| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2009 Google Inc. All rights reserved. | 2 * Copyright (C) 2009 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 24 matching lines...) Expand all Loading... |
| 35 #include "core/frame/LocalDOMWindow.h" | 35 #include "core/frame/LocalDOMWindow.h" |
| 36 #include "core/frame/LocalFrame.h" | 36 #include "core/frame/LocalFrame.h" |
| 37 #include "core/frame/Settings.h" | 37 #include "core/frame/Settings.h" |
| 38 #include "core/html/HTMLFrameElementBase.h" | 38 #include "core/html/HTMLFrameElementBase.h" |
| 39 #include "platform/weborigin/SecurityOrigin.h" | 39 #include "platform/weborigin/SecurityOrigin.h" |
| 40 | 40 |
| 41 namespace blink { | 41 namespace blink { |
| 42 | 42 |
| 43 static bool isOriginAccessibleFromDOMWindow(const SecurityOrigin* targetOrigin,
const LocalDOMWindow* accessingWindow) | 43 static bool isOriginAccessibleFromDOMWindow(const SecurityOrigin* targetOrigin,
const LocalDOMWindow* accessingWindow) |
| 44 { | 44 { |
| 45 return accessingWindow && accessingWindow->document()->securityOrigin()->can
AccessCheckSuborigins(targetOrigin); | 45 return accessingWindow && accessingWindow->document()->getSecurityOrigin()->
canAccessCheckSuborigins(targetOrigin); |
| 46 } | 46 } |
| 47 | 47 |
| 48 static bool canAccessFrame(v8::Isolate* isolate, const LocalDOMWindow* accessing
Window, const SecurityOrigin* targetFrameOrigin, const DOMWindow* targetWindow,
ExceptionState& exceptionState) | 48 static bool canAccessFrame(v8::Isolate* isolate, const LocalDOMWindow* accessing
Window, const SecurityOrigin* targetFrameOrigin, const DOMWindow* targetWindow,
ExceptionState& exceptionState) |
| 49 { | 49 { |
| 50 ASSERT_WITH_SECURITY_IMPLICATION(!(targetWindow && targetWindow->frame()) ||
targetWindow == targetWindow->frame()->domWindow()); | 50 ASSERT_WITH_SECURITY_IMPLICATION(!(targetWindow && targetWindow->frame()) ||
targetWindow == targetWindow->frame()->domWindow()); |
| 51 | 51 |
| 52 if (isOriginAccessibleFromDOMWindow(targetFrameOrigin, accessingWindow)) | 52 if (isOriginAccessibleFromDOMWindow(targetFrameOrigin, accessingWindow)) |
| 53 return true; | 53 return true; |
| 54 | 54 |
| 55 if (targetWindow) | 55 if (targetWindow) |
| (...skipping 12 matching lines...) Expand all Loading... |
| 68 accessingWindow->printErrorMessage(targetWindow->crossDomainAccessErrorM
essage(accessingWindow)); | 68 accessingWindow->printErrorMessage(targetWindow->crossDomainAccessErrorM
essage(accessingWindow)); |
| 69 return false; | 69 return false; |
| 70 } | 70 } |
| 71 | 71 |
| 72 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const DOMWindow* target, ExceptionState& exceptionState) | 72 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const DOMWindow* target, ExceptionState& exceptionState) |
| 73 { | 73 { |
| 74 ASSERT(target); | 74 ASSERT(target); |
| 75 const Frame* frame = target->frame(); | 75 const Frame* frame = target->frame(); |
| 76 if (!frame || !frame->securityContext()) | 76 if (!frame || !frame->securityContext()) |
| 77 return false; | 77 return false; |
| 78 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->se
curityOrigin(), target, exceptionState); | 78 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->ge
tSecurityOrigin(), target, exceptionState); |
| 79 } | 79 } |
| 80 | 80 |
| 81 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const DOMWindow* target, SecurityReportingOption reportin
gOption) | 81 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const DOMWindow* target, SecurityReportingOption reportin
gOption) |
| 82 { | 82 { |
| 83 ASSERT(target); | 83 ASSERT(target); |
| 84 const Frame* frame = target->frame(); | 84 const Frame* frame = target->frame(); |
| 85 if (!frame || !frame->securityContext()) | 85 if (!frame || !frame->securityContext()) |
| 86 return false; | 86 return false; |
| 87 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->se
curityOrigin(), target, reportingOption); | 87 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->ge
tSecurityOrigin(), target, reportingOption); |
| 88 } | 88 } |
| 89 | 89 |
| 90 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const EventTarget* target, ExceptionState& exceptionState
) | 90 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const EventTarget* target, ExceptionState& exceptionState
) |
| 91 { | 91 { |
| 92 ASSERT(target); | 92 ASSERT(target); |
| 93 const DOMWindow* window = target->toDOMWindow(); | 93 const DOMWindow* window = target->toDOMWindow(); |
| 94 if (!window) { | 94 if (!window) { |
| 95 // We only need to check the access to Window objects which are | 95 // We only need to check the access to Window objects which are |
