third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation.html - Issue 1675473002: Update V8 security token correctly when installing a new Document.

Side by Side Diff: third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation.html

Issue 1675473002: Update V8 security token correctly when installing a new Document. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Created 4 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « no previous file | third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3 <head>

	4 <script src="/js-test-resources/js-test.js"></script>

	5 <script>

	6 var jsTestIsAsync = true;

	7 function runTest() {

	8 var frame = document.body.appendChild(document.createElement("iframe"));

	9 frame.src = "http://localhost:8000/security/resources/opened-document-security -origin-resets-on-navigation-frame.html";

	10 frame.onload = function () {
	dcheng 2016/02/05 00:48:08 After this loads, frame tree looks like this: [ M After this loads, frame tree looks like this: [ Main frame: origin 127.0.0.1:8000 ] `--[ Subframe A: origin localhost:8000 ] `--[Subframe B: origin doesn't matter yet ]
	11 frame.onload = null;

	12 var blob = new Blob(["<script>(" + function () {
	dcheng 2016/02/05 00:48:08 The blob URL has origin 127.0.0.1:8000. Once subfr The blob URL has origin 127.0.0.1:8000. Once subframe A is finished loading, the blob URL is loaded into subframe B. The frame tree + origins now look like this: [ Main frame: origin 127.0.0.1:8000 ] `--[ Subframe A: origin localhost:8000 ] `--[Subframe B: 127.0.0.1:8000 (blob URL) ]
	13 frame = document.documentElement.appendChild(document.createElement("ifram e"));
	dcheng 2016/02/05 00:48:08 After subframe C loads, frame tree looks like this After subframe C loads, frame tree looks like this: [ Main frame: origin 127.0.0.1:8000 ] `--[ Subframe A: origin localhost:8000 ] `--[Subframe B: 127.0.0.1:8000 (blob URL) ] `--[Subframe C: 127.0.0.1:8000 ]
	14 frame.contentWindow.setTimeout("parent.document.open()", 0);
	dcheng 2016/02/05 00:48:08 document.open() apparently aliases the parent wind document.open() apparently aliases the parent window's security origin: Once this timer fires, the frame tree + origins look like this: [ Main frame: origin 127.0.0.1:8000 ] `--[ Subframe A: origin localhost:8000 ] `--[Subframe B: origin localhost:8000 ] Subframe C is detached due to the document.open() call, so it is no longer in the frame tree.
	15 setTimeout(function () {
	dcheng 2016/02/05 00:48:08 This setTimeout is set on the context of Subframe This setTimeout is set on the context of Subframe B. But the document.open() call does NOT cancel it. So now we have: [ Main frame: origin 127.0.0.1:8000 ] `--[ Subframe A: origin localhost:8000 ] `--[Subframe B: javascript URL: origin = ???? ] The javascript URL should have origin 127.0.0.1:8000, because it originates from the blob URL. However, due to the bug of calling setSecurityOrigin(): - The Document has the right security origin (127.0.0.1:8000) - But the security token of the v8 Context is not updated and is still localhost:8000. So v8 allows parent.eval to proceed, even though parent (subframe A) is cross-origin to subframe B.
	16 location = "javascript:'<script>setTimeout(top.finishJSTest, 0); paren t.eval(\"alert(location)\"); top.testFailed(\"context security origin was not up dated!\");</scr" + "ipt>'" }, 0);

	17 } + "())</sc" + "ript>"], {type: "text/html"});

	18 frame.contentWindow[0].location = URL.createObjectURL(blob);

	19 }

	20 }

	21 </script>

	22 </head>

	23 <body onload="runTest()">

	24 </body>

	25 </html>

OLD	NEW