[soup] Prevent setting or editing httpOnly cookies from JavaScript
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Jun 2012 00:33:03 +0000 (00:33 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Jun 2012 00:33:03 +0000 (00:33 +0000)
https://bugs.webkit.org/show_bug.cgi?id=88760

Patch by Christophe Dumez <christophe.dumez@intel.com> on 2012-06-12
Reviewed by Gustavo Noronha Silva.

Source/WebCore:

Prevent setting or overwriting httpOnly cookies from JavaScript.
Fix setCookies() so that it parses all the cookies and not just
the first one.

Test: http/tests/cookies/js-get-and-set-http-only-cookie.html

* platform/network/soup/CookieJarSoup.cpp:
(WebCore::httpOnlyCookieExists):
(WebCore):
(WebCore::setCookies):

Tools:

Update libsoup to v2.39.2, glib to v2.33.2 and glib-networking
to v2.33.2 for both GTK and EFL ports.

* efl/jhbuild.modules:
* gtk/jhbuild.modules:

LayoutTests:

Unskip http/tests/cookies/js-get-and-set-http-only-cookie.html for
both GTK and EFL ports now that that we don't allow overwriting
httpOnly cookies from JavaScript anymore.

* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@120145 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/platform/efl/TestExpectations
LayoutTests/platform/gtk/TestExpectations
Source/WebCore/ChangeLog
Source/WebCore/platform/network/soup/CookieJarSoup.cpp
Tools/ChangeLog
Tools/efl/jhbuild.modules
Tools/gtk/jhbuild.modules

index 3f92c44..c446775 100644 (file)
@@ -1,5 +1,19 @@
 2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>
 
+        [soup] Prevent setting or editing httpOnly cookies from JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=88760
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Unskip http/tests/cookies/js-get-and-set-http-only-cookie.html for
+        both GTK and EFL ports now that that we don't allow overwriting
+        httpOnly cookies from JavaScript anymore.
+
+        * platform/efl/TestExpectations:
+        * platform/gtk/TestExpectations:
+
+2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>
+
         [EFL] Enable SHADOW_DOM flag
         https://bugs.webkit.org/show_bug.cgi?id=87732
 
index 5c39bbe..8150083 100644 (file)
@@ -697,9 +697,6 @@ BUGWK86637 : editing/spelling/spellcheck-queue.html = TEXT
 BUGWK86637 : editing/spelling/spellcheck-sequencenum.html = TEXT
 BUGWK86637 : editing/spelling/spelling-marker-description.html = TEXT
 
-// New test added in r119947 which fails on almost all ports
-BUGWK87208 : http/tests/cookies/js-get-and-set-http-only-cookie.html = TEXT
-
 // It is unclear whether a new baseline is needed or it is a JSC failure
 BUGWK77413 : fast/parser/nested-fragment-parser-crash.html = TEXT
 
index f3877c1..9719657 100644 (file)
@@ -1248,9 +1248,6 @@ BUGWK85689 SKIP : fast/animation/request-animation-frame-disabled.html = TEXT
 // New test introduced in r119911 failing on GTK and EFL ports
 BUGWK88727 : http/tests/xmlhttprequest/origin-exact-matching.html = TEXT
 
-// New test introduced in r119947 failing on GTK port
-BUGWK88760 : http/tests/cookies/js-get-and-set-http-only-cookie.html = TEXT
-
 // Started failing after it was added in r116473
 BUGWK85969 : http/tests/loading/post-in-iframe-with-back-navigation.html = TEXT
 
index 1f22ba1..e1c9e2b 100644 (file)
@@ -1,5 +1,23 @@
 2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>
 
