OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org) | 2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org) |
3 * (C) 1999 Antti Koivisto (koivisto@kde.org) | 3 * (C) 1999 Antti Koivisto (koivisto@kde.org) |
4 * (C) 2001 Dirk Mueller (mueller@kde.org) | 4 * (C) 2001 Dirk Mueller (mueller@kde.org) |
5 * (C) 2006 Alexey Proskuryakov (ap@webkit.org) | 5 * (C) 2006 Alexey Proskuryakov (ap@webkit.org) |
6 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All r
ights reserved. | 6 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All r
ights reserved. |
7 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.t
orchmobile.com/) | 7 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.t
orchmobile.com/) |
8 * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved. | 8 * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved. |
9 * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies) | 9 * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies) |
10 * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved. | 10 * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved. |
(...skipping 2416 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2427 exceptionState.throwDOMException(InvalidStateError, "Imported document d
oesn't support open()."); | 2427 exceptionState.throwDOMException(InvalidStateError, "Imported document d
oesn't support open()."); |
2428 return; | 2428 return; |
2429 } | 2429 } |
2430 | 2430 |
2431 if (!isHTMLDocument()) { | 2431 if (!isHTMLDocument()) { |
2432 exceptionState.throwDOMException(InvalidStateError, "Only HTML documents
support open()."); | 2432 exceptionState.throwDOMException(InvalidStateError, "Only HTML documents
support open()."); |
2433 return; | 2433 return; |
2434 } | 2434 } |
2435 | 2435 |
2436 if (enteredDocument) { | 2436 if (enteredDocument) { |
2437 if (!securityOrigin()->canAccess(enteredDocument->securityOrigin())) { | 2437 if (!getSecurityOrigin()->canAccess(enteredDocument->getSecurityOrigin()
)) { |
2438 exceptionState.throwSecurityError("Can only call open() on same-orig
in documents."); | 2438 exceptionState.throwSecurityError("Can only call open() on same-orig
in documents."); |
2439 return; | 2439 return; |
2440 } | 2440 } |
2441 setSecurityOrigin(enteredDocument->securityOrigin()); | 2441 setSecurityOrigin(enteredDocument->getSecurityOrigin()); |
2442 setURL(enteredDocument->url()); | 2442 setURL(enteredDocument->url()); |
2443 m_cookieURL = enteredDocument->cookieURL(); | 2443 m_cookieURL = enteredDocument->cookieURL(); |
2444 } | 2444 } |
2445 | 2445 |
2446 open(); | 2446 open(); |
2447 } | 2447 } |
2448 | 2448 |
2449 void Document::open() | 2449 void Document::open() |
2450 { | 2450 { |
2451 ASSERT(!importLoader()); | 2451 ASSERT(!importLoader()); |
(...skipping 405 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2857 if (importLoader()) { | 2857 if (importLoader()) { |
2858 exceptionState.throwDOMException(InvalidStateError, "Imported document d
oesn't support write()."); | 2858 exceptionState.throwDOMException(InvalidStateError, "Imported document d
oesn't support write()."); |
2859 return; | 2859 return; |
2860 } | 2860 } |
2861 | 2861 |
2862 if (!isHTMLDocument()) { | 2862 if (!isHTMLDocument()) { |
2863 exceptionState.throwDOMException(InvalidStateError, "Only HTML documents
support write()."); | 2863 exceptionState.throwDOMException(InvalidStateError, "Only HTML documents
support write()."); |
2864 return; | 2864 return; |
2865 } | 2865 } |
2866 | 2866 |
2867 if (enteredDocument && !securityOrigin()->canAccess(enteredDocument->securit
yOrigin())) { | 2867 if (enteredDocument && !getSecurityOrigin()->canAccess(enteredDocument->getS
ecurityOrigin())) { |
2868 exceptionState.throwSecurityError("Can only call write() on same-origin
documents."); | 2868 exceptionState.throwSecurityError("Can only call write() on same-origin
documents."); |
2869 return; | 2869 return; |
2870 } | 2870 } |
2871 | 2871 |
2872 NestingLevelIncrementer nestingLevelIncrementer(m_writeRecursionDepth); | 2872 NestingLevelIncrementer nestingLevelIncrementer(m_writeRecursionDepth); |
2873 | 2873 |
2874 m_writeRecursionIsTooDeep = (m_writeRecursionDepth > 1) && m_writeRecursionI
sTooDeep; | 2874 m_writeRecursionIsTooDeep = (m_writeRecursionDepth > 1) && m_writeRecursionI
sTooDeep; |
2875 m_writeRecursionIsTooDeep = (m_writeRecursionDepth > cMaxWriteRecursionDepth
) || m_writeRecursionIsTooDeep; | 2875 m_writeRecursionIsTooDeep = (m_writeRecursionDepth > cMaxWriteRecursionDepth
) || m_writeRecursionIsTooDeep; |
2876 | 2876 |
2877 if (m_writeRecursionIsTooDeep) | 2877 if (m_writeRecursionIsTooDeep) |
(...skipping 293 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3171 if (!SecurityPolicy::referrerPolicyFromString(policy, &referrerPolicy)) { | 3171 if (!SecurityPolicy::referrerPolicyFromString(policy, &referrerPolicy)) { |
3172 addConsoleMessage(ConsoleMessage::create(RenderingMessageSource, ErrorMe
ssageLevel, "Failed to set referrer policy: The value '" + policy + "' is not on
e of 'always', 'default', 'never', 'no-referrer', 'no-referrer-when-downgrade',
'origin', 'origin-when-crossorigin', or 'unsafe-url'. This document's referrer p
olicy has been left unchanged.")); | 3172 addConsoleMessage(ConsoleMessage::create(RenderingMessageSource, ErrorMe
