Bugfix in html_dart2js: Detect window objects in a way compatible with cross domain iframes

Bugfix in html_dart2js: Detect window objects in a way compatible with cross domain iframes

The "setTimeout" member in window object can only be accessed if the window
object is from the same origin. Cross origin windows will throw a security error
exception.

This is fixed by checking for "postMessage" in the window object (which
can be accessed even in cross-origin windows).

BUG=http://dartbug.com/20166
R=blois@google.com

Committed: https://code.google.com/p/dart/source/detail?r=38517

[blois, 2014-07-23 17:35:04]

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
File dart/sdk/lib/html/dart2js/html_dart2js.dart (right):

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
dart/sdk/lib/html/dart2js/html_dart2js.dart:35439: +  // Assume it's a Window if
it contains the self/window properties.  It may be
This change needs to be made in:
https://code.google.com/p/dart/source/browse/branches/bleeding_edge/dart/tool...

Then from tools/dom/scripts, run go.sh.

(Then revert any changes to sdk/lib/_blink/dartium/_blink_dartium.dart :( )

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
dart/sdk/lib/html/dart2js/html_dart2js.dart:35442: +  if (JS('bool', r'"self" in
# && "window" in #', e, e)) {
The primary API exposed by _DOMWindowCrossFrame is postMessage- perhaps just
change setInterval to postMessage? The 'self' and 'window' check seems a bit
broad.

[floitsch, 2014-07-23 17:57:36]

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
File dart/sdk/lib/html/dart2js/html_dart2js.dart (right):

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
dart/sdk/lib/html/dart2js/html_dart2js.dart:35442: +  if (JS('bool', r'"self" in
# && "window" in #', e, e)) {
On 2014/07/23 17:35:04, blois wrote:
> The primary API exposed by _DOMWindowCrossFrame is postMessage- perhaps just
> change setInterval to postMessage? The 'self' and 'window' check seems a bit
> broad.
> 

That would bring it back to being a security violation. (Unless I'm missing
something and "postMessage" can also be accessed).

[kustermann, 2014-07-23 20:10:49]

Thanks, PTAL

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
File dart/sdk/lib/html/dart2js/html_dart2js.dart (right):

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
dart/sdk/lib/html/dart2js/html_dart2js.dart:35439: +  // Assume it's a Window if
it contains the self/window properties.  It may be
On 2014/07/23 17:35:04, blois wrote:
> This change needs to be made in:
>
https://code.google.com/p/dart/source/browse/branches/bleeding_edge/dart/tool...
> 
> Then from tools/dom/scripts, run go.sh.
> 
> (Then revert any changes to sdk/lib/_blink/dartium/_blink_dartium.dart :( )

Done.

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
dart/sdk/lib/html/dart2js/html_dart2js.dart:35442: +  if (JS('bool', r'"self" in
# && "window" in #', e, e)) {
On 2014/07/23 17:57:36, floitsch wrote:
> On 2014/07/23 17:35:04, blois wrote:
> > The primary API exposed by _DOMWindowCrossFrame is postMessage- perhaps just
> > change setInterval to postMessage? The 'self' and 'window' check seems a bit
> > broad.
> > 
> 
> That would bring it back to being a security violation. (Unless I'm missing
> something and "postMessage" can also be accessed).

That's actually not a security violation, because frames/windows of different
origins can communicate with each other using postMessage.

https://codereview.chromium.org/406143004/diff/1/dart/sdk/lib/html/dart2js/ht...
dart/sdk/lib/html/dart2js/html_dart2js.dart:35442: +  if (JS('bool', r'"self" in
# && "window" in #', e, e)) {
On 2014/07/23 17:35:04, blois wrote:
> The primary API exposed by _DOMWindowCrossFrame is postMessage- perhaps just
> change setInterval to postMessage? The 'self' and 'window' check seems a bit
> broad.
> 

Good point. Done.

[I searched a bit on the internet but was unable to find a spec which attributes
are whitelisted (so far I know about:postMessage, self, window and frames).

[blois, 2014-07-23 20:14:27]

lgtm

[kustermann, 2014-07-23 20:16:43]

Committed patchset #2 manually as r38517 (presubmit successful).