Reviewed by Geoff Garen.

        - Test that cross frame access to a window on a different port is denied.
        - Adds test for out behavior of the above if document.domain is explicitly
          set to the same domain for both frames. We currently fail this test and
          a radar has been filed.
        - Clean up cross-frame-access-protocol.html to work in FireFox as well.

        * http/conf/apache2-httpd.conf: Listen on port 8080 now as well
        * http/conf/cygwin-httpd.conf: Listen on port 8080 now as well
        * http/conf/httpd.conf: Listen on port 8080 now as well
        * http/tests/security/cross-frame-access-port-domain-expected.txt: Added.
        * http/tests/security/cross-frame-access-port-domain.html: Added.
        * http/tests/security/cross-frame-access-port-expected.txt: Added.
        * http/tests/security/cross-frame-access-port.html: Added.
        * http/tests/security/cross-frame-access-protocol.html:
        * http/tests/security/resources/cross-frame-iframe-for-port-domain-test.html: Added.
        * http/tests/security/resources/cross-frame-iframe-for-port-test.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@24746 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 33dd33be9451b18826a2d5d00359e174c07f23b4..4dbbba885decb05da53fd8f03d64f81a8542458a 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,24 @@
+2007-07-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        - Test that cross frame access to a window on a different port is denied.
+        - Adds test for out behavior of the above if document.domain is explicitly
+          set to the same domain for both frames. We currently fail this test and
+          a radar has been filed.
+        - Clean up cross-frame-access-protocol.html to work in FireFox as well.
+
+        * http/conf/apache2-httpd.conf: Listen on port 8080 now as well
+        * http/conf/cygwin-httpd.conf: Listen on port 8080 now as well
+        * http/conf/httpd.conf: Listen on port 8080 now as well
+        * http/tests/security/cross-frame-access-port-domain-expected.txt: Added.
+        * http/tests/security/cross-frame-access-port-domain.html: Added.
+        * http/tests/security/cross-frame-access-port-expected.txt: Added.
+        * http/tests/security/cross-frame-access-port.html: Added.
+        * http/tests/security/cross-frame-access-protocol.html:
+        * http/tests/security/resources/cross-frame-iframe-for-port-domain-test.html: Added.
+        * http/tests/security/resources/cross-frame-iframe-for-port-test.html: Added.
+
 2007-07-27  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Adam Roben.

diff --git a/LayoutTests/http/conf/apache2-httpd.conf b/LayoutTests/http/conf/apache2-httpd.conf
index be6e7264d5be180822ea5f55e1117418d52f01b4..41947acf2f32f706b7e9651ff2033a2c84fcb29d 100644 (file)
--- a/LayoutTests/http/conf/apache2-httpd.conf
+++ b/LayoutTests/http/conf/apache2-httpd.conf
@@ -161,7 +161,7 @@ MaxRequestsPerChild 100000
 # Port 8443 is hard-coded as it is needed for the HTTPS configuration later on.
 #
 #Listen 3000
-#Listen 127.0.0.1:8000
+Listen 127.0.0.1:8080
 Listen 127.0.0.1:8443
 
 #

diff --git a/LayoutTests/http/conf/cygwin-httpd.conf b/LayoutTests/http/conf/cygwin-httpd.conf
index b7bfd3c54aff3b96bdeb3a3ab3ac694fd893374e..2b6f9e5da1e86681890e3c75a8a933f7c24ef717 100644 (file)
--- a/LayoutTests/http/conf/cygwin-httpd.conf
+++ b/LayoutTests/http/conf/cygwin-httpd.conf
@@ -178,7 +178,7 @@ MaxRequestsPerChild 100000
 # Configured from the httpd command line for WebKit layout tests.
 #
 #Listen 3000
-#Listen 127.0.0.1:8000
+Listen 127.0.0.1:8080
 
 #
 # Dynamic Shared Object (DSO) Support

diff --git a/LayoutTests/http/conf/httpd.conf b/LayoutTests/http/conf/httpd.conf
index f66a04265f1ee1f96a2f3c6ae47335a72cf6869e..da687ea5935050c04753cef43d511ee20247f9b7 100644 (file)
--- a/LayoutTests/http/conf/httpd.conf
+++ b/LayoutTests/http/conf/httpd.conf
@@ -179,7 +179,7 @@ MaxRequestsPerChild 100000
 # Port 8443 is hard-coded as it is needed for the HTTPS configuration later on.
 #
 #Listen 3000
-#Listen 127.0.0.1:8000
+Listen 127.0.0.1:8080
 Listen 127.0.0.1:8443
 
 #

diff --git a/LayoutTests/http/tests/security/cross-frame-access-port-domain-expected.txt b/LayoutTests/http/tests/security/cross-frame-access-port-domain-expected.txt
new file mode 100644 (file)
index 0000000..5148fc4
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-port-domain-expected.txt
@@ -0,0 +1,7 @@
+CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://127.0.0.1:8080/security/resources/cross-frame-iframe-for-port-domain-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-port-domain.html. Domains, protocols and ports must match.
+
+This test currently fails because we check the port and protocol even if document.domain is explicitly set (rdar://problem/5366437).
+
+
+Fail: Cross frame access to different port after after explicitly setting document.domain was denied!
+