ssageLevel, "Failed to set referrer policy: The value '" + policy + "' is not on
e of 'always', 'default', 'never', 'no-referrer', 'no-referrer-when-downgrade',
'origin', 'origin-when-crossorigin', or 'unsafe-url'. This document's referrer p
olicy has been left unchanged.")); |
3173 return; | 3173 return; |
3174 } | 3174 } |
3175 | 3175 |
3176 setReferrerPolicy(referrerPolicy); | 3176 setReferrerPolicy(referrerPolicy); |
3177 } | 3177 } |
3178 | 3178 |
3179 String Document::outgoingReferrer() const | 3179 String Document::outgoingReferrer() const |
3180 { | 3180 { |
3181 if (securityOrigin()->isUnique()) { | 3181 if (getSecurityOrigin()->isUnique()) { |
3182 // Return |no-referrer|. | 3182 // Return |no-referrer|. |
3183 return String(); | 3183 return String(); |
3184 } | 3184 } |
3185 | 3185 |
3186 // See http://www.whatwg.org/specs/web-apps/current-work/#fetching-resources | 3186 // See http://www.whatwg.org/specs/web-apps/current-work/#fetching-resources |
3187 // for why we walk the parent chain for srcdoc documents. | 3187 // for why we walk the parent chain for srcdoc documents. |
3188 const Document* referrerDocument = this; | 3188 const Document* referrerDocument = this; |
3189 if (LocalFrame* frame = m_frame) { | 3189 if (LocalFrame* frame = m_frame) { |
3190 while (frame->document()->isSrcdocDocument()) { | 3190 while (frame->document()->isSrcdocDocument()) { |
3191 // Srcdoc documents must be local within the containing frame. | 3191 // Srcdoc documents must be local within the containing frame. |
(...skipping 154 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3346 return XMLDocument::create(init); | 3346 return XMLDocument::create(init); |
3347 } | 3347 } |
3348 return create(init); | 3348 return create(init); |
3349 } | 3349 } |
3350 | 3350 |
3351 void Document::cloneDataFromDocument(const Document& other) | 3351 void Document::cloneDataFromDocument(const Document& other) |
3352 { | 3352 { |
3353 setCompatibilityMode(other.getCompatibilityMode()); | 3353 setCompatibilityMode(other.getCompatibilityMode()); |
3354 setEncodingData(other.m_encodingData); | 3354 setEncodingData(other.m_encodingData); |
3355 setContextFeatures(other.contextFeatures()); | 3355 setContextFeatures(other.contextFeatures()); |
3356 setSecurityOrigin(other.securityOrigin()->isolatedCopy()); | 3356 setSecurityOrigin(other.getSecurityOrigin()->isolatedCopy()); |
3357 setMimeType(other.contentType()); | 3357 setMimeType(other.contentType()); |
3358 } | 3358 } |
3359 | 3359 |
3360 bool Document::isSecureContextImpl(String* errorMessage, const SecureContextChec
k privilegeContextCheck) const | 3360 bool Document::isSecureContextImpl(String* errorMessage, const SecureContextChec
k privilegeContextCheck) const |
3361 { | 3361 { |
3362 // There may be exceptions for the secure context check defined for certain | 3362 // There may be exceptions for the secure context check defined for certain |
3363 // schemes. The exceptions are applied only to the special scheme and to | 3363 // schemes. The exceptions are applied only to the special scheme and to |
3364 // sandboxed URLs from those origins, but *not* to any children. | 3364 // sandboxed URLs from those origins, but *not* to any children. |
3365 // | 3365 // |
3366 // For example: | 3366 // For example: |
(...skipping 20 matching lines...) Expand all Loading... |
3387 // | 3387 // |
3388 // In all cases, a frame must be potentially trustworthy in addition to | 3388 // In all cases, a frame must be potentially trustworthy in addition to |
3389 // having an exception listed in order for the exception to be granted. | 3389 // having an exception listed in order for the exception to be granted. |
3390 if (SecurityContext::isSandboxed(SandboxOrigin)) { | 3390 if (SecurityContext::isSandboxed(SandboxOrigin)) { |
3391 RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url()); | 3391 RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url()); |
3392 if (!isOriginPotentiallyTrustworthy(origin.get(), errorMessage)) | 3392 if (!isOriginPotentiallyTrustworthy(origin.get(), errorMessage)) |
3393 return false; | 3393 return false; |
3394 if (SchemeRegistry::schemeShouldBypassSecureContextCheck(origin->protoco
l())) | 3394 if (SchemeRegistry::schemeShouldBypassSecureContextCheck(origin->protoco
l())) |
3395 return true; | 3395 return true; |
3396 } else { | 3396 } else { |
3397 if (!isOriginPotentiallyTrustworthy(securityOrigin(), errorMessage)) | 3397 if (!isOriginPotentiallyTrustworthy(getSecurityOrigin(), errorMessage)) |
3398 return false; | 3398 return false; |
3399 if (SchemeRegistry::schemeShouldBypassSecureContextCheck(securityOrigin(
)->protocol())) | 3399 if (SchemeRegistry::schemeShouldBypassSecureContextCheck(getSecurityOrig
in()->protocol())) |
3400 return true; | 3400 return true; |
3401 } | 3401 } |
3402 | 3402 |
3403 if (privilegeContextCheck == StandardSecureContextCheck) { | 3403 if (privilegeContextCheck == StandardSecureContextCheck) { |
3404 Document* context = parentDocument(); | 3404 Document* context = parentDocument(); |
3405 while (context) { | 3405 while (context) { |
3406 // Skip to the next ancestor if it's a srcdoc. | 3406 // Skip to the next ancestor if it's a srcdoc. |
