src/third_party/WebKit/Source/bindings/v8/BindingSecurity.cpp

   1 /*
   2  * Copyright (C) 2009 Google Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are
   6  * met:
   7  *
   8  *     * Redistributions of source code must retain the above copyright
   9  * notice, this list of conditions and the following disclaimer.
  10  *     * Redistributions in binary form must reproduce the above
  11  * copyright notice, this list of conditions and the following disclaimer
  12  * in the documentation and/or other materials provided with the
  13  * distribution.
  14  *     * Neither the name of Google Inc. nor the names of its
  15  * contributors may be used to endorse or promote products derived from
  16  * this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 #include "config.h"
  32 #include "bindings/v8/BindingSecurity.h"
  33
  34 #include "bindings/v8/V8Binding.h"
  35 #include "core/dom/Document.h"
  36 #include "core/html/HTMLFrameElementBase.h"
  37 #include "core/frame/DOMWindow.h"
  38 #include "core/frame/Frame.h"
  39 #include "core/frame/Settings.h"
  40 #include "platform/weborigin/SecurityOrigin.h"
  41
  42 namespace WebCore {
  43
  44 static bool isDocumentAccessibleFromDOMWindow(Document* targetDocument, DOMWindow* activeWindow)
  45 {
  46     if (!targetDocument)
  47         return false;
  48
  49     if (!activeWindow)
  50         return false;
  51
  52     if (activeWindow->document()->securityOrigin()->canAccess(targetDocument->securityOrigin()))
  53         return true;
  54
  55     return false;
  56 }
  57
  58 static bool canAccessDocument(v8::Isolate* isolate, Document* targetDocument, ExceptionState& exceptionState)
  59 {
  60     DOMWindow* activeWindow = activeDOMWindow(isolate);
  61     if (isDocumentAccessibleFromDOMWindow(targetDocument, activeWindow))
  62         return true;
  63
  64     if (targetDocument->domWindow())
  65         exceptionState.throwSecurityError(targetDocument->domWindow()->sanitizedCrossDomainAccessErrorMessage(activeWindow), targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
  66     return false;
  67 }
  68
  69 static bool canAccessDocument(v8::Isolate* isolate, Document* targetDocument, SecurityReportingOption reportingOption = ReportSecurityError)
  70 {
  71     DOMWindow* activeWindow = activeDOMWindow(isolate);
  72     if (isDocumentAccessibleFromDOMWindow(targetDocument, activeWindow))
  73         return true;
  74
  75     if (reportingOption == ReportSecurityError && targetDocument->domWindow()) {
  76         if (Frame* frame = targetDocument->frame())
  77             frame->domWindow()->printErrorMessage(targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
  78     }
  79
  80     return false;
  81 }
  82
  83 bool BindingSecurity::shouldAllowAccessToFrame(v8::Isolate* isolate, Frame* target, SecurityReportingOption reportingOption)
  84 {
  85     return target && canAccessDocument(isolate, target->document(), reportingOption);
  86 }
  87
  88 bool BindingSecurity::shouldAllowAccessToFrame(v8::Isolate* isolate, Frame* target, ExceptionState& exceptionState)
  89 {
  90     return target && canAccessDocument(isolate, target->document(), exceptionState);
  91 }
  92
  93 bool BindingSecurity::shouldAllowAccessToNode(v8::Isolate* isolate, Node* target, ExceptionState& exceptionState)
  94 {
  95     return target && canAccessDocument(isolate, &target->document(), exceptionState);
  96 }
  97
  98 }