Added some same-origin-domain checks #15478

asajeffrey · 2017-02-09T22:32:41Z

This PR adds some same-origin-domain checks, replacing some same-origin checks. This will make a difference once we support setting document.domain.

This PR builds on #15438, only the last commit is part of this PR.

./mach build -d does not report any errors
./mach test-tidy does not report any errors
These changes do not require tests because we don't support setting document.domain yet

This change is

highfive · 2017-02-09T22:32:45Z

Heads up! This PR modifies the following files:

@fitzgen: components/script/dom/servoparser/mod.rs, components/script/dom/window.rs, components/script/dom/location.rs, components/script/dom/document.rs, components/script/dom/xmlhttprequest.rs, components/script/devtools.rs, components/script/dom/history.rs, components/script/webdriver_handlers.rs, components/script/lib.rs, components/script/dom/domparser.rs, components/script/script_thread.rs, components/script/dom/domimplementation.rs, components/script/dom/htmliframeelement.rs, components/script/dom/webidls/Location.webidl, components/script/dom/node.rs, components/script/dom/xmldocument.rs, components/script/dom/bindings/trace.rs, components/script/origin.rs
@KiChjang: components/script/dom/servoparser/mod.rs, components/script/dom/window.rs, components/script/dom/location.rs, components/script/dom/document.rs, components/net/http_loader.rs, components/script/dom/xmlhttprequest.rs, components/script/devtools.rs, components/script/dom/history.rs, components/script/webdriver_handlers.rs, components/script/lib.rs, components/script/dom/domparser.rs, components/script/script_thread.rs, components/script/dom/domimplementation.rs, components/script/dom/htmliframeelement.rs, components/script/dom/webidls/Location.webidl, components/script/dom/node.rs, components/script/dom/xmldocument.rs, components/script/dom/bindings/trace.rs, components/script/origin.rs, components/net_traits/request.rs, components/net_traits/request.rs

highfive · 2017-02-09T22:32:46Z

Warning

These commits modify unsafe code. Please review it carefully!

asajeffrey · 2017-02-09T22:33:13Z

cc @jdm @cbrewster

Ms2ger

I'm not convinced it's a good idea to land this until we actually have document.domain, and I can tell you to write tests for each and every change here.

Ms2ger · 2017-02-10T09:53:09Z

components/script/dom/htmliframeelement.rs

    fn GetContentDocument(&self) -> Option<Root<Document>> {
-        self.get_content_window().map(|window| window.Document())
+        // Step 1.
+        if let Some(pipeline_id) = self.pipeline_id.get() {


Early returns would be better here.

asajeffrey · 2017-02-10T16:31:07Z

I updated the test expectations (d6e2792). Summary:

Some tests now PASS, hooray!

/html/browsers/history/the-location-interface/security_location_0.htm
/html/browsers/the-window-object/security-window/window-security.html
/html/semantics/embedded-content/the-iframe-element/iframe-load-event.html
/navigation-timing/test_unique_performance_objects.html 
/html/semantics/scripting-1/the-template-element/...
/html/syntax/parsing/template/...

Some tests which were FAIL are now TIMEOUT. The timeouts are caused by postMessage, in particular event.source being undefined.
I bugfixed tests/wpt/mozilla/tests/mozilla/referrer-policy/generic/common.js, which was stringifying iframe.contentWindow.location even for cross-origin windows, which now generates a security error.

@Ms2ger: with these updates to the test expectations, are you okay with this PR going ahead without document.domain?

asajeffrey · 2017-02-13T17:05:14Z

Updated #15438.

asajeffrey · 2017-02-13T21:02:21Z

@Ms2ger I added the setter for document.domain over in #15536, which includes a test for same-origin-domain security checks.

asajeffrey · 2017-02-15T22:22:09Z

@Ms2ger ping?

asajeffrey · 2017-02-15T22:25:59Z

Rebased.

bors-servo · 2017-02-18T21:28:38Z

☔ The latest upstream changes (presumably #15588) made this pull request unmergeable. Please resolve the merge conflicts.

asajeffrey · 2017-02-21T20:46:14Z

Fixed a bug which was causing blob://http://foo.com/ to be considered dissimilar-origin to http://foo.com/. Also rebased.

bors-servo · 2017-02-22T18:34:07Z

☔ The latest upstream changes (presumably #15438) made this pull request unmergeable. Please resolve the merge conflicts.

asajeffrey · 2017-02-22T19:17:24Z

#15438 landed, so this can now land.

@Ms2ger: are you still wanting more tests? If so, we probably need to merge this with #15536.

bors-servo · 2017-02-23T02:43:42Z

☔ The latest upstream changes (presumably #14962) made this pull request unmergeable. Please resolve the merge conflicts.


        Added some same-origin-domain checks.


        WIP: updating test expectations


        WIP: Updated wpt manifest.


        WIP: responding to review comments.


        WIP: blob:http://foo.com/ is same-origin with http://foo.com/.

asajeffrey · 2017-02-27T02:06:25Z

Conversation with @jdm on irc: http://logs.glob.uno/?c=mozilla%23servo&s=24+Feb+2017&e=24+Feb+2017#c619500

TL;DR: merge this PR with #15536.


        Auto merge of #15536 - asajeffrey:script-document-domain-setter, r=<try>

Implement setter for document.domain  This PR implements the setter for `document.domain`. It builds on #15438 and #15478, only the last commit is part of this PR. It includes tests for similar-origin security checks. ---  - [X] `./mach build -d` does not report any errors - [X] `./mach test-tidy` does not report any errors - [X] These changes fix #934. - [X] There are tests for these changes.   --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/15536)


        Auto merge of #15536 - asajeffrey:script-document-domain-setter, r=nox

Implement setter for document.domain  This PR implements the setter for `document.domain`. It builds on #15438 and #15478, only the last commit is part of this PR. It includes tests for similar-origin security checks. ---  - [X] `./mach build -d` does not report any errors - [X] `./mach test-tidy` does not report any errors - [X] These changes fix #934. - [X] There are tests for these changes.   --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/15536)


        Auto merge of #15679 - asajeffrey:script-postMessage-xorigin, r=emilio

Implement cross-thread postMessage  This PR implements cross-thread postMessage, It builds on #15438 and #15478, only the last commit is part of this PR. ---  - [X] `./mach build -d` does not report any errors - [X] `./mach test-tidy` does not report any errors - [X] There are tests for these changes   --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/15679)

highfive assigned Ms2ger Feb 9, 2017

highfive added the S-awaiting-review label Feb 9, 2017

asajeffrey added A-content/script and removed S-awaiting-review labels Feb 9, 2017

asajeffrey changed the title ~~Script same origin domain~~ Added some same-origin-domain checks Feb 9, 2017

Ms2ger reviewed Feb 10, 2017

View changes

highfive added the S-awaiting-review label Feb 10, 2017

asajeffrey added the S-needs-squash label Feb 10, 2017

asajeffrey force-pushed the asajeffrey:script-same-origin-domain branch from d7d00a2 to 583a7dd Feb 13, 2017

asajeffrey mentioned this pull request Feb 13, 2017

Implement setter for document.domain #15536

Merged

4 of 4 tasks complete

asajeffrey force-pushed the asajeffrey:script-same-origin-domain branch from 583a7dd to 92d220b Feb 15, 2017

highfive added the S-needs-rebase label Feb 18, 2017

asajeffrey force-pushed the asajeffrey:script-same-origin-domain branch from 92d220b to b07d2dc Feb 21, 2017

asajeffrey removed the S-needs-rebase label Feb 21, 2017

asajeffrey mentioned this pull request Feb 21, 2017

Implement cross-thread postMessage #15679

Merged

3 of 3 tasks complete

highfive added the S-needs-rebase label Feb 22, 2017

asajeffrey force-pushed the asajeffrey:script-same-origin-domain branch 2 times, most recently from d91b63a to 26ea806 Feb 22, 2017

asajeffrey removed the S-needs-rebase label Feb 22, 2017

highfive added the S-needs-rebase label Feb 23, 2017

asajeffrey added 5 commits Feb 9, 2017

Added some same-origin-domain checks.

4ad32cb

WIP: updating test expectations

5927437

WIP: Updated wpt manifest.

c867201

WIP: responding to review comments.

c3f055f

WIP: blob:http://foo.com/ is same-origin with http://foo.com/.

Loading status checks…

1d8d6ac

asajeffrey force-pushed the asajeffrey:script-same-origin-domain branch from 26ea806 to 1d8d6ac Feb 23, 2017

asajeffrey removed the S-needs-rebase label Feb 23, 2017

asajeffrey closed this Feb 27, 2017

servo / servo

Added some same-origin-domain checks #15478

Added some same-origin-domain checks #15478

asajeffrey commented Feb 9, 2017 •

edited by larsbergstrom

highfive commented Feb 9, 2017

highfive commented Feb 9, 2017

asajeffrey commented Feb 9, 2017

Ms2ger left a comment

This comment has been minimized.

This comment has been minimized.

asajeffrey commented Feb 10, 2017

asajeffrey commented Feb 13, 2017

asajeffrey commented Feb 13, 2017

asajeffrey commented Feb 15, 2017

asajeffrey commented Feb 15, 2017

bors-servo commented Feb 18, 2017

asajeffrey commented Feb 21, 2017

bors-servo commented Feb 22, 2017

asajeffrey commented Feb 22, 2017

bors-servo commented Feb 23, 2017

asajeffrey commented Feb 27, 2017

servo / servo

Join GitHub today

Added some same-origin-domain checks #15478

Added some same-origin-domain checks #15478

Conversation

asajeffrey commented Feb 9, 2017 • edited by larsbergstrom

highfive commented Feb 9, 2017

highfive commented Feb 9, 2017

asajeffrey commented Feb 9, 2017

Ms2ger left a comment

This comment has been minimized.

Ms2ger Feb 10, 2017

This comment has been minimized.

asajeffrey Feb 10, 2017

asajeffrey commented Feb 10, 2017

asajeffrey commented Feb 13, 2017

asajeffrey commented Feb 13, 2017

asajeffrey commented Feb 15, 2017

asajeffrey commented Feb 15, 2017

bors-servo commented Feb 18, 2017

asajeffrey commented Feb 21, 2017

bors-servo commented Feb 22, 2017

asajeffrey commented Feb 22, 2017

bors-servo commented Feb 23, 2017

asajeffrey commented Feb 27, 2017

asajeffrey commented Feb 9, 2017 •

edited by larsbergstrom