diff --git a/LayoutTests/http/tests/security/cross-frame-access-port-domain.html b/LayoutTests/http/tests/security/cross-frame-access-port-domain.html
new file mode 100644 (file)
index 0000000..e8cfa32
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-port-domain.html
@@ -0,0 +1,53 @@
+<html>
+<p>This test currently fails because we check the port and protocol even if document.domain is explicitly set (rdar://problem/5366437).</p> 
+<iframe id="aFrame"></iframe>
+<pre id="console"></pre>
+<script>
+    function log(s)
+    {
+        document.getElementById("console").appendChild(document.createTextNode(s + "\n"));
+    }
+
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    document.domain = "127.0.0.1";
+
+    var targetWindow = frames[0];
+    if (!targetWindow.document.body)
+        log("FAIL: targetWindow started with no document, we won't know if the test passed or failed.");
+
+    var iframe = document.getElementById('aFrame');
+    iframe.src = "http://127.0.0.1:8080/security/resources/cross-frame-iframe-for-port-domain-test.html";
+
+    var testDone = false;
+
+    setTimeout(test, 1);
+
+    setTimeout(function() {
+        targetWindow.document.getElementById('accessMe').innerHTML = "PASS: Access allowed from frame with different port after explicitly setting document.domain.";
+        if (!testDone) {
+            log("Pass: Cross frame access to a different port was allowed.");
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+    }, 5000);
+
+    function test() {
+        try {
+            if (targetWindow.document.body) {
+                setTimeout(test, 1);
+                return;
+            }
+        } catch (e) {
+        }
+
+        log("Fail: Cross frame access to different port after after explicitly setting document.domain was denied!");
+        testDone = true;
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
+</html>

diff --git a/LayoutTests/http/tests/security/cross-frame-access-port-expected.txt b/LayoutTests/http/tests/security/cross-frame-access-port-expected.txt
new file mode 100644 (file)
index 0000000..d84a0ee
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-port-expected.txt
@@ -0,0 +1,5 @@
+CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://127.0.0.1:8080/security/resources/cross-frame-iframe-for-port-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-port.html. Domains, protocols and ports must match.
+
+
+PASS: Cross frame access to different port was denied!
+

diff --git a/LayoutTests/http/tests/security/cross-frame-access-port.html b/LayoutTests/http/tests/security/cross-frame-access-port.html
new file mode 100644 (file)
index 0000000..d91cd9f
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-port.html
@@ -0,0 +1,49 @@
+<html>
+<iframe id="aFrame"></iframe>
+<pre id="console"></pre>
+<script>
+    function log(s)
+    {
+        document.getElementById("console").appendChild(document.createTextNode(s + "\n"));
+    }
+
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    var targetWindow = frames[0];
+    if (!targetWindow.document.body)
+        log("FAIL: targetWindow started with no document, we won't know if the test passed or failed.");
+
+    var iframe = document.getElementById('aFrame');
+    iframe.src = "http://127.0.0.1:8080/security/resources/cross-frame-iframe-for-port-test.html";
+
+    var testDone = false;
+
+    setTimeout(test, 1);
+
+    setTimeout(function() {
+        if (!testDone) {
+            log("FAIL: Cross frame access to a different port was allowed.");
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+    }, 5000);
+
+    function test() {
+        try {
+            if (targetWindow.document.body) {
+                setTimeout(test, 1);
+                return;
+            }
+        } catch (e) {
+        }
+
+        log("PASS: Cross frame access to different port was denied!");
+        testDone = true;
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
+</html>

diff --git a/LayoutTests/http/tests/security/cross-frame-access-protocol.html b/LayoutTests/http/tests/security/cross-frame-access-protocol.html
index e7ed07e3cb57a73528b8d17957d6c269bbf0e09c..d4594ec76f715cf8495ab3fd360c5ec5173f65d5 100644 (file)
--- a/LayoutTests/http/tests/security/cross-frame-access-protocol.html
+++ b/LayoutTests/http/tests/security/cross-frame-access-protocol.html
@@ -13,27 +13,35 @@
     }
 
     var targetWindow = frames[0];
-    if (!targetWindow.document)
+    if (!targetWindow.document.body)
         log("FAIL: targetWindow started with no document, we won't know if the test passed or failed.");
 
     var iframe = document.getElementById('aFrame');
     iframe.src = "https://127.0.0.1:8443/ssl/resources/cross-frame-access-protocol-iframe.html";
 
+    var testDone = false;
+
     setTimeout(test, 1);
 
     setTimeout(function() {
-        log("FAIL: Cross frame access to https from http was allowed.");
-        if (window.layoutTestController)
-            layoutTestController.notifyDone();
+        if (!testDone) {
+            log("FAIL: Cross frame access to https from http was allowed.");
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
     }, 5000);
 
     function test() {
-        if (targetWindow.document) {
-            setTimeout(test, 1);
-            return;
+        try {
+            if (targetWindow.document.body) {
+                setTimeout(test, 1);
+                return;
+            }
+        } catch (e) {
         }
 
         log("PASS: Cross frame access to https from http was denied!");
+        testDone = true;
         if (window.layoutTestController)
             layoutTestController.notifyDone();
     }

diff --git a/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-port-domain-test.html b/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-port-domain-test.html
new file mode 100644 (file)
index 0000000..23a76ce
--- /dev/null
+++ b/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-port-domain-test.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+    <script>
+        document.domain = "127.0.0.1";
+    </script>
+</head>
+<body>
+    <p>This document (cross-frame-iframe-for-port-domain-test.html) was load over on port 8080.</p>
+</body>
+</html>

diff --git a/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-port-test.html b/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-port-test.html
new file mode 100644 (file)
index 0000000..364bbe6
--- /dev/null
+++ b/LayoutTests/http/tests/security/resources/cross-frame-iframe-for-port-test.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+    <p>This document (cross-frame-iframe-for-port-test.html) was load over on port 8080.</p>
+</body>
+</html>