Harden the implementation of '--disable-web-security'

third_party/WebKit/Source/platform/weborigin/SecurityOrigin.cpp

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 17 matching lines @@
 
 #include "config.h"
 #include "platform/weborigin/SecurityOrigin.h"
 
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOriginCache.h"
 #include "platform/weborigin/SecurityPolicy.h"
+#include "public/platform/Platform.h"
 #include "url/url_canon_ip.h"
 #include "wtf/HexNumber.h"
 #include "wtf/MainThread.h"
 #include "wtf/NotFound.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace blink {
@@ skipping 70 matching lines @@
     return false;
 }
 
 SecurityOrigin::SecurityOrigin(const KURL& url)
     : m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
     , m_host(url.host().isNull() ? "" : url.host().lower())
     , m_port(url.port())
     , m_effectivePort(url.port() ? url.port() : defaultPortForProtocol(m_protocol))
     , m_isUnique(false)
     , m_universalAccess(false)
+    , m_universalAccessForFileOrigins(false)
     , m_domainWasSetInDOM(false)
     , m_blockLocalAccessFromLocalOrigin(false)
 {
     // Suborigins are serialized into the host, so extract it if necessary.
     String suboriginName;
     if (deserializeSuboriginAndHost(m_host, suboriginName, m_host))
         addSuborigin(suboriginName);
 
     // document.domain starts as m_host, but can be set by the DOM.
     m_domain = m_host;
 
     if (isDefaultPortForProtocol(m_port, m_protocol))
         m_port = InvalidPort;
 
     // By default, only local SecurityOrigins can load local resources.
     m_canLoadLocalResources = isLocal();
 }
 
 SecurityOrigin::SecurityOrigin()
     : m_protocol("")
     , m_host("")
     , m_domain("")
     , m_suboriginName(WTF::String())
     , m_port(InvalidPort)
     , m_effectivePort(InvalidPort)
     , m_isUnique(true)
     , m_universalAccess(false)
+    , m_universalAccessForFileOrigins(false)
     , m_domainWasSetInDOM(false)
     , m_canLoadLocalResources(false)
     , m_blockLocalAccessFromLocalOrigin(false)
 {
 }
 
 SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
     : m_protocol(other->m_protocol.isolatedCopy())
     , m_host(other->m_host.isolatedCopy())
     , m_domain(other->m_domain.isolatedCopy())
     , m_suboriginName(other->m_suboriginName)
     , m_port(other->m_port)
     , m_effectivePort(other->m_effectivePort)
     , m_isUnique(other->m_isUnique)
     , m_universalAccess(other->m_universalAccess)
+    , m_universalAccessForFileOrigins(other->m_universalAccessForFileOrigins)
     , m_domainWasSetInDOM(other->m_domainWasSetInDOM)
     , m_canLoadLocalResources(other->m_canLoadLocalResources)
     , m_blockLocalAccessFromLocalOrigin(other->m_blockLocalAccessFromLocalOrigin)
 {
 }
 
 PassRefPtr<SecurityOrigin> SecurityOrigin::create(const KURL& url)
 {
     if (RefPtr<SecurityOrigin> origin = cachedOrigin(url))
         return origin.release();
@@ skipping 47 matching lines @@
         return true;
 
     if (SecurityPolicy::isOriginWhiteListedTrustworthy(*SecurityOrigin::create(url).get()))
         return true;
 
     return false;
 }
 
 bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
 {
-    if (m_universalAccess)
+    if (m_universalAccess) {
+        // TODO(mkwst): I would love to make this a RELEASE_ASSERT_WITH_SECURITY_IMPLICATIONS, but that
+        // would be seriously expensive as it would inject an IPC to the embedder on this very hot path.
+        ASSERT(blink::Platform::current()->canGrantUniversalAccess());

[esprehn, 2015/12/10 08:06:44]

you don't need the blink:: prefix, also this should probably null check platform
for tests?