3407 if (!context->isSrcdocDocument()) { | 3407 if (!context->isSrcdocDocument()) { |
3408 if (context->securityContext().isSandboxed(SandboxOrigin)) { | 3408 if (context->securityContext().isSandboxed(SandboxOrigin)) { |
3409 // For a sandboxed origin, use the document's URL. | 3409 // For a sandboxed origin, use the document's URL. |
3410 RefPtr<SecurityOrigin> origin = SecurityOrigin::create(conte
xt->url()); | 3410 RefPtr<SecurityOrigin> origin = SecurityOrigin::create(conte
xt->url()); |
3411 if (!isOriginPotentiallyTrustworthy(origin.get(), errorMessa
ge)) | 3411 if (!isOriginPotentiallyTrustworthy(origin.get(), errorMessa
ge)) |
3412 return false; | 3412 return false; |
3413 } else { | 3413 } else { |
3414 if (!isOriginPotentiallyTrustworthy(context->securityOrigin(
), errorMessage)) | 3414 if (!isOriginPotentiallyTrustworthy(context->getSecurityOrig
in(), errorMessage)) |
3415 return false; | 3415 return false; |
3416 } | 3416 } |
3417 } | 3417 } |
3418 context = context->parentDocument(); | 3418 context = context->parentDocument(); |
3419 } | 3419 } |
3420 } | 3420 } |
3421 return true; | 3421 return true; |
3422 } | 3422 } |
3423 | 3423 |
3424 StyleSheetList* Document::styleSheets() | 3424 StyleSheetList* Document::styleSheets() |
(...skipping 520 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3945 } | 3945 } |
3946 | 3946 |
3947 EventListener* Document::getWindowAttributeEventListener(const AtomicString& eve
ntType) | 3947 EventListener* Document::getWindowAttributeEventListener(const AtomicString& eve
ntType) |
3948 { | 3948 { |
3949 LocalDOMWindow* domWindow = this->domWindow(); | 3949 LocalDOMWindow* domWindow = this->domWindow(); |
3950 if (!domWindow) | 3950 if (!domWindow) |
3951 return 0; | 3951 return 0; |
3952 return domWindow->getAttributeEventListener(eventType); | 3952 return domWindow->getAttributeEventListener(eventType); |
3953 } | 3953 } |
3954 | 3954 |
3955 EventQueue* Document::eventQueue() const | 3955 EventQueue* Document::getEventQueue() const |
3956 { | 3956 { |
3957 if (!m_domWindow) | 3957 if (!m_domWindow) |
3958 return 0; | 3958 return 0; |
3959 return m_domWindow->eventQueue(); | 3959 return m_domWindow->getEventQueue(); |
3960 } | 3960 } |
3961 | 3961 |
3962 void Document::enqueueAnimationFrameEvent(PassRefPtrWillBeRawPtr<Event> event) | 3962 void Document::enqueueAnimationFrameEvent(PassRefPtrWillBeRawPtr<Event> event) |
3963 { | 3963 { |
3964 ensureScriptedAnimationController().enqueueEvent(event); | 3964 ensureScriptedAnimationController().enqueueEvent(event); |
3965 } | 3965 } |
3966 | 3966 |
3967 void Document::enqueueUniqueAnimationFrameEvent(PassRefPtrWillBeRawPtr<Event> ev
ent) | 3967 void Document::enqueueUniqueAnimationFrameEvent(PassRefPtrWillBeRawPtr<Event> ev
ent) |
3968 { | 3968 { |
3969 ensureScriptedAnimationController().enqueuePerFrameEvent(event); | 3969 ensureScriptedAnimationController().enqueuePerFrameEvent(event); |
(...skipping 120 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
4090 | 4090 |
4091 String Document::cookie(ExceptionState& exceptionState) const | 4091 String Document::cookie(ExceptionState& exceptionState) const |
4092 { | 4092 { |
4093 if (settings() && !settings()->cookieEnabled()) | 4093 if (settings() && !settings()->cookieEnabled()) |
4094 return String(); | 4094 return String(); |
4095 | 4095 |
4096 // FIXME: The HTML5 DOM spec states that this attribute can raise an | 4096 // FIXME: The HTML5 DOM spec states that this attribute can raise an |
4097 // InvalidStateError exception on getting if the Document has no | 4097 // InvalidStateError exception on getting if the Document has no |
4098 // browsing context. | 4098 // browsing context. |
4099 | 4099 |
4100 if (!securityOrigin()->canAccessCookies()) { | 4100 if (!getSecurityOrigin()->canAccessCookies()) { |
4101 if (isSandboxed(SandboxOrigin)) | 4101 if (isSandboxed(SandboxOrigin)) |
4102 exceptionState.throwSecurityError("The document is sandboxed and lac
ks the 'allow-same-origin' flag."); | 4102 exceptionState.throwSecurityError("The document is sandboxed and lac
ks the 'allow-same-origin' flag."); |
4103 else if (url().protocolIs("data")) | 4103 else if (url().protocolIs("data")) |
4104 exceptionState.throwSecurityError("Cookies are disabled inside 'data
:' URLs."); | 4104 exceptionState.throwSecurityError("Cookies are disabled inside 'data
:' URLs."); |
4105 else | 4105 else |
4106 exceptionState.throwSecurityError("Access is denied for this documen
t."); | 4106 exceptionState.throwSecurityError("Access is denied for this documen
t."); |
4107 return String(); | 4107 return String(); |
4108 } | 4108 } |
4109 | 4109 |
4110 KURL cookieURL = this->cookieURL(); | 4110 KURL cookieURL = this->cookieURL(); |
4111 if (cookieURL.isEmpty()) | 4111 if (cookieURL.isEmpty()) |
4112 return String(); | 4112 return String(); |
4113 | 4113 |
4114 return cookies(this, cookieURL); | 4114 return cookies(this, cookieURL); |
4115 } | 4115 } |
4116 | 4116 |
4117 void Document::setCookie(const String& value, ExceptionState& exceptionState) | 4117 void Document::setCookie(const String& value, ExceptionState& exceptionState) |
4118 { | 4118 { |
4119 if (settings() && !settings()->cookieEnabled()) | 4119 if (settings() && !settings()->cookieEnabled()) |
4120 return; | 4120 return; |
