CREDENTIAL: Block API access from non-top-level Documents.

third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/credentialmanager/CredentialsContainer.h"
 
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "core/dom/DOMException.h"
+#include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
+#include "core/frame/Frame.h"
 #include "core/frame/UseCounter.h"
+#include "core/page/FrameTree.h"
 #include "modules/credentialmanager/Credential.h"
 #include "modules/credentialmanager/CredentialManagerClient.h"
 #include "modules/credentialmanager/CredentialRequestOptions.h"
 #include "modules/credentialmanager/FederatedCredential.h"
 #include "modules/credentialmanager/FederatedCredentialRequestOptions.h"
 #include "modules/credentialmanager/PasswordCredential.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCredential.h"
 #include "public/platform/WebCredentialManagerClient.h"
@@ skipping 20 matching lines @@
 }
 
 class NotificationCallbacks : public WebCredentialManagerClient::NotificationCallbacks {
     WTF_MAKE_NONCOPYABLE(NotificationCallbacks);
 public:
     explicit NotificationCallbacks(ScriptPromiseResolver* resolver) : m_resolver(resolver) { }
     ~NotificationCallbacks() override { }
 
     void onSuccess() override
     {
+        Frame* frame = toDocument(m_resolver->getScriptState()->getExecutionContext())->frame();
+        SECURITY_CHECK(frame == frame->tree().top());
+
         m_resolver->resolve();
     }
 
     void onError(WebCredentialManagerError reason) override
     {
         rejectDueToCredentialManagerError(m_resolver, reason);
     }
 
 private:
     const Persistent<ScriptPromiseResolver> m_resolver;
 };
 
 class RequestCallbacks : public WebCredentialManagerClient::RequestCallbacks {
     WTF_MAKE_NONCOPYABLE(RequestCallbacks);
 public:
     explicit RequestCallbacks(ScriptPromiseResolver* resolver) : m_resolver(resolver) { }
     ~RequestCallbacks() override { }
 
     void onSuccess(WebPassOwnPtr<WebCredential> webCredential) override
     {
+        Frame* frame = toDocument(m_resolver->getScriptState()->getExecutionContext())->frame();
+        SECURITY_CHECK(frame == frame->tree().top());
+
         OwnPtr<WebCredential> credential = webCredential.release();
         if (!credential) {
             m_resolver->resolve();
             return;
         }
 
         ASSERT(credential->isPasswordCredential() || credential->isFederatedCredential());
         if (credential->isPasswordCredential())
             m_resolver->resolve(PasswordCredential::create(static_cast<WebPasswordCredential*>(credential.get())));
         else
@@ skipping 14 matching lines @@
 {
     return new CredentialsContainer();
 }
 
 CredentialsContainer::CredentialsContainer()
 {
 }
 
 static bool checkBoilerplate(ScriptPromiseResolver* resolver)
 {
-    CredentialManagerClient* client = CredentialManagerClient::from(resolver->getScriptState()->getExecutionContext());
-    if (!client) {
-        resolver->reject(DOMException::create(InvalidStateError, "Could not establish connection to the credential manager."));
+    Frame* frame = toDocument(resolver->getScriptState()->getExecutionContext())->frame();
+    if (!frame || frame != frame->tree().top()) {
+        resolver->reject(DOMException::create(SecurityError, "CredentialContainer methods may only be executed in a top-level document."));
         return false;
     }
 
     String errorMessage;
     if (!resolver->getScriptState()->getExecutionContext()->isSecureContext(errorMessage)) {
         resolver->reject(DOMException::create(SecurityError, errorMessage));
         return false;
     }
 
+    CredentialManagerClient* client = CredentialManagerClient::from(resolver->getScriptState()->getExecutionContext());
+    if (!client) {
+        resolver->reject(DOMException::create(InvalidStateError, "Could not establish connection to the credential manager."));
+        return false;
+    }
+
     return true;
 }
 
 ScriptPromise CredentialsContainer::get(ScriptState* scriptState, const CredentialRequestOptions& options)
 {
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();
     if (!checkBoilerplate(resolver))
         return promise;
 
@@ skipping 34 matching lines @@
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();
     if (!checkBoilerplate(resolver))
         return promise;
 
     CredentialManagerClient::from(scriptState->getExecutionContext())->dispatchRequireUserMediation(new NotificationCallbacks(resolver));
     return promise;
 }
 
 } // namespace blink