projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: c68e66d)
Replace [CheckNodeSecurity] with [CheckAccessToNode]
authorharaken@chromium.org <haraken@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 8 Feb 2012 08:13:58 +0000 (08:13 +0000)
committerharaken@chromium.org <haraken@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 8 Feb 2012 08:13:58 +0000 (08:13 +0000)
https://bugs.webkit.org/show_bug.cgi?id=77971

Reviewed by Adam Barth.

Source/WebCore:

[CheckNodeSecurity] is not implemented by code generators.
This patch replaces [CheckNodeSecurity] with [CheckAccessToNode].

Test: http/tests/security/cross-frame-access-frameelement.html

* page/DOMWindow.idl:

LayoutTests:

The added test checks if frameElement is accessible from the same or cross origin iframe.

* http/tests/security/cross-frame-access-frameelement-expected.txt: Added.
* http/tests/security/cross-frame-access-frameelement.html: Added.
* http/tests/security/resources/cross-frame-access-frameelement-from-iframe.html: Added.
* platform/chromium/http/tests/security/cross-frame-access-put-expected.txt: Updated the test result.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107046 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/http/tests/security/cross-frame-access-frameelement-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/http/tests/security/cross-frame-access-frameelement.html [new file with mode: 0644] patch | blob
LayoutTests/http/tests/security/resources/cross-frame-access-frameelement-from-iframe.html [new file with mode: 0644] patch | blob
LayoutTests/platform/chromium/http/tests/security/cross-frame-access-put-expected.txt patch | blob | history
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/page/DOMWindow.idl patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index f90b26c..ec038c7 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2012-02-08  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [CheckNodeSecurity] with [CheckAccessToNode]
+        https://bugs.webkit.org/show_bug.cgi?id=77971
+
+        Reviewed by Adam Barth.
+
+        The added test checks if frameElement is accessible from the same or cross origin iframe.
+
+        * http/tests/security/cross-frame-access-frameelement-expected.txt: Added.
+        * http/tests/security/cross-frame-access-frameelement.html: Added.
+        * http/tests/security/resources/cross-frame-access-frameelement-from-iframe.html: Added.
+        * platform/chromium/http/tests/security/cross-frame-access-put-expected.txt: Updated the test result.
+
 2012-02-07  Robert Kroeger  <rjkroege@chromium.org>
 
         [chromium] Remove unnecessary Chromium gesture recognizer tests.
diff --git a/LayoutTests/http/tests/security/cross-frame-access-frameelement-expected.txt b/LayoutTests/http/tests/security/cross-frame-access-frameelement-expected.txt
new file mode 100644 (file)
index 0000000..899576c
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-frameelement-expected.txt
@@ -0,0 +1,15 @@
+CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://127.0.0.1:8000/security/cross-frame-access-frameelement.html from frame with URL http://127.0.0.1:8080/security/resources/cross-frame-access-frameelement-from-iframe.html. Domains, protocols and ports must match.
+
+This test checks if frameElement is accessible from the same or cross origin iframe.
+
+ 
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+[object HTMLIFrameElement]
+
+--------
+Frame: '<!--framePath //<!--frame1-->-->'
+--------
+undefined
diff --git a/LayoutTests/http/tests/security/cross-frame-access-frameelement.html b/LayoutTests/http/tests/security/cross-frame-access-frameelement.html
new file mode 100644 (file)
index 0000000..db1fae9
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-frameelement.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.dumpChildFramesAsText();
+}
+</script>
+</head>
+<body>
+<p>This test checks if frameElement is accessible from the same or cross origin iframe.</p>
+<iframe src="resources/cross-frame-access-frameelement-from-iframe.html"></iframe>
+<iframe src="http://127.0.0.1:8080/security/resources/cross-frame-access-frameelement-from-iframe.html"></iframe>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/resources/cross-frame-access-frameelement-from-iframe.html b/LayoutTests/http/tests/security/resources/cross-frame-access-frameelement-from-iframe.html
new file mode 100644 (file)
index 0000000..3829aa0
--- /dev/null
+++ b/LayoutTests/http/tests/security/resources/cross-frame-access-frameelement-from-iframe.html
@@ -0,0 +1,7 @@
+<body>
+<div id="console"></div>
+<script src="cross-frame-access.js"></script>
+<script>
+log(eval("window.frameElement"));
+</script>
+</body>
diff --git a/LayoutTests/platform/chromium/http/tests/security/cross-frame-access-put-expected.txt b/LayoutTests/platform/chromium/http/tests/security/cross-frame-access-put-expected.txt
index 53fb434..728c530 100644 (file)
--- a/LayoutTests/platform/chromium/http/tests/security/cross-frame-access-put-expected.txt
+++ b/LayoutTests/platform/chromium/http/tests/security/cross-frame-access-put-expected.txt
@@ -1,3 +1,5 @@
+CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://127.0.0.1:8000/security/cross-frame-access-put.html from frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-put-test.html. Domains, protocols and ports must match.
+
 CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-put-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-put.html. Domains, protocols and ports must match.
 
 CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-put-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-put.html. Domains, protocols and ports must match.
@@ -483,7 +485,9 @@ ALERT: PASS: window.devicePixelRatio should be '1' and is.
 ALERT: PASS: window.document should be '[object HTMLDocument]' and is.
 ALERT: PASS: window.embeds should be 'undefined' and is.
 ALERT: PASS: window.event should be 'undefined' and is.
-ALERT: PASS: window.frameElement should be '[object HTMLIFrameElement]' and is.
+CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://127.0.0.1:8000/security/cross-frame-access-put.html from frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-put-test.html. Domains, protocols and ports must match.
+
+ALERT: PASS: window.frameElement should be 'undefined' and is.
 ALERT: PASS: window.frames should be '[object DOMWindow]' and is.
 ALERT: PASS: window.history should be '[object History]' and is.
 ALERT: PASS: window.images should be 'undefined' and is.
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 93fb997..22e6de8 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,5 +1,19 @@
 2012-02-08  Kentaro Hara  <haraken@chromium.org>
 
+        Replace [CheckNodeSecurity] with [CheckAccessToNode]
+        https://bugs.webkit.org/show_bug.cgi?id=77971
+
+        Reviewed by Adam Barth.
+
+        [CheckNodeSecurity] is not implemented by code generators.
+        This patch replaces [CheckNodeSecurity] with [CheckAccessToNode].
+
+        Test: http/tests/security/cross-frame-access-frameelement.html
+
+        * page/DOMWindow.idl:
+
+2012-02-08  Kentaro Hara  <haraken@chromium.org>
+
         Rename [CustomPushEventHandlerScope] to [JSCustomPushEventHandlerScope]
         https://bugs.webkit.org/show_bug.cgi?id=78081
 
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 90702d8..0792439 100644 (file)
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -60,7 +60,7 @@ module window {
 
         DOMSelection getSelection();
 
-        readonly attribute [CheckNodeSecurity] Element frameElement;
+        readonly attribute [CheckAccessToNode] Element frameElement;
 
         [DoNotCheckDomainSecurity] void focus();
         [DoNotCheckDomainSecurity] void blur();
Domain: Web Framework / Uncategorized;