2009-11-22 Chris Evans <cevans@chromium.org>
authorabarth@webkit.org <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 22 Nov 2009 17:22:31 +0000 (17:22 +0000)
committerabarth@webkit.org <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 22 Nov 2009 17:22:31 +0000 (17:22 +0000)
        Reviewed by Adam Barth.

        Updates the test to make sure it is disabling universal access for
        file:/// URLs (if the API is supported). This is required to do
        effective intra-file:/// access tests.
        Note that Safari only passes by virtual of supporting no directory
        listings at all.

        * fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html: Added.
        * fast/xmlhttprequest/xmlhttprequest-nonexistent-file-expected.txt:
        * fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html:
        Disable universal access for file:/// URLs (if API available).
        Run the real test in an iframe without universal access.
2009-11-22  Chris Evans  <cevans@chromium.org>

        Reviewed by Adam Barth.

        Deny access to directory listings. This needs doing in WebKit for
        WebKit clients that do permit top-level navigation to file:///dir.
        This matches Firefox, plus the existing Safari implementation (which
        does not support any directory access at all). It will fix the
        LayoutTest named below for Chromium.

        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html

        * page/SecurityOrigin.cpp: Deny access to directory listings.
        (WebCore::SecurityOrigin::SecurityOrigin):
        (WebCore::SecurityOrigin::canRequest):
2009-11-22  Chris Evans  <cevans@chromium.org>

        Reviewed by Adam Barth.

        Implemented setAllowUniversalAccessFromFileURLs to support testing of
        file URL security.

        * DumpRenderTree/LayoutTestController.cpp:
        (setAllowUniversalAccessFromFileURLsCallback):
        (LayoutTestController::staticFunctions):
        * DumpRenderTree/LayoutTestController.h:
        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
        (LayoutTestController::setAllowUniversalAccessFromFileURLs):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@51294 268f45cc-cd09-0410-ab3c-d52691b4dbfc

13 files changed:
LayoutTests/ChangeLog
LayoutTests/fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html [new file with mode: 0644]
LayoutTests/fast/xmlhttprequest/xmlhttprequest-nonexistent-file-expected.txt
LayoutTests/fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
WebCore/ChangeLog
WebCore/page/SecurityOrigin.cpp
WebKitTools/ChangeLog
WebKitTools/DumpRenderTree/LayoutTestController.cpp
WebKitTools/DumpRenderTree/LayoutTestController.h
WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp

index 5709ae3a7dbdf8d7c7daa8b3f8dbc754d5f214ad..010fa82fda0035fde1ffc2f3eb3e969520df3d01 100644 (file)
@@ -1,3 +1,19 @@
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Updates the test to make sure it is disabling universal access for
+        file:/// URLs (if the API is supported). This is required to do
+        effective intra-file:/// access tests.
+        Note that Safari only passes by virtual of supporting no directory
+        listings at all.
+
+        * fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html: Added.
+        * fast/xmlhttprequest/xmlhttprequest-nonexistent-file-expected.txt:
+        * fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html:
+        Disable universal access for file:/// URLs (if API available).
+        Run the real test in an iframe without universal access.
+
 2009-11-21  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
diff --git a/LayoutTests/fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html b/LayoutTests/fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html
new file mode 100644 (file)
index 0000000..7785172
--- /dev/null
@@ -0,0 +1,73 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+                      "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+    <script>
+        function log(message)
+        {
+            var console = document.getElementById('console');
+            console.appendChild(document.createTextNode(message));
+            console.appendChild(document.createElement('br'));
+        }
+
+        function errorHandler()
+        {
+            log("Error handler: readyState = " + xhr.readyState);
+            var results = window.top.document.getElementById('results');
+            results.innerHTML = document.body.innerHTML;
+        }
+
+        function readyStateHandlerDirectory()
+        {
+            log("ReadyState handler: readyState = " + xhr.readyState);
+            if (xhr.readyState == 4 && window.layoutTestController) {
+                setTimeout("layoutTestController.notifyDone()", 0);
+            }
+        }
+
+        function testXHRDirectory()
+        {
+            log("");
+            log("Doing an XHR to a directory.");
+            xhr = new XMLHttpRequest();
+            xhr.onerror = errorHandler;
+            xhr.onreadystatechange = readyStateHandlerDirectory;
+
+            try {
+                xhr.open("GET", "../resources/", false);
+                xhr.send("");
+            } catch(e) {
+                log("Exception: " + e.message);
+            }
+        }
+
+        function readyStateHandlerNonExistent()
+        {
+            log("ReadyState handler: readyState = " + xhr.readyState);
+            if (xhr.readyState == 4)
+                setTimeout("testXHRDirectory()", 0);
+        }
+
+        function testXHRNonExistentFile()
+        {
+            log("Doing an XHR to a nonexistent file.");
+            xhr = new XMLHttpRequest();
+            xhr.onerror = errorHandler;
+            xhr.onreadystatechange = readyStateHandlerNonExistent;
+
+            try {
+                xhr.open("GET", "nonexistent.html", true);
+                xhr.send("");
+            } catch(e) {
+                log("Exception: " + e.message);
+                testXHRDirectory();
+            }
+        }
+        </script>
+    </head>
+    <body onload="testXHRNonExistentFile()">
+        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=22475">22475</a>: REGRESSION: Async XMLHttpRequest never finishes on nonexistent files anymore </p>
+        <p> In both cases, readyState 4 should be reached, and error handler should be invoked. </p>
+        <div id="console"/>
+    </body>
+</html>
index 77290bb00bb318a12d8e5248c6f363df483de0e0..1e968428548f9b9a62d64f500d102de30ae0a2ab 100644 (file)
@@ -1,3 +1,4 @@
+
 Bug 22475: REGRESSION: Async XMLHttpRequest never finishes on nonexistent files anymore
 
