Count cross-origin property access.

third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 20 matching lines @@
 #include "bindings/core/v8/BindingSecurity.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "bindings/core/v8/V8Location.h"
 #include "core/dom/Document.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Location.h"
 #include "core/frame/Settings.h"
+#include "core/frame/UseCounter.h"
 #include "core/html/HTMLFrameElementBase.h"
 #include "core/workers/MainThreadWorkletGlobalScope.h"
 #include "platform/bindings/WrapperCreationSecurityCheck.h"
 #include "platform/weborigin/SecurityOrigin.h"
 
 namespace blink {
 
 namespace {
 
 bool CanAccessFrameInternal(const LocalDOMWindow* accessing_window,
@@ skipping 56 matching lines @@
 }  // namespace
 
 bool BindingSecurity::ShouldAllowAccessTo(
     const LocalDOMWindow* accessing_window,
     const DOMWindow* target,
     ExceptionState& exception_state) {
   DCHECK(target);
   const Frame* frame = target->GetFrame();
   if (!frame || !frame->GetSecurityContext())
     return false;
-  return CanAccessFrame(accessing_window,
-                        frame->GetSecurityContext()->GetSecurityOrigin(),
-                        target, exception_state);
+  bool can_access = CanAccessFrame(
+      accessing_window, frame->GetSecurityContext()->GetSecurityOrigin(),
+      target, exception_state);
+
+  if (!can_access) {
+    UseCounter::Count(accessing_window->GetFrame(),
+                      UseCounter::kCrossOriginPropertyAccess);
+    if (target->opener() == accessing_window) {
+      UseCounter::Count(accessing_window->GetFrame(),
+                        UseCounter::kCrossOriginPropertyAccessFromOpener);
+    }
+  }

[Mike West, 2017/05/16 14:54:31]

Does this do what I think it does?

[jochen (gone - plz use gerrit), 2017/05/17 07:36:06]

not sure, but kCrossOriginPropertyAccessFromOpener might undercount, if target
nulled out its opener

+
+  return can_access;
 }
 
 bool BindingSecurity::ShouldAllowAccessTo(
     const LocalDOMWindow* accessing_window,
     const DOMWindow* target,
     ErrorReportOption reporting_option) {
   DCHECK(target);
   const Frame* frame = target->GetFrame();
   if (!frame || !frame->GetSecurityContext())
     return false;
-  return CanAccessFrame(accessing_window,
-                        frame->GetSecurityContext()->GetSecurityOrigin(),
-                        target, reporting_option);
+  bool can_access = CanAccessFrame(
+      accessing_window, frame->GetSecurityContext()->GetSecurityOrigin(),
+      target, reporting_option);
+
+  if (!can_access) {

[Yuki, 2017/05/17 05:31:11]

If we're going to put this into CanAccessFrame, then it's fine.
Otherwise, can we define a helper function?  IIUC, I see the same code many
times.

+    UseCounter::Count(accessing_window->GetFrame(),
+                      UseCounter::kCrossOriginPropertyAccess);
+    if (target->opener() == accessing_window) {
+      UseCounter::Count(accessing_window->GetFrame(),
+                        UseCounter::kCrossOriginPropertyAccessFromOpener);
+    }
+  }
+
+  return can_access;
 }
 
 bool BindingSecurity::ShouldAllowAccessTo(
-    const LocalDOMWindow* accessing_window,
-    const EventTarget* target,
-    ExceptionState& exception_state) {
-  DCHECK(target);
-  const DOMWindow* window = target->ToDOMWindow();
-  if (!window) {
-    // We only need to check the access to Window objects which are
-    // cross-origin accessible.  If it's not a Window, the object's
-    // origin must always be the same origin (or it already leaked).
-    return true;
-  }
-  const Frame* frame = window->GetFrame();
-  if (!frame || !frame->GetSecurityContext())
-    return false;
-  return CanAccessFrame(accessing_window,
-                        frame->GetSecurityContext()->GetSecurityOrigin(),
-                        window, exception_state);
-}
-
-bool BindingSecurity::ShouldAllowAccessTo(
     const LocalDOMWindow* accessing_window,
     const Location* target,
     ExceptionState& exception_state) {
   DCHECK(target);
   const Frame* frame = target->GetFrame();
   if (!frame || !frame->GetSecurityContext())
     return false;
-  return CanAccessFrame(accessing_window,
-                        frame->GetSecurityContext()->GetSecurityOrigin(),
-                        frame->DomWindow(), exception_state);
+  bool can_access = CanAccessFrame(
+      accessing_window, frame->GetSecurityContext()->GetSecurityOrigin(),
+      frame->DomWindow(), exception_state);
+
+  if (!can_access) {
+    UseCounter::Count(accessing_window->GetFrame(),
+                      UseCounter::kCrossOriginPropertyAccess);
+    if (target->DomWindow()->opener() == accessing_window) {
+      UseCounter::Count(accessing_window->GetFrame(),
+                        UseCounter::kCrossOriginPropertyAccessFromOpener);
+    }
+  }
+
+  return can_access;
 }
 
 bool BindingSecurity::ShouldAllowAccessTo(
     const LocalDOMWindow* accessing_window,
     const Location* target,
     ErrorReportOption reporting_option) {
   DCHECK(target);
   const Frame* frame = target->GetFrame();
   if (!frame || !frame->GetSecurityContext())
     return false;
-  return CanAccessFrame(accessing_window,
-                        frame->GetSecurityContext()->GetSecurityOrigin(),
-                        frame->DomWindow(), reporting_option);
+  bool can_access = CanAccessFrame(
+      accessing_window, frame->GetSecurityContext()->GetSecurityOrigin(),
+      frame->DomWindow(), reporting_option);
+
+  if (!can_access) {
+    UseCounter::Count(accessing_window->GetFrame(),
+                      UseCounter::kCrossOriginPropertyAccess);
+    if (target->DomWindow()->opener() == accessing_window) {
+      UseCounter::Count(accessing_window->GetFrame(),
+                        UseCounter::kCrossOriginPropertyAccessFromOpener);
+    }
+  }
+
+  return can_access;
 }
 
 bool BindingSecurity::ShouldAllowAccessTo(
     const LocalDOMWindow* accessing_window,
     const Node* target,
     ExceptionState& exception_state) {
   if (!target)
     return false;
   return CanAccessFrame(accessing_window,
                         target->GetDocument().GetSecurityOrigin(),
@@ skipping 149 matching lines @@
   // arguments, so the generated exception can be more descriptive.
   ExceptionState exception_state(isolate, ExceptionState::kUnknownContext,
                                  nullptr, nullptr);
   exception_state.ThrowSecurityError(
       target_window->SanitizedCrossDomainAccessErrorMessage(
           CurrentDOMWindow(isolate)),
       target_window->CrossDomainAccessErrorMessage(CurrentDOMWindow(isolate)));
 }
 
 }  // namespace blink