Make Document::isSecureContext() work for OOPIFs

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 3368 matching lines @@
     // Additionally, with
     //   <iframe src="scheme-has-exception://host">
     //     <iframe src="http://host"></iframe>
     //     <iframe sandbox src="http://host"></iframe>
     //   </iframe>
     // both inner iframes would fail the check, even though the outermost iframe
     // passes.
     //
     // In all cases, a frame must be potentially trustworthy in addition to
     // having an exception listed in order for the exception to be granted.
-    if (SecurityContext::isSandboxed(SandboxOrigin)) {
-        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url());
-        if (!isOriginPotentiallyTrustworthy(origin.get(), errorMessage))
-            return false;
-        if (SchemeRegistry::schemeShouldBypassSecureContextCheck(origin->protocol()))
-            return true;
-    } else {
-        if (!isOriginPotentiallyTrustworthy(securityOrigin(), errorMessage))
-            return false;
-        if (SchemeRegistry::schemeShouldBypassSecureContextCheck(securityOrigin()->protocol()))
-            return true;
-    }
+    if (!isOriginPotentiallyTrustworthy(securityOrigin(), errorMessage))
+        return false;
+    if (SchemeRegistry::schemeShouldBypassSecureContextCheck(securityOrigin()->protocol()))
+        return true;
 
     if (privilegeContextCheck == StandardSecureContextCheck) {
-        Document* context = parentDocument();
-        while (context) {
-            // Skip to the next ancestor if it's a srcdoc.
-            if (!context->isSrcdocDocument()) {
-                if (context->securityContext().isSandboxed(SandboxOrigin)) {
-                    // For a sandboxed origin, use the document's URL.
-                    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(context->url());
-                    if (!isOriginPotentiallyTrustworthy(origin.get(), errorMessage))
-                        return false;
-                } else {
-                    if (!isOriginPotentiallyTrustworthy(context->securityOrigin(), errorMessage))
-                        return false;
-                }
-            }
-            context = context->parentDocument();
+        if (!m_frame)
+            return true;
+        Frame* parent = m_frame->tree().parent();
+        while (parent) {
+            if (!isOriginPotentiallyTrustworthy(parent->securityContext()->securityOrigin(), errorMessage))
+                return false;
+            parent = parent->tree().parent();
         }
     }
     return true;
 }
 
 StyleSheetList* Document::styleSheets()
 {
     if (!m_styleSheetList)
         m_styleSheetList = StyleSheetList::create(this);
     return m_styleSheetList.get();
@@ skipping 1507 matching lines @@
         enforceStrictMixedContentChecking();
     setInsecureRequestsPolicy(initializer.getInsecureRequestsPolicy());
     if (initializer.insecureNavigationsToUpgrade()) {
         for (auto toUpgrade : *initializer.insecureNavigationsToUpgrade())
             addInsecureNavigationUpgrade(toUpgrade);
     }
 
     if (isSandboxed(SandboxOrigin)) {
         m_cookieURL = m_url;
         setSecurityOrigin(SecurityOrigin::createUnique());
-        // If we're supposed to inherit our security origin from our owner,
-        // but we're also sandboxed, the only thing we inherit is the ability
-        // to load local resources. This lets about:blank iframes in file://
-        // URL documents load images and other resources from the file system.
+        // If we're supposed to inherit our security origin from our
+        // owner, but we're also sandboxed, the only things we inherit are
+        // the origin's potential trustworthiness and the ability to
+        // load local resources. The latter lets about:blank iframes in
+        // file:// URL documents load images and other resources from
+        // the file system.
+        if (initializer.owner() && initializer.owner()->securityOrigin()->isPotentiallyTrustworthy())
+            setUniqueOriginIsPotentiallyTrustworthy();
         if (initializer.owner() && initializer.owner()->securityOrigin()->canLoadLocalResources())
             securityOrigin()->grantLoadLocalResources();
     } else if (initializer.owner()) {
         m_cookieURL = initializer.owner()->cookieURL();
         // We alias the SecurityOrigins to match Firefox, see Bug 15313
         // https://bugs.webkit.org/show_bug.cgi?id=15313
         setSecurityOrigin(initializer.owner()->securityOrigin());
     } else {
         m_cookieURL = m_url;
         setSecurityOrigin(SecurityOrigin::create(m_url));
@@ skipping 35 matching lines @@
                 securityOrigin()->blockLocalAccessFromLocalOrigin();
             }
         }
     }
 
     if (initializer.shouldTreatURLAsSrcdocDocument()) {
         m_isSrcdocDocument = true;
         setBaseURLOverride(initializer.parentBaseURL());
     }
 
