Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(346)

Unified Diff: third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp

Issue 2881393002: Count cross-origin property access. (Closed)
Patch Set: Nits + Rebase. Created 3 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp b/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp
index 9a42280e93f9f57dcfdc97d580e90b05a4ce0770..1a1239d5cd36333c562ab93bbbc560d439b438e1 100644
--- a/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp
@@ -40,6 +40,7 @@
#include "core/frame/LocalFrame.h"
#include "core/frame/Location.h"
#include "core/frame/Settings.h"
+#include "core/frame/UseCounter.h"
#include "core/html/HTMLFrameElementBase.h"
#include "core/workers/MainThreadWorkletGlobalScope.h"
#include "platform/bindings/WrapperCreationSecurityCheck.h"
@@ -133,8 +134,18 @@ bool BindingSecurity::ShouldAllowAccessTo(
// would have to early return when it was null.
if (!target->GetFrame())
return false;
+ bool can_access = CanAccessWindow(accessing_window, target, exception_state);
+
+ if (!can_access) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccess);
+ if (target->opener() == accessing_window) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccessFromOpener);
+ }
+ }
- return CanAccessWindow(accessing_window, target, exception_state);
+ return can_access;
}
bool BindingSecurity::ShouldAllowAccessTo(
@@ -151,7 +162,18 @@ bool BindingSecurity::ShouldAllowAccessTo(
if (!target->GetFrame())
return false;
- return CanAccessWindow(accessing_window, target, reporting_option);
+ bool can_access = CanAccessWindow(accessing_window, target, reporting_option);
+
+ if (!can_access) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccess);
+ if (target->opener() == accessing_window) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccessFromOpener);
+ }
+ }
+
+ return can_access;
}
bool BindingSecurity::ShouldAllowAccessTo(
@@ -168,8 +190,19 @@ bool BindingSecurity::ShouldAllowAccessTo(
if (!target->DomWindow()->GetFrame())
return false;
- return CanAccessWindow(accessing_window, target->DomWindow(),
- exception_state);
+ bool can_access =
+ CanAccessWindow(accessing_window, target->DomWindow(), exception_state);
+
+ if (!can_access) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccess);
+ if (target->DomWindow()->opener() == accessing_window) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccessFromOpener);
+ }
+ }
+
+ return can_access;
}
bool BindingSecurity::ShouldAllowAccessTo(
@@ -186,8 +219,19 @@ bool BindingSecurity::ShouldAllowAccessTo(
if (!target->DomWindow()->GetFrame())
return false;
- return CanAccessWindow(accessing_window, target->DomWindow(),
- reporting_option);
+ bool can_access =
+ CanAccessWindow(accessing_window, target->DomWindow(), reporting_option);
+
+ if (!can_access) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccess);
+ if (target->DomWindow()->opener() == accessing_window) {
+ UseCounter::Count(accessing_window->GetFrame(),
+ UseCounter::kCrossOriginPropertyAccessFromOpener);
+ }
+ }
+
+ return can_access;
}
bool BindingSecurity::ShouldAllowAccessTo(
« no previous file with comments | « third_party/WebKit/Source/bindings/core/DEPS ('k') | third_party/WebKit/Source/bindings/core/v8/BindingSecurityTest.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698