Fix to respect --explicitly-allowed-ports command line option

Source/modules/websockets/DOMWebSocket.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 34 matching lines @@
 #include "core/frame/ConsoleTypes.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/ScriptCallStack.h"
 #include "modules/websockets/CloseEvent.h"
 #include "platform/Logging.h"
 #include "platform/blob/BlobData.h"
 #include "platform/heap/Handle.h"
-#include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "wtf/Assertions.h"
 #include "wtf/HashSet.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/WTFString.h"
 
@@ skipping 230 matching lines @@
         m_state = CLOSED;
         exceptionState.throwDOMException(SyntaxError, "The URL's scheme must be either 'ws' or 'wss'. '" + m_url.protocol() + "' is not allowed.");
         return;
     }
 
     if (m_url.hasFragmentIdentifier()) {
         m_state = CLOSED;
         exceptionState.throwDOMException(SyntaxError, "The URL contains a fragment identifier ('" + m_url.fragmentIdentifier() + "'). Fragment identifiers are not allowed in WebSocket URLs.");
         return;
     }
-    if (!portAllowed(m_url)) {
+
+    if (!Platform::current()->portAllowed(m_url.port(), m_url.protocolIs("ftp"))) {

[eroman, 2015/04/10 01:55:56]

A couple things here:

  (1) It is weird to be calling m_url.port() in cases where the URL has no
specified port. In this case it will return 0, and relies on the assumption that
0 is an allowed port to pass. It would be better to only do the test if
m_url.hasPort().

 (2) Is it possible for the URL scheme to be anything other than "ws" or "wss" ?
The test for FTP would make sense in the general case, but it looks weird here.

 (3) The previous implementation of portAllowed() also explicitly checked for
"file" scheme and allowed everything on that. I don't think that is applicable
anymore, but the solution will depend on the answer to (2)

[Paritosh Kumar, 2015/04/10 12:52:35]

Updated in new CL.

 
As on line# 296 we are doing protocol check:
"if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
    m_state = CLOSED;
    exceptionState.throwDOMException(SyntaxError, "The URL's scheme must be
either 'ws' or 'wss'. '" + m_url.protocol() + "' is not allowed.");
    return;
}"

So, URL scheme cannot be other than "ws" or "wss", here. So, should remove test
for FTP. Thanks.
Agree. No need of checking for file also. As per (2).

         m_state = CLOSED;
         exceptionState.throwSecurityError("The port " + String::number(m_url.port()) + " is not allowed.");
         return;
     }
 
     // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved.
     if (!ContentSecurityPolicy::shouldBypassMainWorld(executionContext()) && !executionContext()->contentSecurityPolicy()->allowConnectToSource(m_url)) {
         m_state = CLOSED;
         // The URL is safe to expose to JavaScript, as this check happens synchronously before redirection.
         exceptionState.throwSecurityError("Refused to connect to '" + m_url.elidedString() + "' because it violates the document's Content Security Policy.");
@@ skipping 365 matching lines @@
 DEFINE_TRACE(DOMWebSocket)
 {
     visitor->trace(m_channel);
     visitor->trace(m_eventQueue);
     WebSocketChannelClient::trace(visitor);
     RefCountedGarbageCollectedEventTargetWithInlineData<DOMWebSocket>::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink