OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "core/frame/DOMWindow.h" | 5 #include "core/frame/DOMWindow.h" |
6 | 6 |
7 #include "bindings/core/v8/ScriptCallStack.h" | 7 #include "bindings/core/v8/ScriptCallStack.h" |
8 #include "core/dom/Document.h" | 8 #include "core/dom/Document.h" |
9 #include "core/dom/ExceptionCode.h" | 9 #include "core/dom/ExceptionCode.h" |
10 #include "core/dom/ExecutionContext.h" | 10 #include "core/dom/ExecutionContext.h" |
(...skipping 123 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
134 | 134 |
135 // If this DOMWindow isn't currently active in the Frame, then there's no | 135 // If this DOMWindow isn't currently active in the Frame, then there's no |
136 // way we should allow the access. | 136 // way we should allow the access. |
137 if (isCurrentlyDisplayedInFrame()) { | 137 if (isCurrentlyDisplayedInFrame()) { |
138 // FIXME: Is there some way to eliminate the need for a separate "callin
gWindow == this" check? | 138 // FIXME: Is there some way to eliminate the need for a separate "callin
gWindow == this" check? |
139 if (&callingWindow == this) | 139 if (&callingWindow == this) |
140 return false; | 140 return false; |
141 | 141 |
142 // FIXME: The name canAccess seems to be a roundabout way to ask "can ex
ecute script". | 142 // FIXME: The name canAccess seems to be a roundabout way to ask "can ex
ecute script". |
143 // Can we name the SecurityOrigin function better to make this more clea
r? | 143 // Can we name the SecurityOrigin function better to make this more clea
r? |
144 if (callingWindow.document()->securityOrigin()->canAccessCheckSuborigins
(frame()->securityContext()->securityOrigin())) | 144 if (callingWindow.document()->getSecurityOrigin()->canAccessCheckSuborig
ins(frame()->securityContext()->getSecurityOrigin())) |
145 return false; | 145 return false; |
146 } | 146 } |
147 | 147 |
148 callingWindow.printErrorMessage(crossDomainAccessErrorMessage(&callingWindow
)); | 148 callingWindow.printErrorMessage(crossDomainAccessErrorMessage(&callingWindow
)); |
149 return true; | 149 return true; |
150 } | 150 } |
151 | 151 |
152 void DOMWindow::resetLocation() | 152 void DOMWindow::resetLocation() |
153 { | 153 { |
154 // Location needs to be reset manually because it doesn't inherit from DOMWi
ndowProperty. | 154 // Location needs to be reset manually because it doesn't inherit from DOMWi
ndowProperty. |
(...skipping 18 matching lines...) Expand all Loading... |
173 return; | 173 return; |
174 | 174 |
175 Document* sourceDocument = source->document(); | 175 Document* sourceDocument = source->document(); |
176 | 176 |
177 // Compute the target origin. We need to do this synchronously in order | 177 // Compute the target origin. We need to do this synchronously in order |
178 // to generate the SyntaxError exception correctly. | 178 // to generate the SyntaxError exception correctly. |
179 RefPtr<SecurityOrigin> target; | 179 RefPtr<SecurityOrigin> target; |
180 if (targetOrigin == "/") { | 180 if (targetOrigin == "/") { |
181 if (!sourceDocument) | 181 if (!sourceDocument) |
182 return; | 182 return; |
183 target = sourceDocument->securityOrigin(); | 183 target = sourceDocument->getSecurityOrigin(); |
184 } else if (targetOrigin != "*") { | 184 } else if (targetOrigin != "*") { |
185 target = SecurityOrigin::createFromString(targetOrigin); | 185 target = SecurityOrigin::createFromString(targetOrigin); |
186 // It doesn't make sense target a postMessage at a unique origin | 186 // It doesn't make sense target a postMessage at a unique origin |
187 // because there's no way to represent a unique origin in a string. | 187 // because there's no way to represent a unique origin in a string. |
188 if (target->isUnique()) { | 188 if (target->isUnique()) { |
189 exceptionState.throwDOMException(SyntaxError, "Invalid target origin
'" + targetOrigin + "' in a call to 'postMessage'."); | 189 exceptionState.throwDOMException(SyntaxError, "Invalid target origin
'" + targetOrigin + "' in a call to 'postMessage'."); |
190 return; | 190 return; |
191 } | 191 } |
192 } | 192 } |
193 | 193 |
194 OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(exe