4121 | 4121 |
4122 // FIXME: The HTML5 DOM spec states that this attribute can raise an | 4122 // FIXME: The HTML5 DOM spec states that this attribute can raise an |
4123 // InvalidStateError exception on setting if the Document has no | 4123 // InvalidStateError exception on setting if the Document has no |
4124 // browsing context. | 4124 // browsing context. |
4125 | 4125 |
4126 if (!securityOrigin()->canAccessCookies()) { | 4126 if (!getSecurityOrigin()->canAccessCookies()) { |
4127 if (isSandboxed(SandboxOrigin)) | 4127 if (isSandboxed(SandboxOrigin)) |
4128 exceptionState.throwSecurityError("The document is sandboxed and lac
ks the 'allow-same-origin' flag."); | 4128 exceptionState.throwSecurityError("The document is sandboxed and lac
ks the 'allow-same-origin' flag."); |
4129 else if (url().protocolIs("data")) | 4129 else if (url().protocolIs("data")) |
4130 exceptionState.throwSecurityError("Cookies are disabled inside 'data
:' URLs."); | 4130 exceptionState.throwSecurityError("Cookies are disabled inside 'data
:' URLs."); |
4131 else | 4131 else |
4132 exceptionState.throwSecurityError("Access is denied for this documen
t."); | 4132 exceptionState.throwSecurityError("Access is denied for this documen
t."); |
4133 return; | 4133 return; |
4134 } | 4134 } |
4135 | 4135 |
4136 KURL cookieURL = this->cookieURL(); | 4136 KURL cookieURL = this->cookieURL(); |
4137 if (cookieURL.isEmpty()) | 4137 if (cookieURL.isEmpty()) |
4138 return; | 4138 return; |
4139 | 4139 |
4140 setCookies(this, cookieURL, value); | 4140 setCookies(this, cookieURL, value); |
4141 } | 4141 } |
4142 | 4142 |
4143 const AtomicString& Document::referrer() const | 4143 const AtomicString& Document::referrer() const |
4144 { | 4144 { |
4145 if (loader()) | 4145 if (loader()) |
4146 return loader()->request().httpReferrer(); | 4146 return loader()->request().httpReferrer(); |
4147 return nullAtom; | 4147 return nullAtom; |
4148 } | 4148 } |
4149 | 4149 |
4150 String Document::domain() const | 4150 String Document::domain() const |
4151 { | 4151 { |
4152 return securityOrigin()->domain(); | 4152 return getSecurityOrigin()->domain(); |
4153 } | 4153 } |
4154 | 4154 |
4155 void Document::setDomain(const String& newDomain, ExceptionState& exceptionState
) | 4155 void Document::setDomain(const String& newDomain, ExceptionState& exceptionState
) |
4156 { | 4156 { |
4157 UseCounter::count(*this, UseCounter::DocumentSetDomain); | 4157 UseCounter::count(*this, UseCounter::DocumentSetDomain); |
4158 | 4158 |
4159 if (isSandboxed(SandboxDocumentDomain)) { | 4159 if (isSandboxed(SandboxDocumentDomain)) { |
4160 exceptionState.throwSecurityError("Assignment is forbidden for sandboxed
iframes."); | 4160 exceptionState.throwSecurityError("Assignment is forbidden for sandboxed
iframes."); |
4161 return; | 4161 return; |
4162 } | 4162 } |
4163 | 4163 |
4164 if (SchemeRegistry::isDomainRelaxationForbiddenForURLScheme(securityOrigin()
->protocol())) { | 4164 if (SchemeRegistry::isDomainRelaxationForbiddenForURLScheme(getSecurityOrigi
n()->protocol())) { |
4165 exceptionState.throwSecurityError("Assignment is forbidden for the '" +
securityOrigin()->protocol() + "' scheme."); | 4165 exceptionState.throwSecurityError("Assignment is forbidden for the '" +
getSecurityOrigin()->protocol() + "' scheme."); |
4166 return; | 4166 return; |
4167 } | 4167 } |
4168 | 4168 |
4169 if (newDomain.isEmpty()) { | 4169 if (newDomain.isEmpty()) { |
4170 exceptionState.throwSecurityError("'" + newDomain + "' is an empty domai
n."); | 4170 exceptionState.throwSecurityError("'" + newDomain + "' is an empty domai
n."); |
4171 return; | 4171 return; |
4172 } | 4172 } |
4173 | 4173 |
4174 OriginAccessEntry accessEntry(securityOrigin()->protocol(), newDomain, Origi
nAccessEntry::AllowSubdomains); | 4174 OriginAccessEntry accessEntry(getSecurityOrigin()->protocol(), newDomain, Or
iginAccessEntry::AllowSubdomains); |
4175 OriginAccessEntry::MatchResult result = accessEntry.matchesOrigin(*securityO
rigin()); | 4175 OriginAccessEntry::MatchResult result = accessEntry.matchesOrigin(*getSecuri
tyOrigin()); |
4176 if (result == OriginAccessEntry::DoesNotMatchOrigin) { | 4176 if (result == OriginAccessEntry::DoesNotMatchOrigin) { |
4177 exceptionState.throwSecurityError("'" + newDomain + "' is not a suffix o
f '" + domain() + "'."); | 4177 exceptionState.throwSecurityError("'" + newDomain + "' is not a suffix o
f '" + domain() + "'."); |
4178 return; | 4178 return; |
4179 } | 4179 } |
4180 | 4180 |
4181 if (result == OriginAccessEntry::MatchesOriginButIsPublicSuffix) { | 4181 if (result == OriginAccessEntry::MatchesOriginButIsPublicSuffix) { |
4182 exceptionState.throwSecurityError("'" + newDomain + "' is a top-level do
main."); | 4182 exceptionState.throwSecurityError("'" + newDomain + "' is a top-level do
main."); |
4183 return; | 4183 return; |
4184 } | 4184 } |
4185 | 4185 |
4186 securityOrigin()->setDomainFromDOM(newDomain); | 4186 getSecurityOrigin()->setDomainFromDOM(newDomain); |
4187 if (m_frame) | 4187 if (m_frame) |
4188 m_frame->script().updateSecurityOrigin(securityOrigin()); | 4188 m_frame->script().updateSecurityOrigin(getSecurityOrigin()); |
4189 } | 4189 } |
4190 | 4190 |
