Add window access checks for Suborigins

Add window access checks for Suborigins

As a first enforcement step, this adds access control checks for windows
and JavaScript objects for Suborigins. In short, two origins can only
access each other's objects if they are in the same scheme, host, and
port (as always), but also the same Suborigin. This also sets up the
infrastructure to later start working checks for requests as well. This
does not add any CORS check dependencies on Suborigins yet.

R=jochen@chromium.org
BUG=336894
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=197195

[jww, 2015-06-11 23:03:08]

Hey Jochen. This is a first enforcement CL that adds enforcement for Window
objects between suborigins. Can you take a look? I'd like to get this working
and committed before investing time in other areas, like CORS.

As a note, the approach I'm taking is to create new canAccess and canRequest
variants, canAccessCheckSuborigins and canRequestNoSuborigin respectively, and
go call site by call site to determine which version should be used. The
ultimate goal would be to make canAccess do a Suborigin check by default, and
make it so that a Blink developer needs to opt-out by using an alternate
version, but I think this is the best approach for starting.

[jochen (gone - plz use gerrit), 2015-06-12 12:50:24]

I'd expect that you'd also update WindowProxy::setSecurityToken - v8 uses the
security token of two iframes to figure out whether they can access each other.

https://codereview.chromium.org/1180923003/diff/1/Source/platform/weborigin/S...
File Source/platform/weborigin/SecurityOrigin.h (right):

https://codereview.chromium.org/1180923003/diff/1/Source/platform/weborigin/S...
Source/platform/weborigin/SecurityOrigin.h:95: // Same as canAccess, except that
it adds an additional check to make sure
maybe add some words for developers to figure out which version to use?

[jochen (gone - plz use gerrit), 2015-06-12 12:50:37]

jochen@chromium.org changed reviewers:
+ mkwst@chromium.org

[jochen (gone - plz use gerrit), 2015-06-12 12:50:38]

overall, the approach looks good

[jww, 2015-06-12 15:39:59]

On 2015/06/12 12:50:24, jochen wrote:
> I'd expect that you'd also update WindowProxy::setSecurityToken - v8 uses the
> security token of two iframes to figure out whether they can access each
other.
That implicitly is already the case. setSecurityToken uses
SecurityOrigin::toString(), which serializes the suborigin into the host, this
enforcing suborigins.
> 
>
https://codereview.chromium.org/1180923003/diff/1/Source/platform/weborigin/S...
> File Source/platform/weborigin/SecurityOrigin.h (right):
> 
>
https://codereview.chromium.org/1180923003/diff/1/Source/platform/weborigin/S...
> Source/platform/weborigin/SecurityOrigin.h:95: // Same as canAccess, except
that
> it adds an additional check to make sure
> maybe add some words for developers to figure out which version to use?

[jww, 2015-06-12 15:40:44]

I tried to improve the comment. Let me know what you all think, and if it's
commitable at this point.

https://codereview.chromium.org/1180923003/diff/1/Source/platform/weborigin/S...
File Source/platform/weborigin/SecurityOrigin.h (right):

https://codereview.chromium.org/1180923003/diff/1/Source/platform/weborigin/S...
Source/platform/weborigin/SecurityOrigin.h:95: // Same as canAccess, except that
it adds an additional check to make sure
On 2015/06/12 12:50:24, jochen wrote:
> maybe add some words for developers to figure out which version to use?

I've added some clarifications to the comments. For now, I believe the answer is
basically "use canAccess" (until we have a more definitive design for what
Suborigins is supposed to cover).

[jochen (gone - plz use gerrit), 2015-06-15 14:47:00]

lgtm

[jww, 2015-06-15 16:32:00]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2015-06-15 16:32:24]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1180923003/20001

[commit-bot: I haz the power, 2015-06-15 16:36:04]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-06-15 16:36:04]

Try jobs failed on following builders:
  mac_blink_compile_dbg on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/mac_blink_compile_dbg/bu...)
  mac_blink_rel on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/mac_blink_rel/builds/58947)

[jww, 2015-06-15 16:41:23]

The CQ bit was checked by jww@chromium.org

[jww, 2015-06-15 16:41:23]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org
Link to the patchset: https://codereview.chromium.org/1180923003/#ps40001
(title: "Rebase on ToT")

[commit-bot: I haz the power, 2015-06-15 16:41:43]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1180923003/40001

[commit-bot: I haz the power, 2015-06-15 17:16:48]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-06-15 17:16:49]

Try jobs failed on following builders:
  mac_blink_rel on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/mac_blink_rel/builds/58949)

[jww, 2015-06-15 17:43:44]

The CQ bit was checked by jww@chromium.org

[jww, 2015-06-15 17:43:44]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org
Link to the patchset: https://codereview.chromium.org/1180923003/#ps60001
(title: "Unit test fix")

[commit-bot: I haz the power, 2015-06-15 17:43:59]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1180923003/60001

[commit-bot: I haz the power, 2015-06-15 20:42:41]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-06-15 20:42:42]

Try jobs failed on following builders:
  win_blink_rel on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/66671)

[jww, 2015-06-15 21:04:44]

The CQ bit was checked by jww@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-06-15 21:05:17]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1180923003/60001

[commit-bot: I haz the power, 2015-06-15 23:01:28]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-06-15 23:01:29]

Dry run: Try jobs failed on following builders:
  win_blink_rel on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/66694)

[jww, 2015-06-16 20:05:26]

The CQ bit was checked by jww@chromium.org

[jww, 2015-06-16 20:05:26]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org
Link to the patchset: https://codereview.chromium.org/1180923003/#ps80001
(title: "Fix tests on Windows")

[commit-bot: I haz the power, 2015-06-16 20:06:16]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1180923003/80001

[commit-bot: I haz the power, 2015-06-16 21:08:54]

Committed patchset #5 (id:80001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=197195