+        return true;
+    }
+
+    if (m_universalAccessForFileOrigins && isLocal())
         return true;
 
     if (this == other)
         return true;
 
     if (isUnique() || other->isUnique())
         return false;
 
     // document.domain handling, as per https://html.spec.whatwg.org/multipage/browsers.html#dom-document-domain:
     //
@@ skipping 33 matching lines @@
 
 bool SecurityOrigin::passesFileCheck(const SecurityOrigin* other) const
 {
     ASSERT(isLocal() && other->isLocal());
 
     return !m_blockLocalAccessFromLocalOrigin && !other->m_blockLocalAccessFromLocalOrigin;
 }
 
 bool SecurityOrigin::canRequest(const KURL& url) const
 {
-    if (m_universalAccess)
+    if (m_universalAccess) {
+        // TODO(mkwst): I would love to make this a RELEASE_ASSERT_WITH_SECURITY_IMPLICATIONS, but that
+        // would be seriously expensive as it would inject an IPC to the embedder on this very hot path.
+        ASSERT(blink::Platform::current()->canGrantUniversalAccess());

[esprehn, 2015/12/10 08:06:44]

ditto

+        return true;
+    }
+
+    if (m_universalAccessForFileOrigins && isLocal())
         return true;
 
     if (cachedOrigin(url) == this)
         return true;
 
     if (isUnique())
         return false;
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
 
@@ skipping 28 matching lines @@
     // data URL security, then we can remove this function in favor of
     // !canRequest.
     if (url.protocolIsData())
         return false;
 
     return true;
 }
 
 bool SecurityOrigin::canDisplay(const KURL& url) const
 {
-    if (m_universalAccess)
+    if (m_universalAccess) {
+        // TODO(mkwst): I would love to make this a RELEASE_ASSERT_WITH_SECURITY_IMPLICATIONS, but that
+        // would be seriously expensive as it would inject an IPC to the embedder on this very hot path.
+        ASSERT(blink::Platform::current()->canGrantUniversalAccess());

[esprehn, 2015/12/10 08:06:44]

ditto

+        return true;
+    }
+
+    if (m_universalAccessForFileOrigins && isLocal())
         return true;
 
     String protocol = url.protocol().lower();
 
     if (SchemeRegistry::canDisplayOnlyIfCanRequest(protocol))
         return canRequest(url);
 
     if (SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
         return m_protocol == protocol || SecurityPolicy::isAccessToURLWhiteListed(this, url);
 
@@ skipping 20 matching lines @@
 {
     // Granting privileges to some, but not all, documents in a SecurityOrigin
     // is a security hazard because the documents without the privilege can
     // obtain the privilege by injecting script into the documents that have
     // been granted the privilege.
     m_canLoadLocalResources = true;
 }
 
 void SecurityOrigin::grantUniversalAccess()
 {
+    // This must not be granted unless the embedder says we can grant this kind of permission.
+    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(blink::Platform::current()->canGrantUniversalAccess());
     m_universalAccess = true;
 }
 
+void SecurityOrigin::grantUniversalAccessForFileOrigins()
+{
+    // This must not be granted to non-local origins, hence the release assert.
+    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(isLocal());
+    m_universalAccessForFileOrigins = true;
+}
+
 void SecurityOrigin::blockLocalAccessFromLocalOrigin()
 {
     ASSERT(isLocal());
     m_blockLocalAccessFromLocalOrigin = true;
 }
 
 bool SecurityOrigin::isLocal() const
 {
     return SchemeRegistry::shouldTreatURLSchemeAsLocal(m_protocol);
 }
@@ skipping 134 matching lines @@
 {
     ASSERT(isMainThread());
     DEFINE_STATIC_LOCAL(const KURL, uniqueSecurityOriginURL, (ParsedURLString, "data:,"));
     return uniqueSecurityOriginURL;
 }
 
 PassOwnPtr<SecurityOrigin::PrivilegeData> SecurityOrigin::createPrivilegeData() const
 {
     OwnPtr<PrivilegeData> privilegeData = adoptPtr(new PrivilegeData);
     privilegeData->m_universalAccess = m_universalAccess;
+    privilegeData->m_universalAccessForFileOrigins = m_universalAccessForFileOrigins;
     privilegeData->m_canLoadLocalResources = m_canLoadLocalResources;
     privilegeData->m_blockLocalAccessFromLocalOrigin = m_blockLocalAccessFromLocalOrigin;
     return privilegeData.release();
 }
 
 void SecurityOrigin::transferPrivilegesFrom(PassOwnPtr<PrivilegeData> privilegeData)
 {
     m_universalAccess = privilegeData->m_universalAccess;
+    m_universalAccessForFileOrigins = privilegeData->m_universalAccessForFileOrigins;
     m_canLoadLocalResources = privilegeData->m_canLoadLocalResources;
     m_blockLocalAccessFromLocalOrigin = privilegeData->m_blockLocalAccessFromLocalOrigin;
 }
 
 } // namespace blink