4191 // http://www.whatwg.org/specs/web-apps/current-work/#dom-document-lastmodified | 4191 // http://www.whatwg.org/specs/web-apps/current-work/#dom-document-lastmodified |
4192 String Document::lastModified() const | 4192 String Document::lastModified() const |
4193 { | 4193 { |
4194 DateComponents date; | 4194 DateComponents date; |
4195 bool foundDate = false; | 4195 bool foundDate = false; |
4196 if (m_frame) { | 4196 if (m_frame) { |
4197 if (DocumentLoader* documentLoader = loader()) { | 4197 if (DocumentLoader* documentLoader = loader()) { |
4198 const AtomicString& httpLastModified = documentLoader->response().ht
tpHeaderField(HTTPNames::Last_Modified); | 4198 const AtomicString& httpLastModified = documentLoader->response().ht
tpHeaderField(HTTPNames::Last_Modified); |
(...skipping 22 matching lines...) Expand all Loading... |
4221 const OriginAccessEntry& accessEntry = topDocument().accessEntryFromURL(); | 4221 const OriginAccessEntry& accessEntry = topDocument().accessEntryFromURL(); |
4222 const Document* currentDocument = this; | 4222 const Document* currentDocument = this; |
4223 while (currentDocument) { | 4223 while (currentDocument) { |
4224 // Skip over srcdoc documents, as they are always same-origin with their
closest non-srcdoc parent. | 4224 // Skip over srcdoc documents, as they are always same-origin with their
closest non-srcdoc parent. |
4225 while (currentDocument->isSrcdocDocument()) | 4225 while (currentDocument->isSrcdocDocument()) |
4226 currentDocument = currentDocument->parentDocument(); | 4226 currentDocument = currentDocument->parentDocument(); |
4227 ASSERT(currentDocument); | 4227 ASSERT(currentDocument); |
4228 | 4228 |
4229 // We use 'matchesDomain' here, as it turns out that some folks embed HT
TPS login forms | 4229 // We use 'matchesDomain' here, as it turns out that some folks embed HT
TPS login forms |
4230 // into HTTP pages; we should allow this kind of upgrade. | 4230 // into HTTP pages; we should allow this kind of upgrade. |
4231 if (accessEntry.matchesDomain(*currentDocument->securityOrigin()) == Ori
ginAccessEntry::DoesNotMatchOrigin) | 4231 if (accessEntry.matchesDomain(*currentDocument->getSecurityOrigin()) ==
OriginAccessEntry::DoesNotMatchOrigin) |
4232 return SecurityOrigin::urlWithUniqueSecurityOrigin(); | 4232 return SecurityOrigin::urlWithUniqueSecurityOrigin(); |
4233 | 4233 |
4234 currentDocument = currentDocument->parentDocument(); | 4234 currentDocument = currentDocument->parentDocument(); |
4235 } | 4235 } |
4236 | 4236 |
4237 return topDocument().url(); | 4237 return topDocument().url(); |
4238 } | 4238 } |
4239 | 4239 |
4240 static bool isValidNameNonASCII(const LChar* characters, unsigned length) | 4240 static bool isValidNameNonASCII(const LChar* characters, unsigned length) |
4241 { | 4241 { |
(...skipping 667 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
4909 m_frame->selection().updateSecureKeyboardEntryIfActive(); | 4909 m_frame->selection().updateSecureKeyboardEntryIfActive(); |
4910 } | 4910 } |
4911 | 4911 |
4912 bool Document::useSecureKeyboardEntryWhenActive() const | 4912 bool Document::useSecureKeyboardEntryWhenActive() const |
4913 { | 4913 { |
4914 return m_useSecureKeyboardEntryWhenActive; | 4914 return m_useSecureKeyboardEntryWhenActive; |
4915 } | 4915 } |
4916 | 4916 |
4917 void Document::initSecurityContext(const DocumentInit& initializer) | 4917 void Document::initSecurityContext(const DocumentInit& initializer) |
4918 { | 4918 { |
4919 ASSERT(!securityOrigin()); | 4919 ASSERT(!getSecurityOrigin()); |
4920 | 4920 |
4921 if (!initializer.hasSecurityContext()) { | 4921 if (!initializer.hasSecurityContext()) { |
4922 // No source for a security context. | 4922 // No source for a security context. |
4923 // This can occur via document.implementation.createDocument(). | 4923 // This can occur via document.implementation.createDocument(). |
4924 m_cookieURL = KURL(ParsedURLString, emptyString()); | 4924 m_cookieURL = KURL(ParsedURLString, emptyString()); |
4925 setSecurityOrigin(SecurityOrigin::createUnique()); | 4925 setSecurityOrigin(SecurityOrigin::createUnique()); |
4926 initContentSecurityPolicy(); | 4926 initContentSecurityPolicy(); |
4927 // Unique security origins cannot have a suborigin | 4927 // Unique security origins cannot have a suborigin |
4928 return; | 4928 return; |
4929 } | 4929 } |
4930 | 4930 |
4931 // In the common case, create the security context from the currently | 4931 // In the common case, create the security context from the currently |
4932 // loading URL with a fresh content security policy. | 4932 // loading URL with a fresh content security policy. |
4933 enforceSandboxFlags(initializer.getSandboxFlags()); | 4933 enforceSandboxFlags(initializer.getSandboxFlags()); |
4934 if (initializer.shouldEnforceStrictMixedContentChecking()) | 4934 if (initializer.shouldEnforceStrictMixedContentChecking()) |
4935 enforceStrictMixedContentChecking(); | 4935 enforceStrictMixedContentChecking(); |
4936 setInsecureRequestsPolicy(initializer.getInsecureRequestsPolicy()); | 4936 setInsecureRequestsPolicy(initializer.getInsecureRequestsPolicy()); |
4937 if (initializer.insecureNavigationsToUpgrade()) { | 4937 if (initializer.insecureNavigationsToUpgrade()) { |