+        [soup] Prevent setting or editing httpOnly cookies from JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=88760
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Prevent setting or overwriting httpOnly cookies from JavaScript.
+        Fix setCookies() so that it parses all the cookies and not just
+        the first one.
+
+        Test: http/tests/cookies/js-get-and-set-http-only-cookie.html
+
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::httpOnlyCookieExists):
+        (WebCore):
+        (WebCore::setCookies):
+
+2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>
+
         [EFL] Enable SHADOW_DOM flag
         https://bugs.webkit.org/show_bug.cgi?id=87732
 
index a1387e7..c6e9bce 100644 (file)
@@ -72,6 +72,20 @@ void setSoupCookieJar(SoupCookieJar* jar)
     defaultCookieJar() = jar;
 }
 
+static inline bool httpOnlyCookieExists(const GSList* cookies, const gchar* name, const gchar* path)
+{
+    for (const GSList* iter = cookies; iter; iter = g_slist_next(iter)) {
+        SoupCookie* cookie = static_cast<SoupCookie*>(iter->data);
+        if (!strcmp(soup_cookie_get_name(cookie), name)
+            && !g_strcmp0(soup_cookie_get_path(cookie), path)) {
+            if (soup_cookie_get_http_only(cookie))
+                return true;
+            break;
+        }
+    }
+    return false;
+}
+
 void setCookies(Document* document, const KURL& url, const String& value)
 {
     SoupCookieJar* jar = cookieJarForDocument(document);
@@ -80,7 +94,30 @@ void setCookies(Document* document, const KURL& url, const String& value)
 
     GOwnPtr<SoupURI> origin(soup_uri_new(url.string().utf8().data()));
     GOwnPtr<SoupURI> firstParty(soup_uri_new(document->firstPartyForCookies().string().utf8().data()));
-    soup_cookie_jar_set_cookie_with_first_party(jar, origin.get(), firstParty.get(), value.utf8().data());
+
+    // Get existing cookies for this origin.
+    GSList* existingCookies = soup_cookie_jar_get_cookie_list(jar, origin.get(), TRUE);
+
+    Vector<String> cookies;
+    value.split('\n', cookies);
+    const size_t cookiesCount = cookies.size();
+    for (size_t i = 0; i < cookiesCount; ++i) {
+        GOwnPtr<SoupCookie> cookie(soup_cookie_parse(cookies[i].utf8().data(), origin.get()));
+        if (!cookie)
+            continue;
+
+        // Make sure the cookie is not httpOnly since such cookies should not be set from JavaScript.
+        if (soup_cookie_get_http_only(cookie.get()))
+            continue;
+
+        // Make sure we do not overwrite httpOnly cookies from JavaScript.
+        if (httpOnlyCookieExists(existingCookies, soup_cookie_get_name(cookie.get()), soup_cookie_get_path(cookie.get())))
+            continue;
+
+        soup_cookie_jar_add_cookie_with_first_party(jar, firstParty.get(), cookie.release());
+    }
+
+    soup_cookies_free(existingCookies);
 }
 
 static String cookiesForDocument(const Document* document, const KURL& url, bool forHTTPHeader)
index c0514a4..8c48545 100644 (file)
@@ -1,5 +1,18 @@
 2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>
 
+        [soup] Prevent setting or editing httpOnly cookies from JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=88760
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Update libsoup to v2.39.2, glib to v2.33.2 and glib-networking
+        to v2.33.2 for both GTK and EFL ports.
+
+        * efl/jhbuild.modules:
+        * gtk/jhbuild.modules:
+
+2012-06-12  Christophe Dumez  <christophe.dumez@intel.com>
+
         [EFL] Enable SHADOW_DOM flag
         https://bugs.webkit.org/show_bug.cgi?id=87732
 
index 11ecb09..14faf78 100644 (file)
     <dependencies>
       <dep package="libffi"/>
     </dependencies>
-    <branch module="/pub/GNOME/sources/glib/2.32/glib-2.32.2.tar.xz" version="2.32.2"
+    <branch module="/pub/GNOME/sources/glib/2.33/glib-2.33.2.tar.xz" version="2.33.2"
             repo="ftp.gnome.org"
-            hash="sha256:b1764abf00bac96e0e93e29fb9715ce75f3583579acac40648e18771d43d6136"
-            md5sum="5bfdb6197afb90e4dbc7b1bb98f0eae0"/>
+            hash="sha256:b7163e9f159775d13ecfb433d67c3f0883e0e518e85b2e970d4ad9773d7cd0b4"
+            md5sum="06ef0099fed22afcf34ade39ddff9a5b"/>
   </autotools>
 