| 96 // cross-origin accessible. If it's not a Window, the object's | 96 // cross-origin accessible. If it's not a Window, the object's |
| 97 // origin must always be the same origin (or it already leaked). | 97 // origin must always be the same origin (or it already leaked). |
| 98 return true; | 98 return true; |
| 99 } | 99 } |
| 100 const Frame* frame = window->frame(); | 100 const Frame* frame = window->frame(); |
| 101 if (!frame || !frame->securityContext()) | 101 if (!frame || !frame->securityContext()) |
| 102 return false; | 102 return false; |
| 103 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->se
curityOrigin(), window, exceptionState); | 103 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->ge
tSecurityOrigin(), window, exceptionState); |
| 104 } | 104 } |
| 105 | 105 |
| 106 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Location* target, ExceptionState& exceptionState) | 106 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Location* target, ExceptionState& exceptionState) |
| 107 { | 107 { |
| 108 ASSERT(target); | 108 ASSERT(target); |
| 109 const Frame* frame = target->frame(); | 109 const Frame* frame = target->frame(); |
| 110 if (!frame || !frame->securityContext()) | 110 if (!frame || !frame->securityContext()) |
| 111 return false; | 111 return false; |
| 112 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->se
curityOrigin(), frame->domWindow(), exceptionState); | 112 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->ge
tSecurityOrigin(), frame->domWindow(), exceptionState); |
| 113 } | 113 } |
| 114 | 114 |
| 115 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Location* target, SecurityReportingOption reporting
Option) | 115 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Location* target, SecurityReportingOption reporting
Option) |
| 116 { | 116 { |
| 117 ASSERT(target); | 117 ASSERT(target); |
| 118 const Frame* frame = target->frame(); | 118 const Frame* frame = target->frame(); |
| 119 if (!frame || !frame->securityContext()) | 119 if (!frame || !frame->securityContext()) |
| 120 return false; | 120 return false; |
| 121 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->se
curityOrigin(), frame->domWindow(), reportingOption); | 121 return canAccessFrame(isolate, accessingWindow, frame->securityContext()->ge
tSecurityOrigin(), frame->domWindow(), reportingOption); |
| 122 } | 122 } |
| 123 | 123 |
| 124 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Node* target, ExceptionState& exceptionState) | 124 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Node* target, ExceptionState& exceptionState) |
| 125 { | 125 { |
| 126 if (!target) | 126 if (!target) |
| 127 return false; | 127 return false; |
| 128 return canAccessFrame(isolate, accessingWindow, target->document().securityO
rigin(), target->document().domWindow(), exceptionState); | 128 return canAccessFrame(isolate, accessingWindow, target->document().getSecuri
tyOrigin(), target->document().domWindow(), exceptionState); |
| 129 } | 129 } |
| 130 | 130 |
| 131 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Node* target, SecurityReportingOption reportingOpti
on) | 131 bool BindingSecurity::shouldAllowAccessTo(v8::Isolate* isolate, const LocalDOMWi
ndow* accessingWindow, const Node* target, SecurityReportingOption reportingOpti
on) |
| 132 { | 132 { |
| 133 if (!target) | 133 if (!target) |
| 134 return false; | 134 return false; |
| 135 return canAccessFrame(isolate, accessingWindow, target->document().securityO
rigin(), target->document().domWindow(), reportingOption); | 135 return canAccessFrame(isolate, accessingWindow, target->document().getSecuri
tyOrigin(), target->document().domWindow(), reportingOption); |
| 136 } | 136 } |
| 137 | 137 |
| 138 bool BindingSecurity::shouldAllowAccessToFrame(v8::Isolate* isolate, const Local
DOMWindow* accessingWindow, const Frame* target, SecurityReportingOption reporti
ngOption) | 138 bool BindingSecurity::shouldAllowAccessToFrame(v8::Isolate* isolate, const Local
DOMWindow* accessingWindow, const Frame* target, SecurityReportingOption reporti
ngOption) |
| 139 { | 139 { |
| 140 if (!target || !target->securityContext()) | 140 if (!target || !target->securityContext()) |
| 141 return false; | 141 return false; |
| 142 return canAccessFrame(isolate, accessingWindow, target->securityContext()->s
ecurityOrigin(), target->domWindow(), reportingOption); | 142 return canAccessFrame(isolate, accessingWindow, target->securityContext()->g
etSecurityOrigin(), target->domWindow(), reportingOption); |
| 143 } | 143 } |
| 144 | 144 |
| 145 } // namespace blink | 145 } // namespace blink |
| OLD | NEW |