-    if (securityOrigin()->hasSuborigin())

[alexmos, 2016/03/09 18:45:06]

Weird that there were two identical enforceSuborigin calls previously.  That was
presumably a bug?

[estark, 2016/03/10 00:53:44]

Huh, I actually didn't notice that I deleted this; I think I must have done it
accidentally while resolving a conflict. I asked jww@ though and he thinks it
probably was indeed a mistake to have it twice. And no tests are failing so I
think it's okay to leave it out.

-        enforceSuborigin(securityOrigin()->suboriginName());
+    if (securityOrigin()->isUnique() && SecurityOrigin::create(m_url)->isPotentiallyTrustworthy())
+        setUniqueOriginIsPotentiallyTrustworthy();
 }
 
 void Document::initContentSecurityPolicy(PassRefPtrWillBeRawPtr<ContentSecurityPolicy> csp)
 {
     setContentSecurityPolicy(csp ? csp : ContentSecurityPolicy::create());
     if (m_frame && m_frame->tree().parent() && m_frame->tree().parent()->isLocalFrame()) {
         ContentSecurityPolicy* parentCSP = toLocalFrame(m_frame->tree().parent())->document()->contentSecurityPolicy();
         if (shouldInheritSecurityOriginFromOwner(m_url)) {
             contentSecurityPolicy()->copyStateFrom(parentCSP);
         } else if (isPluginDocument()) {
@@ skipping 40 matching lines @@
     LocalFrame* frame = executingFrame();
     if (!frame)
         return false;
     if (!node->document().executingFrame())
         return false;
     if (!frame->script().canExecuteScripts(AboutToExecuteScript))
         return false;
     return true;
 }
 
+void Document::enforceSandboxFlags(SandboxFlags mask)
+{
+    RefPtr<SecurityOrigin> standInOrigin = securityOrigin();
+    applySandboxFlags(mask);
+    if (standInOrigin && !standInOrigin->isUnique() && securityOrigin()->isUnique() && standInOrigin->isPotentiallyTrustworthy())
+        setUniqueOriginIsPotentiallyTrustworthy();
+}
+
 void Document::updateSecurityOrigin(PassRefPtr<SecurityOrigin> origin)
 {
     setSecurityOrigin(origin);
     didUpdateSecurityOrigin();
 }
 
 void Document::didUpdateSecurityOrigin()
 {
     if (!m_frame)
         return;
@@ skipping 839 matching lines @@
     securityContext().setShouldEnforceStrictMixedContentChecking(true);
     if (frame())
         frame()->loader().client()->didEnforceStrictMixedContentChecking();
 }
 
 PassOwnPtrWillBeRawPtr<OriginTrialContext> Document::createOriginTrialContext()
 {
     return adoptPtrWillBeNoop(new DocumentOriginTrialContext(this));
 }
 
+void Document::setUniqueOriginIsPotentiallyTrustworthy()
+{
+    securityOrigin()->setUniqueOriginIsPotentiallyTrustworthy(true);
+    if (frame())
+        frame()->loader().client()->didSetUniqueOriginPotentiallyTrustworthy();
+}
+
 DEFINE_TRACE(Document)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_importsController);
     visitor->trace(m_docType);
     visitor->trace(m_implementation);
     visitor->trace(m_autofocusElement);
     visitor->trace(m_focusedElement);
     visitor->trace(m_sequentialFocusNavigationStartingPoint);
     visitor->trace(m_hoverNode);
@@ skipping 61 matching lines @@
 #ifndef NDEBUG
 using namespace blink;
 void showLiveDocumentInstances()
 {
     Document::WeakDocumentSet& set = Document::liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().getString().utf8().data());
 }
 #endif