Support targetOrigin = "/" in postMessage for sending messages to same origin as...

https://bugs.webkit.org/show_bug.cgi?id=77580

Patch by Pablo Flouret <pablof@motorola.com> on 2012-02-01
Reviewed by Adam Barth.

Source/WebCore:

No new tests. Modified http/tests/security/postMessage/target-origin.html
to test this case as well.

* page/DOMWindow.cpp:
(WebCore::DOMWindow::postMessage):

LayoutTests:

* http/tests/security/postMessage/target-origin-expected.txt:
* http/tests/security/postMessage/target-origin.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@106516 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index dea50cc..388cc5a 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2012-02-01  Pablo Flouret  <pablof@motorola.com>
+
+        Support targetOrigin = "/" in postMessage for sending messages to same origin as source document.
+        https://bugs.webkit.org/show_bug.cgi?id=77580
+
+        Reviewed by Adam Barth.
+
+        * http/tests/security/postMessage/target-origin-expected.txt:
+        * http/tests/security/postMessage/target-origin.html:
+
 2012-02-01  Gavin Barraclough  <barraclough@apple.com>
 
         calling function on catch block scope containing an eval result in wrong this value being passed

diff --git a/LayoutTests/http/tests/security/postMessage/target-origin-expected.txt b/LayoutTests/http/tests/security/postMessage/target-origin-expected.txt
index 863431d..b7cb925 100644 (file)
--- a/LayoutTests/http/tests/security/postMessage/target-origin-expected.txt
+++ b/LayoutTests/http/tests/security/postMessage/target-origin-expected.txt
@@ -1,3 +1,5 @@
+CONSOLE MESSAGE: Unable to post message to http://127.0.0.1:8000. Recipient has origin http://localhost:8000.
+
 CONSOLE MESSAGE: Unable to post message to http://localhost:9090. Recipient has origin http://localhost:8000.
 
 CONSOLE MESSAGE: Unable to post message to http://localhost. Recipient has origin http://localhost:8000.
@@ -13,6 +15,7 @@ window.location.href = http://127.0.0.1:8000/security/postMessage/target-origin.
 waiting...
 Error sending message to null. Error: SYNTAX_ERR: DOM Exception 12
 Error sending message to undefined. Error: SYNTAX_ERR: DOM Exception 12
+Error sending message to //. Error: SYNTAX_ERR: DOM Exception 12
 Received message: data="Received message: data="Trying origin=http://localhost:8000" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"
 Received message: data="Received message: data="Trying origin=http://localhost:8000/" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"
 Received message: data="Received message: data="Trying origin=http://localhost:8000/foo" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"
@@ -20,4 +23,5 @@ Received message: data="Received message: data="Trying origin=http://localhost:8
 Received message: data="Received message: data="Trying origin=http://localhost:8000/foo?bar#baz" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"
 Received message: data="Received message: data="Trying origin=http://user:pass@localhost:8000/foo?bar#baz" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"
 Received message: data="Received message: data="Trying origin=*" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"
+Received message: data="Received message: data="Trying origin=/" origin="http://127.0.0.1:8000"" origin="http://127.0.0.1:8000"
 Received message: data="Received message: data="done" origin="http://127.0.0.1:8000"" origin="http://localhost:8000"

diff --git a/LayoutTests/http/tests/security/postMessage/target-origin.html b/LayoutTests/http/tests/security/postMessage/target-origin.html
index 4c94323..18bdd46 100644 (file)
--- a/LayoutTests/http/tests/security/postMessage/target-origin.html
+++ b/LayoutTests/http/tests/security/postMessage/target-origin.html
@@ -19,37 +19,41 @@ function tryPostMessage(win, origin) {
 }
 
 function test() {
-    var iframe = document.getElementById('child');
-    var win = iframe.contentWindow;
+    var winLocalhost = document.getElementById('iframe-localhost').contentWindow;
+    var win127= document.getElementById('iframe-127').contentWindow;
 
