Cross-Origin =="); >- var sheet1 = document.styleSheets[0]; >- log("cssRules: " + sheet1.cssRules); >- log("rules: " + sheet1.rules); >- log("== Same-Origin =="); >- var sheet2 = document.styleSheets[1]; >- log("cssRules: " + sheet2.cssRules); >- log("rules: " + sheet2.rules); >+ log("== Cross-Origin resource, no-cors mode =="); >+ checkCSSRules(document.styleSheets[0]); >+ log("== Same-Origin resource, no-cors mode =="); >+ checkCSSRules(document.styleSheets[1]); >+ log("== Cross-Origin resource, cors mode, failing cors check =="); >+ checkCSSRules(document.styleSheets[2]); >+ log("== Cross-Origin resource, cors mode, successful cors check =="); >+ checkCSSRules(document.styleSheets[3]); > log("Test ends."); > } > </script> >diff --git a/LayoutTests/http/tests/security/cross-origin-css-9.html b/LayoutTests/http/tests/security/cross-origin-css-9.html >index 61b250248aba91b48ff28b41ef4faee4477a7524..5b9061efb916d2a87eb8593731c13c27504746ff 100644 >--- a/LayoutTests/http/tests/security/cross-origin-css-9.html >+++ b/LayoutTests/http/tests/security/cross-origin-css-9.html >@@ -21,8 +21,7 @@ function checkCSSLoading(id, expectToIncludeOrigin, expectVisibility) > { > expectedColor = expectToIncludeOrigin ? "rgb(255, 255, 0)" : "rgb(0, 0, 255)"; > assert_equals(getBackgroundColorForId(id), expectedColor); >- // FIXME: cssRules should be made visible according resource tainted status, not only based on the resource URL being cross origin. >- // assert_equals(document.getElementById("link-" + id).sheet.cssRules !== null, expectVisibility); >+ assert_equals(document.getElementById("link-" + id).sheet.cssRules !== null, expectVisibility); > } > > var onloadTest = async_test(" Testing that link element to load stylesheets correctly handle crossorigin mode."); >diff --git a/LayoutTests/http/tests/security/resources/xorigincss1-allow-star.php b/LayoutTests/http/tests/security/resources/xorigincss1-allow-star.php >new file mode 100644 >index 0000000000000000000000000000000000000000..4479844148f409d2047bc207bbe2e3f5a4460378 >--- /dev/null >+++ b/LayoutTests/http/tests/security/resources/xorigincss1-allow-star.php >@@ -0,0 +1,11 @@ >+<?php >+header("Access-Control-Allow-Origin: *"); >+ >+$name = 'xorigincss1.css'; >+$fp = fopen($name, 'rb'); >+header("Content-Type: text/css"); >+header("Content-Length: " . filesize($name)); >+ >+fpassthru($fp); >+exit; >+?>
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=287949">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 158728
:
281251
|
281358
|
281836
|
281908
|
285101
|
287949
|
287953