   <autotools id="glib-networking">
     <dependencies>
       <dep package="gnutls"/>
     </dependencies>
-    <branch module="/pub/GNOME/sources/glib-networking/2.31/glib-networking-2.31.2.tar.xz" version="2.31.2"
+    <branch module="/pub/GNOME/sources/glib-networking/2.33/glib-networking-2.33.2.tar.xz" version="2.33.2"
             repo="ftp.gnome.org"
-            hash="sha256:03e3a2881d2626d1206e72972531661037fe0d32e745bf9b2f63c0d6f5e32a9c"
-            md5sum="b649b457bd9fd5e0e9b9c4dcb1a74a37"/>
+            hash="e298cff3935eb752be290bbf734e457f1870bdb5370ee292606e6040a82074e7"
+            md5sum="5abb364f2a0babe2ec1e3a6d59f69043"/>
   </autotools>
 
   <autotools id="gnutls"
     <dependencies>
       <dep package="glib-networking"/>
     </dependencies>
-    <branch module="libsoup" version="2.38.1"
+    <branch module="libsoup" version="2.39.2"
             repo="git.gnome.org"
-            tag="LIBSOUP_2_38_1"/>
+            tag="LIBSOUP_2_39_2"/>
   </autotools>
 
   <autotools id="fontconfig" autogen-sh="configure">
index c93e39f..3306d74 100644 (file)
     <dependencies>
       <dep package="libffi"/>
     </dependencies>
-    <branch module="/pub/GNOME/sources/glib/2.32/glib-2.32.0.tar.xz" version="2.32.0"
+    <branch module="/pub/GNOME/sources/glib/2.33/glib-2.33.2.tar.xz" version="2.33.2"
             repo="ftp.gnome.org"
-            hash="sha256:cde9d9f25ed648069c547e323897ad9379974e1f936b4477fa51bcf1bb261ae4"
-            md5sum="c5fa76fbf9184d20dfb04af66b598190"/>
+            hash="sha256:b7163e9f159775d13ecfb433d67c3f0883e0e518e85b2e970d4ad9773d7cd0b4"
+            md5sum="06ef0099fed22afcf34ade39ddff9a5b"/>
   </autotools>
 
   <autotools id="glib-networking">
       <dep package="glib"/>
       <dep package="gnutls"/>
     </dependencies>
-    <branch module="/pub/GNOME/sources/glib-networking/2.31/glib-networking-2.31.2.tar.xz" version="2.31.2"
+    <branch module="/pub/GNOME/sources/glib-networking/2.33/glib-networking-2.33.2.tar.xz" version="2.33.2"
             repo="ftp.gnome.org"
-            hash="sha256:03e3a2881d2626d1206e72972531661037fe0d32e745bf9b2f63c0d6f5e32a9c"
-            md5sum="b649b457bd9fd5e0e9b9c4dcb1a74a37"/>
+            hash="sha256:e298cff3935eb752be290bbf734e457f1870bdb5370ee292606e6040a82074e7"
+            md5sum="5abb364f2a0babe2ec1e3a6d59f69043"/>
   </autotools>
 
   <autotools id="gnutls"
     <dependencies>
       <dep package="glib-networking"/>
     </dependencies>
-    <branch module="libsoup" version="2.38.1"
+    <branch module="libsoup" version="2.39.2"
             repo="git.gnome.org"
-            tag="LIBSOUP_2_38_1"/>
+            tag="LIBSOUP_2_39_2"/>
   </autotools>
 
   <autotools id="fontconfig" autogen-sh="configure">