 In both cases, readyState 4 should be reached, and error handler should be invoked.
index 67f07a722355cfeb7478decfad507d7d60253895..ef0a2d6e5eb6622a9d503e3280d6b61bf1c8f60a 100644 (file)
@@ -1,76 +1,15 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
-                      "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
-    <script>
-        function log(message)
-        {
-            var console = document.getElementById('console');
-            console.appendChild(document.createTextNode(message));
-            console.appendChild(document.createElement('br'));
-        }
-
-        function errorHandler()
-        {
-            log("Error handler: readyState = " + xhr.readyState);
-        }
-
-        function readyStateHandlerDirectory()
-        {
-            log("ReadyState handler: readyState = " + xhr.readyState);
-            if (xhr.readyState == 4 && window.layoutTestController) {
-                setTimeout("layoutTestController.notifyDone()", 0);
-            }
-        }
-
-        function testXHRDirectory()
-        {
-            log("");
-            log("Doing an XHR to a directory.");
-            xhr = new XMLHttpRequest();
-            xhr.onerror = errorHandler;
-            xhr.onreadystatechange = readyStateHandlerDirectory;
-
-            try {
-                xhr.open("GET", "resources", true);
-                xhr.send("");
-            } catch(e) {
-                log("Exception: " + e.message);
-            }
-        }
-
-        function readyStateHandlerNonExistent()
-        {
-            log("ReadyState handler: readyState = " + xhr.readyState);
-            if (xhr.readyState == 4)
-                setTimeout("testXHRDirectory()", 0);
-        }
-
-        function testXHRNonExistentFile()
-        {
-            if (window.layoutTestController) {
-                layoutTestController.dumpAsText();
-                layoutTestController.waitUntilDone();
-            }
-
-            log("Doing an XHR to a nonexistent file.");
-            xhr = new XMLHttpRequest();
-            xhr.onerror = errorHandler;
-            xhr.onreadystatechange = readyStateHandlerNonExistent;
-
-            try {
-                xhr.open("GET", "nonexistent.html", true);
-                xhr.send("");
-            } catch(e) {
-                log("Exception: " + e.message);
-                testXHRDirectory();
-            }
-        }
-        </script>
-    </head>
-    <body onload="testXHRNonExistentFile()">
-        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=22475">22475</a>: REGRESSION: Async XMLHttpRequest never finishes on nonexistent files anymore </p>
-        <p> In both cases, readyState 4 should be reached, and error handler should be invoked. </p>
-        <div id="console"/>
-    </body>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.setAllowUniversalAccessFromFileURLs(false);
+}
+</script>
+</head>
+<body>
+<iframe src="resources/xmlhttprequest-nonexistent-file-real.html"></iframe>
+<div id="results"></div>
+</body>
 </html>
index 054bfb3931422f2c0ea66a041eff1d6d161a1f22..1b4c652d930f9b70c5c47dd67e398bf5ea033dd0 100644 (file)
@@ -1,3 +1,19 @@
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Deny access to directory listings. This needs doing in WebKit for
+        WebKit clients that do permit top-level navigation to file:///dir.
+        This matches Firefox, plus the existing Safari implementation (which
+        does not support any directory access at all). It will fix the
+        LayoutTest named below for Chromium.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+
+        * page/SecurityOrigin.cpp: Deny access to directory listings.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canRequest):
+
 2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
 