4938 for (auto toUpgrade : *initializer.insecureNavigationsToUpgrade()) | 4938 for (auto toUpgrade : *initializer.insecureNavigationsToUpgrade()) |
4939 addInsecureNavigationUpgrade(toUpgrade); | 4939 addInsecureNavigationUpgrade(toUpgrade); |
4940 } | 4940 } |
4941 | 4941 |
4942 if (isSandboxed(SandboxOrigin)) { | 4942 if (isSandboxed(SandboxOrigin)) { |
4943 m_cookieURL = m_url; | 4943 m_cookieURL = m_url; |
4944 setSecurityOrigin(SecurityOrigin::createUnique()); | 4944 setSecurityOrigin(SecurityOrigin::createUnique()); |
4945 // If we're supposed to inherit our security origin from our owner, | 4945 // If we're supposed to inherit our security origin from our owner, |
4946 // but we're also sandboxed, the only thing we inherit is the ability | 4946 // but we're also sandboxed, the only thing we inherit is the ability |
4947 // to load local resources. This lets about:blank iframes in file:// | 4947 // to load local resources. This lets about:blank iframes in file:// |
4948 // URL documents load images and other resources from the file system. | 4948 // URL documents load images and other resources from the file system. |
4949 if (initializer.owner() && initializer.owner()->securityOrigin()->canLoa
dLocalResources()) | 4949 if (initializer.owner() && initializer.owner()->getSecurityOrigin()->can
LoadLocalResources()) |
4950 securityOrigin()->grantLoadLocalResources(); | 4950 getSecurityOrigin()->grantLoadLocalResources(); |
4951 } else if (initializer.owner()) { | 4951 } else if (initializer.owner()) { |
4952 m_cookieURL = initializer.owner()->cookieURL(); | 4952 m_cookieURL = initializer.owner()->cookieURL(); |
4953 // We alias the SecurityOrigins to match Firefox, see Bug 15313 | 4953 // We alias the SecurityOrigins to match Firefox, see Bug 15313 |
4954 // https://bugs.webkit.org/show_bug.cgi?id=15313 | 4954 // https://bugs.webkit.org/show_bug.cgi?id=15313 |
4955 setSecurityOrigin(initializer.owner()->securityOrigin()); | 4955 setSecurityOrigin(initializer.owner()->getSecurityOrigin()); |
4956 } else { | 4956 } else { |
4957 m_cookieURL = m_url; | 4957 m_cookieURL = m_url; |
4958 setSecurityOrigin(SecurityOrigin::create(m_url)); | 4958 setSecurityOrigin(SecurityOrigin::create(m_url)); |
4959 } | 4959 } |
4960 | 4960 |
4961 // Set the address space before setting up CSP, as the latter may override | 4961 // Set the address space before setting up CSP, as the latter may override |
4962 // the former via the 'treat-as-public-address' directive (see | 4962 // the former via the 'treat-as-public-address' directive (see |
4963 // https://mikewest.github.io/cors-rfc1918/#csp). | 4963 // https://mikewest.github.io/cors-rfc1918/#csp). |
4964 if (initializer.isHostedInReservedIPRange()) { | 4964 if (initializer.isHostedInReservedIPRange()) { |
4965 setAddressSpace(securityOrigin()->isLocalhost() ? WebAddressSpaceLocal :
WebAddressSpacePrivate); | 4965 setAddressSpace(getSecurityOrigin()->isLocalhost() ? WebAddressSpaceLoca
l : WebAddressSpacePrivate); |
4966 } else { | 4966 } else { |
4967 setAddressSpace(WebAddressSpacePublic); | 4967 setAddressSpace(WebAddressSpacePublic); |
4968 } | 4968 } |
4969 | 4969 |
4970 if (importsController()) { | 4970 if (importsController()) { |
4971 // If this document is an HTML import, grab a reference to it's master d
ocument's Content | 4971 // If this document is an HTML import, grab a reference to it's master d
ocument's Content |
4972 // Security Policy. We don't call 'initContentSecurityPolicy' in this ca
se, as we can't | 4972 // Security Policy. We don't call 'initContentSecurityPolicy' in this ca
se, as we can't |
4973 // rebind the master document's policy object: its ExecutionContext need
s to remain tied | 4973 // rebind the master document's policy object: its ExecutionContext need
s to remain tied |
4974 // to the master document. | 4974 // to the master document. |
4975 setContentSecurityPolicy(importsController()->master()->contentSecurityP
olicy()); | 4975 setContentSecurityPolicy(importsController()->master()->contentSecurityP
olicy()); |
4976 } else { | 4976 } else { |
4977 initContentSecurityPolicy(); | 4977 initContentSecurityPolicy(); |
4978 } | 4978 } |
4979 | 4979 |
4980 if (securityOrigin()->hasSuborigin()) | 4980 if (getSecurityOrigin()->hasSuborigin()) |
4981 enforceSuborigin(securityOrigin()->suboriginName()); | 4981 enforceSuborigin(getSecurityOrigin()->suboriginName()); |
4982 | 4982 |
4983 if (Settings* settings = initializer.settings()) { | 4983 if (Settings* settings = initializer.settings()) { |
4984 if (!settings->webSecurityEnabled()) { | 4984 if (!settings->webSecurityEnabled()) { |
4985 // Web security is turned off. We should let this document access ev
ery other document. This is used primary by testing | 4985 // Web security is turned off. We should let this document access ev
ery other document. This is used primary by testing |
4986 // harnesses for web sites. | 4986 // harnesses for web sites. |
4987 securityOrigin()->grantUniversalAccess(); | 4987 getSecurityOrigin()->grantUniversalAccess(); |
4988 } else if (securityOrigin()->isLocal()) { | 4988 } else if (getSecurityOrigin()->isLocal()) { |
4989 if (settings->allowUniversalAccessFromFileURLs()) { | 4989 if (settings->allowUniversalAccessFromFileURLs()) { |
4990 // Some clients want local URLs to have universal access, but th