cutionContext(), ports, exceptionState); | 194 OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(get
ExecutionContext(), ports, exceptionState); |
195 if (exceptionState.hadException()) | 195 if (exceptionState.hadException()) |
196 return; | 196 return; |
197 | 197 |
198 // Capture the source of the message. We need to do this synchronously | 198 // Capture the source of the message. We need to do this synchronously |
199 // in order to capture the source of the message correctly. | 199 // in order to capture the source of the message correctly. |
200 if (!sourceDocument) | 200 if (!sourceDocument) |
201 return; | 201 return; |
202 String sourceOrigin = sourceDocument->securityOrigin()->toString(); | 202 String sourceOrigin = sourceDocument->getSecurityOrigin()->toString(); |
203 String sourceSuborigin = sourceDocument->securityOrigin()->suboriginName(); | 203 String sourceSuborigin = sourceDocument->getSecurityOrigin()->suboriginName(
); |
204 | 204 |
205 KURL targetUrl = isLocalDOMWindow() ? document()->url() : KURL(KURL(), frame
()->securityContext()->securityOrigin()->toString()); | 205 KURL targetUrl = isLocalDOMWindow() ? document()->url() : KURL(KURL(), frame
()->securityContext()->getSecurityOrigin()->toString()); |
206 if (MixedContentChecker::isMixedContent(sourceDocument->securityOrigin(), ta
rgetUrl)) | 206 if (MixedContentChecker::isMixedContent(sourceDocument->getSecurityOrigin(),
targetUrl)) |
207 UseCounter::count(frame(), UseCounter::PostMessageFromSecureToInsecure); | 207 UseCounter::count(frame(), UseCounter::PostMessageFromSecureToInsecure); |
208 else if (MixedContentChecker::isMixedContent(frame()->securityContext()->sec
urityOrigin(), sourceDocument->url())) | 208 else if (MixedContentChecker::isMixedContent(frame()->securityContext()->get
SecurityOrigin(), sourceDocument->url())) |
209 UseCounter::count(frame(), UseCounter::PostMessageFromInsecureToSecure); | 209 UseCounter::count(frame(), UseCounter::PostMessageFromInsecureToSecure); |
210 | 210 |
211 RefPtrWillBeRawPtr<MessageEvent> event = MessageEvent::create(channels.relea
se(), message, sourceOrigin, String(), source, sourceSuborigin); | 211 RefPtrWillBeRawPtr<MessageEvent> event = MessageEvent::create(channels.relea
se(), message, sourceOrigin, String(), source, sourceSuborigin); |
212 // Give the embedder a chance to intercept this postMessage. If the | 212 // Give the embedder a chance to intercept this postMessage. If the |
213 // target is a remote frame, the message will be forwarded through the | 213 // target is a remote frame, the message will be forwarded through the |
214 // browser process. | 214 // browser process. |
215 if (frame()->client()->willCheckAndDispatchMessageEvent(target.get(), event.
get(), source->document()->frame())) | 215 if (frame()->client()->willCheckAndDispatchMessageEvent(target.get(), event.
get(), source->document()->frame())) |
216 return; | 216 return; |
217 | 217 |
218 // Capture stack trace only when inspector front-end is loaded as it may be
time consuming. | 218 // Capture stack trace only when inspector front-end is loaded as it may be
time consuming. |
(...skipping 11 matching lines...) Expand all Loading... |
230 // http://crbug.com/17325 | 230 // http://crbug.com/17325 |
231 String DOMWindow::sanitizedCrossDomainAccessErrorMessage(const LocalDOMWindow* c
allingWindow) const | 231 String DOMWindow::sanitizedCrossDomainAccessErrorMessage(const LocalDOMWindow* c
allingWindow) const |
232 { | 232 { |
233 if (!callingWindow || !callingWindow->document() || !frame()) | 233 if (!callingWindow || !callingWindow->document() || !frame()) |
234 return String(); | 234 return String(); |
235 | 235 |
236 const KURL& callingWindowURL = callingWindow->document()->url(); | 236 const KURL& callingWindowURL = callingWindow->document()->url(); |
237 if (callingWindowURL.isNull()) | 237 if (callingWindowURL.isNull()) |
238 return String(); | 238 return String(); |
239 | 239 |
240 ASSERT(!callingWindow->document()->securityOrigin()->canAccessCheckSuborigin
s(frame()->securityContext()->securityOrigin())); | 240 ASSERT(!callingWindow->document()->getSecurityOrigin()->canAccessCheckSubori