         Reviewed by Timothy Hatcher.
index 338bf9fa3d42963384a70720d65a8d4d42aff807..b625fba494476a400a070acfa18209d430644844 100644 (file)
@@ -112,6 +112,11 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 
     // By default, only local SecurityOrigins can load local resources.
     m_canLoadLocalResources = isLocal();
+    if (m_canLoadLocalResources) {
+        // Directories should never be readable.
+        if (!url.hasPath() || url.path().endsWith("/"))
+            m_noAccess = true;
+    }
 
     if (isDefaultPortForProtocol(m_port, m_protocol))
         m_port = 0;
@@ -207,6 +212,8 @@ bool SecurityOrigin::canRequest(const KURL& url) const
         return false;
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
+    if (targetOrigin->m_noAccess)
+        return false;
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
index 66bc657ba55fdd11e8e3f3f365794d3866bf600d..8ae92beeff6b281f8fcbcc6e1a26f5591664af56 100644 (file)
@@ -1,3 +1,23 @@
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Implemented setAllowUniversalAccessFromFileURLs to support testing of
+        file URL security.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setAllowUniversalAccessFromFileURLsCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+
 2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
 
         Reviewed by Kenneth Rohde Christiansen.
index 4c28ca728b9b9792723a902c589d326ab84318e9..ed9cb30194afe4d0f72b0266a7362b4b1b37c888 100644 (file)
@@ -838,6 +838,18 @@ static JSValueRef setXSSAuditorEnabledCallback(JSContextRef context, JSObjectRef
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setAllowUniversalAccessFromFileURLsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac & windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setAllowUniversalAccessFromFileURLs(JSValueToBoolean(context, arguments[0]));
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef setTabKeyCyclesThroughElementsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac & windows implementation
@@ -1248,6 +1260,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "removeAllVisitedLinks", removeAllVisitedLinksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "repaintSweepHorizontally", repaintSweepHorizontallyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAcceptsEditing", setAcceptsEditingCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setAllowUniversalAccessFromFileURLs", setAllowUniversalAccessFromFileURLsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAlwaysAcceptCookies", setAlwaysAcceptCookiesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAppCacheMaximumSize", setAppCacheMaximumSizeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
         { "setAuthenticationPassword", setAuthenticationPasswordCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
index 0641e99d3aedf4d0b03b623a59c555642766bdee..2fffde9f7d0852a5c8cb24d0d98c839e31f1641e 100644 (file)
@@ -67,6 +67,7 @@ public:
     void removeAllVisitedLinks();
     void setAcceptsEditing(bool acceptsEditing);
     void setAppCacheMaximumSize(unsigned long long quota);
+    void setAllowUniversalAccessFromFileURLs(bool);
     void setAuthorAndUserStylesEnabled(bool);
     void setCacheModel(int);
     void setCustomPolicyDelegate(bool setDelegate, bool permissive);
index db55fbd7cae17f71b29b496d5222faef2cd5137c..9fd79cc455065e75898bd9e1f50f02b0e7bfe948 100644 (file)
@@ -316,6 +316,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool flag)
     g_object_set(G_OBJECT(settings), "enable-xss-auditor", flag, NULL);
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool flag)
+{
+    // FIXME: implement
+}
+
 void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
 {
     // FIXME: implement
index b435f54565d6bfad3bf82210310fb3e9db455efd..42aa7886ccf9b0d5d7f93d1b0a95c554d490513f 100644 (file)
@@ -301,6 +301,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     [[[mainFrame webView] preferences] setXSSAuditorEnabled:enabled];
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    [[[mainFrame webView] preferences] setAllowUniversalAccessFromFileURLs:enabled];
+}
+
 void LayoutTestController::setPopupBlockingEnabled(bool popupBlockingEnabled)
 {
     [[[mainFrame webView] preferences] setJavaScriptCanOpenWindowsAutomatically:!popupBlockingEnabled];
index c8649bb47fe3c3a4ff327911280795612ce8b892..0b77be68e628013574fd43dd6571483c912572b2 100644 (file)
@@ -372,6 +372,23 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     prefsPrivate->setXSSAuditorEnabled(enabled);
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebPreferences> preferences;
+    if (FAILED(webView->preferences(&preferences)))
+        return;
+
+    COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
+    if (!prefsPrivate)
+        return;
+
+    prefsPrivate->setAllowUniversalAccessFromFileURLs(enabled);
+}
+
 void LayoutTestController::setPopupBlockingEnabled(bool enabled)
 {
     COMPtr<IWebView> webView;
index 72f85ae2f4d87e05e462daac9b163c3754ce8ada..218480fdb6e2147c5beda22ab538a9c2d1cb896e 100644 (file)
@@ -170,6 +170,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     // FIXME: implement
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    // FIXME: implement
+}
+
 void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
 {
     // FIXME: implement