     // Should succeed:
-    tryPostMessage(win, "http://localhost:8000");
-    tryPostMessage(win, "http://localhost:8000/");
-    tryPostMessage(win, "http://localhost:8000/foo");
-    tryPostMessage(win, "http://localhost:8000/foo?bar");
-    tryPostMessage(win, "http://localhost:8000/foo?bar#baz");
-    tryPostMessage(win, "http://user:pass@localhost:8000/foo?bar#baz");
-    tryPostMessage(win, "*");
+    tryPostMessage(winLocalhost, "http://localhost:8000");
+    tryPostMessage(winLocalhost, "http://localhost:8000/");
+    tryPostMessage(winLocalhost, "http://localhost:8000/foo");
+    tryPostMessage(winLocalhost, "http://localhost:8000/foo?bar");
+    tryPostMessage(winLocalhost, "http://localhost:8000/foo?bar#baz");
+    tryPostMessage(winLocalhost, "http://user:pass@localhost:8000/foo?bar#baz");
+    tryPostMessage(winLocalhost, "*");
+    tryPostMessage(win127, "/");
 
     // Should fail:
-    tryPostMessage(win, "http://localhost:9090");
-    tryPostMessage(win, "http://localhost");
-    tryPostMessage(win, "https://localhost");
-    tryPostMessage(win, "https://localhost:8000");
-    tryPostMessage(win, "http://www.example.com");
+    tryPostMessage(winLocalhost, "/");
+    tryPostMessage(winLocalhost, "http://localhost:9090");
+    tryPostMessage(winLocalhost, "http://localhost");
+    tryPostMessage(winLocalhost, "https://localhost");
+    tryPostMessage(winLocalhost, "https://localhost:8000");
+    tryPostMessage(winLocalhost, "http://www.example.com");
 
     // Should throw syntax error:
-    tryPostMessage(win, null);
-    tryPostMessage(win, undefined);
+    tryPostMessage(winLocalhost, null);
+    tryPostMessage(winLocalhost, undefined);
+    tryPostMessage(win127, "//");
 
-    win.postMessage('done', '*');
+    winLocalhost.postMessage('done', '*');
 }
 </script>
 <body onload="test()">
 <div>window.location.href = <script>document.write(window.location.href);</script></div>
 <div><iframe src="http://localhost:8000/security/postMessage/resources/post-message-listener.html"
-  id="child" width="800" height="300" style="border: 1px solid black;">
-</iframe></div>
+  id="iframe-localhost" width="800" height="300" style="border: 1px solid black;">
+</iframe><iframe src="http://127.0.0.1:8000/security/postMessage/resources/post-message-listener.html"
+  id="iframe-127" width="800" height="300" style="border: 1px solid black;"></iframe>
 <div id="result">waiting...</div>
 </body>
 </html>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 81bea14..7ae5e64 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2012-02-01  Pablo Flouret  <pablof@motorola.com>
+
+        Support targetOrigin = "/" in postMessage for sending messages to same origin as source document.
+        https://bugs.webkit.org/show_bug.cgi?id=77580
+
+        Reviewed by Adam Barth.
+
+        No new tests. Modified http/tests/security/postMessage/target-origin.html
+        to test this case as well.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessage):
+
 2012-02-01  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
 
         Avoid creating NamedNodeMap unnecessarily

diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index afc611f..f550548 100644 (file)
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -826,10 +826,16 @@ void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, const Mes
     if (!isCurrentlyDisplayedInFrame())
         return;
 
+    Document* sourceDocument = source->document();
+
     // Compute the target origin.  We need to do this synchronously in order
     // to generate the SYNTAX_ERR exception correctly.
     RefPtr<SecurityOrigin> target;
-    if (targetOrigin != "*") {
+    if (targetOrigin == "/") {
+        if (!sourceDocument)
+            return;
+        target = sourceDocument->securityOrigin();
+    } else if (targetOrigin != "*") {
         target = SecurityOrigin::createFromString(targetOrigin);
         // It doesn't make sense target a postMessage at a unique origin
         // because there's no way to represent a unique origin in a string.
@@ -845,7 +851,6 @@ void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, const Mes
 
     // Capture the source of the message.  We need to do this synchronously
     // in order to capture the source of the message correctly.
-    Document* sourceDocument = source->document();
     if (!sourceDocument)
         return;
     String sourceOrigin = sourceDocument->securityOrigin()->toString();