at setting is dangerous for other clients. | 4990 // Some clients want local URLs to have universal access, but th
at setting is dangerous for other clients. |
4991 securityOrigin()->grantUniversalAccess(); | 4991 getSecurityOrigin()->grantUniversalAccess(); |
4992 } else if (!settings->allowFileAccessFromFileURLs()) { | 4992 } else if (!settings->allowFileAccessFromFileURLs()) { |
4993 // Some clients do not want local URLs to have access to other l
ocal URLs. | 4993 // Some clients do not want local URLs to have access to other l
ocal URLs. |
4994 securityOrigin()->blockLocalAccessFromLocalOrigin(); | 4994 getSecurityOrigin()->blockLocalAccessFromLocalOrigin(); |
4995 } | 4995 } |
4996 } | 4996 } |
4997 } | 4997 } |
4998 | 4998 |
4999 if (initializer.shouldTreatURLAsSrcdocDocument()) { | 4999 if (initializer.shouldTreatURLAsSrcdocDocument()) { |
5000 m_isSrcdocDocument = true; | 5000 m_isSrcdocDocument = true; |
5001 setBaseURLOverride(initializer.parentBaseURL()); | 5001 setBaseURLOverride(initializer.parentBaseURL()); |
5002 } | 5002 } |
5003 | 5003 |
5004 if (securityOrigin()->hasSuborigin()) | 5004 if (getSecurityOrigin()->hasSuborigin()) |
5005 enforceSuborigin(securityOrigin()->suboriginName()); | 5005 enforceSuborigin(getSecurityOrigin()->suboriginName()); |
5006 } | 5006 } |
5007 | 5007 |
5008 void Document::initContentSecurityPolicy(PassRefPtrWillBeRawPtr<ContentSecurityP
olicy> csp) | 5008 void Document::initContentSecurityPolicy(PassRefPtrWillBeRawPtr<ContentSecurityP
olicy> csp) |
5009 { | 5009 { |
5010 setContentSecurityPolicy(csp ? csp : ContentSecurityPolicy::create()); | 5010 setContentSecurityPolicy(csp ? csp : ContentSecurityPolicy::create()); |
5011 if (m_frame && m_frame->tree().parent() && m_frame->tree().parent()->isLocal
Frame()) { | 5011 if (m_frame && m_frame->tree().parent() && m_frame->tree().parent()->isLocal
Frame()) { |
5012 ContentSecurityPolicy* parentCSP = toLocalFrame(m_frame->tree().parent()
)->document()->contentSecurityPolicy(); | 5012 ContentSecurityPolicy* parentCSP = toLocalFrame(m_frame->tree().parent()
)->document()->contentSecurityPolicy(); |
5013 if (shouldInheritSecurityOriginFromOwner(m_url)) { | 5013 if (shouldInheritSecurityOriginFromOwner(m_url)) { |
5014 contentSecurityPolicy()->copyStateFrom(parentCSP); | 5014 contentSecurityPolicy()->copyStateFrom(parentCSP); |
5015 } else if (isPluginDocument()) { | 5015 } else if (isPluginDocument()) { |
5016 // Per CSP2, plugin-types for plugin documents in nested browsing | 5016 // Per CSP2, plugin-types for plugin documents in nested browsing |
5017 // contexts gets inherited from the parent. | 5017 // contexts gets inherited from the parent. |
5018 contentSecurityPolicy()->copyPluginTypesFrom(parentCSP); | 5018 contentSecurityPolicy()->copyPluginTypesFrom(parentCSP); |
5019 } | 5019 } |
5020 } | 5020 } |
5021 contentSecurityPolicy()->bindToExecutionContext(this); | 5021 contentSecurityPolicy()->bindToExecutionContext(this); |
5022 } | 5022 } |
5023 | 5023 |
5024 bool Document::isSecureTransitionTo(const KURL& url) const | 5024 bool Document::isSecureTransitionTo(const KURL& url) const |
5025 { | 5025 { |
5026 RefPtr<SecurityOrigin> other = SecurityOrigin::create(url); | 5026 RefPtr<SecurityOrigin> other = SecurityOrigin::create(url); |
5027 return securityOrigin()->canAccess(other.get()); | 5027 return getSecurityOrigin()->canAccess(other.get()); |
5028 } | 5028 } |
5029 | 5029 |
5030 bool Document::allowInlineEventHandlers(Node* node, EventListener* listener, con
st String& contextURL, const WTF::OrdinalNumber& contextLine) | 5030 bool Document::allowInlineEventHandlers(Node* node, EventListener* listener, con
st String& contextURL, const WTF::OrdinalNumber& contextLine) |
5031 { | 5031 { |
5032 bool allowedByHash = contentSecurityPolicy()->experimentalFeaturesEnabled()
&& contentSecurityPolicy()->allowScriptWithHash(listener->code()); | 5032 bool allowedByHash = contentSecurityPolicy()->experimentalFeaturesEnabled()
&& contentSecurityPolicy()->allowScriptWithHash(listener->code()); |
5033 if (!ContentSecurityPolicy::shouldBypassMainWorld(this) && !allowedByHash &&
!contentSecurityPolicy()->allowInlineEventHandlers(contextURL, contextLine)) | 5033 if (!ContentSecurityPolicy::shouldBypassMainWorld(this) && !allowedByHash &&
!contentSecurityPolicy()->allowInlineEventHandlers(contextURL, contextLine)) |
5034 return false; | 5034 return false; |
5035 | 5035 |
5036 // HTML says that inline script needs browsing context to create its executi
on environment. | 5036 // HTML says that inline script needs browsing context to create its executi
on environment. |
5037 // http://www.whatwg.org/specs/web-apps/current-work/multipage/webappapis.ht
ml#event-handler-attributes | 5037 // http://www.whatwg.org/specs/web-apps/current-work/multipage/webappapis.ht
ml#event-handler-attributes |
(...skipping 28 matching lines...) Expand all Loading... |
5066 void Document::updateSecurityOrigin(PassRefPtr<SecurityOrigin> origin) | 5066 void Document::updateSecurityOrigin(PassRefPtr<SecurityOrigin> origin) |
5067 { | 5067 { |
5068 setSecurityOrigin(origin); | 5068 setSecurityOrigin(origin); |
5069 didUpdateSecurityOrigin(); | 5069 didUpdateSecurityOrigin(); |
5070 } | 5070 } |
5071 | 5071 |