gins(frame()->securityContext()->getSecurityOrigin())); |
241 | 241 |
242 const SecurityOrigin* activeOrigin = callingWindow->document()->securityOrig
in(); | 242 const SecurityOrigin* activeOrigin = callingWindow->document()->getSecurityO
rigin(); |
243 String message = "Blocked a frame with origin \"" + activeOrigin->toString()
+ "\" from accessing a cross-origin frame."; | 243 String message = "Blocked a frame with origin \"" + activeOrigin->toString()
+ "\" from accessing a cross-origin frame."; |
244 | 244 |
245 // FIXME: Evaluate which details from 'crossDomainAccessErrorMessage' may sa
fely be reported to JavaScript. | 245 // FIXME: Evaluate which details from 'crossDomainAccessErrorMessage' may sa
fely be reported to JavaScript. |
246 | 246 |
247 return message; | 247 return message; |
248 } | 248 } |
249 | 249 |
250 String DOMWindow::crossDomainAccessErrorMessage(const LocalDOMWindow* callingWin
dow) const | 250 String DOMWindow::crossDomainAccessErrorMessage(const LocalDOMWindow* callingWin
dow) const |
251 { | 251 { |
252 if (!callingWindow || !callingWindow->document() || !frame()) | 252 if (!callingWindow || !callingWindow->document() || !frame()) |
253 return String(); | 253 return String(); |
254 | 254 |
255 const KURL& callingWindowURL = callingWindow->document()->url(); | 255 const KURL& callingWindowURL = callingWindow->document()->url(); |
256 if (callingWindowURL.isNull()) | 256 if (callingWindowURL.isNull()) |
257 return String(); | 257 return String(); |
258 | 258 |
259 // FIXME: This message, and other console messages, have extra newlines. Sho
uld remove them. | 259 // FIXME: This message, and other console messages, have extra newlines. Sho
uld remove them. |
260 const SecurityOrigin* activeOrigin = callingWindow->document()->securityOrig
in(); | 260 const SecurityOrigin* activeOrigin = callingWindow->document()->getSecurityO
rigin(); |
261 const SecurityOrigin* targetOrigin = frame()->securityContext()->securityOri
gin(); | 261 const SecurityOrigin* targetOrigin = frame()->securityContext()->getSecurity
Origin(); |
262 ASSERT(!activeOrigin->canAccessCheckSuborigins(targetOrigin)); | 262 ASSERT(!activeOrigin->canAccessCheckSuborigins(targetOrigin)); |
263 | 263 |
264 String message = "Blocked a frame with origin \"" + activeOrigin->toString()
+ "\" from accessing a frame with origin \"" + targetOrigin->toString() + "\".
"; | 264 String message = "Blocked a frame with origin \"" + activeOrigin->toString()
+ "\" from accessing a frame with origin \"" + targetOrigin->toString() + "\".
"; |
265 | 265 |
266 // Sandbox errors: Use the origin of the frames' location, rather than their
actual origin (since we know that at least one will be "null"). | 266 // Sandbox errors: Use the origin of the frames' location, rather than their
actual origin (since we know that at least one will be "null"). |
267 KURL activeURL = callingWindow->document()->url(); | 267 KURL activeURL = callingWindow->document()->url(); |
268 // TODO(alexmos): RemoteFrames do not have a document, and their URLs | 268 // TODO(alexmos): RemoteFrames do not have a document, and their URLs |
269 // aren't replicated. For now, construct the URL using the replicated | 269 // aren't replicated. For now, construct the URL using the replicated |
270 // origin for RemoteFrames. If the target frame is remote and sandboxed, | 270 // origin for RemoteFrames. If the target frame is remote and sandboxed, |
271 // there isn't anything else to show other than "null" for its origin. | 271 // there isn't anything else to show other than "null" for its origin. |
(...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
365 page->focusController().focusDocumentView(frame(), true /* notifyEmbedder */
); | 365 page->focusController().focusDocumentView(frame(), true /* notifyEmbedder */
); |
366 } | 366 } |
367 | 367 |
368 DEFINE_TRACE(DOMWindow) | 368 DEFINE_TRACE(DOMWindow) |
369 { | 369 { |
370 visitor->trace(m_location); | 370 visitor->trace(m_location); |
371 EventTargetWithInlineData::trace(visitor); | 371 EventTargetWithInlineData::trace(visitor); |
372 } | 372 } |
373 | 373 |
374 } // namespace blink | 374 } // namespace blink |
OLD | NEW |