5072 void Document::didUpdateSecurityOrigin() | 5072 void Document::didUpdateSecurityOrigin() |
5073 { | 5073 { |
5074 if (!m_frame) | 5074 if (!m_frame) |
5075 return; | 5075 return; |
5076 m_frame->updateSecurityOrigin(securityOrigin()); | 5076 m_frame->updateSecurityOrigin(getSecurityOrigin()); |
5077 } | 5077 } |
5078 | 5078 |
5079 bool Document::isContextThread() const | 5079 bool Document::isContextThread() const |
5080 { | 5080 { |
5081 return isMainThread(); | 5081 return isMainThread(); |
5082 } | 5082 } |
5083 | 5083 |
5084 void Document::updateFocusAppearanceSoon(SelectionBehaviorOnFocus selectionbehav
ioronfocus) | 5084 void Document::updateFocusAppearanceSoon(SelectionBehaviorOnFocus selectionbehav
ioronfocus) |
5085 { | 5085 { |
5086 m_updateFocusAppearanceSelectionBahavior = selectionbehavioronfocus; | 5086 m_updateFocusAppearanceSelectionBahavior = selectionbehavioronfocus; |
(...skipping 27 matching lines...) Expand all Loading... |
5114 // We don't ASSERT m_ranges.contains(range) to allow us to call this | 5114 // We don't ASSERT m_ranges.contains(range) to allow us to call this |
5115 // unconditionally to fix: https://bugs.webkit.org/show_bug.cgi?id=26044 | 5115 // unconditionally to fix: https://bugs.webkit.org/show_bug.cgi?id=26044 |
5116 m_ranges.remove(range); | 5116 m_ranges.remove(range); |
5117 } | 5117 } |
5118 | 5118 |
5119 void Document::initDNSPrefetch() | 5119 void Document::initDNSPrefetch() |
5120 { | 5120 { |
5121 Settings* settings = this->settings(); | 5121 Settings* settings = this->settings(); |
5122 | 5122 |
5123 m_haveExplicitlyDisabledDNSPrefetch = false; | 5123 m_haveExplicitlyDisabledDNSPrefetch = false; |
5124 m_isDNSPrefetchEnabled = settings && settings->dnsPrefetchingEnabled() && se
curityOrigin()->protocol() == "http"; | 5124 m_isDNSPrefetchEnabled = settings && settings->dnsPrefetchingEnabled() && ge
tSecurityOrigin()->protocol() == "http"; |
5125 | 5125 |
5126 // Inherit DNS prefetch opt-out from parent frame | 5126 // Inherit DNS prefetch opt-out from parent frame |
5127 if (Document* parent = parentDocument()) { | 5127 if (Document* parent = parentDocument()) { |
5128 if (!parent->isDNSPrefetchEnabled()) | 5128 if (!parent->isDNSPrefetchEnabled()) |
5129 m_isDNSPrefetchEnabled = false; | 5129 m_isDNSPrefetchEnabled = false; |
5130 } | 5130 } |
5131 } | 5131 } |
5132 | 5132 |
5133 void Document::parseDNSPrefetchControlHeader(const String& dnsPrefetchControl) | 5133 void Document::parseDNSPrefetchControlHeader(const String& dnsPrefetchControl) |
5134 { | 5134 { |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
5177 void Document::addConsoleMessage(PassRefPtrWillBeRawPtr<ConsoleMessage> consoleM
essage) | 5177 void Document::addConsoleMessage(PassRefPtrWillBeRawPtr<ConsoleMessage> consoleM
essage) |
5178 { | 5178 { |
5179 if (!isContextThread()) { | 5179 if (!isContextThread()) { |
5180 m_taskRunner->postTask(BLINK_FROM_HERE, AddConsoleMessageTask::create(co
nsoleMessage->source(), consoleMessage->level(), consoleMessage->message())); | 5180 m_taskRunner->postTask(BLINK_FROM_HERE, AddConsoleMessageTask::create(co
nsoleMessage->source(), consoleMessage->level(), consoleMessage->message())); |
5181 return; | 5181 return; |
5182 } | 5182 } |
5183 | 5183 |
5184 if (!m_frame) | 5184 if (!m_frame) |
5185 return; | 5185 return; |
5186 | 5186 |
5187 if (!consoleMessage->scriptState() && consoleMessage->url().isNull() && !con
soleMessage->lineNumber()) { | 5187 if (!consoleMessage->getScriptState() && consoleMessage->url().isNull() && !
consoleMessage->lineNumber()) { |
5188 consoleMessage->setURL(url().getString()); | 5188 consoleMessage->setURL(url().getString()); |
5189 if (!isInDocumentWrite() && scriptableDocumentParser()) { | 5189 if (!isInDocumentWrite() && scriptableDocumentParser()) { |
5190 ScriptableDocumentParser* parser = scriptableDocumentParser(); | 5190 ScriptableDocumentParser* parser = scriptableDocumentParser(); |
5191 if (parser->isParsingAtLineNumber()) | 5191 if (parser->isParsingAtLineNumber()) |
5192 consoleMessage->setLineNumber(parser->lineNumber().oneBasedInt()
); | 5192 consoleMessage->setLineNumber(parser->lineNumber().oneBasedInt()
); |
5193 } | 5193 } |
5194 } | 5194 } |
5195 m_frame->console().addMessage(consoleMessage); | 5195 m_frame->console().addMessage(consoleMessage); |
5196 } | 5196 } |
5197 | 5197 |
(...skipping 798 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
5996 #ifndef NDEBUG | 5996 #ifndef NDEBUG |
5997 using namespace blink; | 5997 using namespace blink; |
5998 void showLiveDocumentInstances() | 5998 void showLiveDocumentInstances() |
5999 { | 5999 { |
6000 Document::WeakDocumentSet& set = Document::liveDocumentSet(); | 6000 Document::WeakDocumentSet& set = Document::liveDocumentSet(); |
6001 fprintf(stderr, "There are %u documents currently alive:\n", set.size()); | 6001 fprintf(stderr, "There are %u documents currently alive:\n", set.size()); |
6002 for (Document* document : set) | 6002 for (Document* document : set) |
6003 fprintf(stderr, "- Document %p URL: %s\n", document, document->url().get
String().utf8().data()); | 6003 fprintf(stderr, "- Document %p URL: %s\n", document, document->url().get
String().utf8().data()); |
6004 } | 6004 } |
6005 #endif | 6005 #endif |
OLD | NEW |