LayoutTests/ChangeLog

112012-06-11 Christophe Dumez <christophe.dumez@intel.com>
22
 3 [soup] Prevent setting or editing httpOnly cookies from JavaScript
 4 https://bugs.webkit.org/show_bug.cgi?id=88760
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Unskip http/tests/cookies/js-get-and-set-http-only-cookie.html now
 9 that we don't allow overwriting httpOnly cookies from JavaScript
 10 anymore.
 11
 12 * platform/efl/TestExpectations:
 13
 142012-06-11 Christophe Dumez <christophe.dumez@intel.com>
 15
316 [EFL] skip http/tests/cookies/js-get-and-set-http-only-cookie.html test case
417 https://bugs.webkit.org/show_bug.cgi?id=88751
518

LayoutTests/platform/efl/TestExpectations

@@BUGWK86637 : editing/spelling/spellcheck-queue.html = TEXT
711711BUGWK86637 : editing/spelling/spellcheck-sequencenum.html = TEXT
712712BUGWK86637 : editing/spelling/spelling-marker-description.html = TEXT
713713
714 // New test added in r119947 which fails on almost all ports
715 BUGWK87208 : http/tests/cookies/js-get-and-set-http-only-cookie.html = TEXT
716 
717714// It is unclear whether a new baseline is needed or it is a JSC failure
718715BUGWK77413 : fast/parser/nested-fragment-parser-crash.html = TEXT
719716

Source/WebCore/ChangeLog

 12012-06-11 Christophe Dumez <christophe.dumez@intel.com>
 2
 3 [soup] Prevent setting or editing httpOnly cookies from JavaScript
 4 https://bugs.webkit.org/show_bug.cgi?id=88760
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Prevent setting or overwriting httpOnly cookies from JavaScript.
 9
 10 Test: http/tests/cookies/js-get-and-set-http-only-cookie.html
 11
 12 * platform/network/soup/CookieJarSoup.cpp:
 13 (WebCore::setCookies):
 14
1152012-06-11 Peter Wang <peter.wang@torchmobile.com.cn>
216
317 [JSC] Web Inspector: implement breaking from native callback

Source/WebCore/platform/network/soup/CookieJarSoup.cpp

@@void setCookies(Document* document, const KURL& url, const String& value)
7979 return;
8080
8181 GOwnPtr<SoupURI> origin(soup_uri_new(url.string().utf8().data()));
 82 GOwnPtr<SoupCookie> newCookie(soup_cookie_parse(value.utf8().data(), origin.get()));
 83 if (!newCookie)
 84 return;
 85
 86 // Make sure the cookie is not httpOnly since such cookies should not be
 87 // set from JavaScript (Bug 86067).
 88 if (soup_cookie_get_http_only(newCookie.get()))
 89 return;
 90
 91 // Make sure we do not overwrite httpOnly cookies from JavaScript (Bug 86067).
 92 GOwnPtr<GSList> existingCookies(soup_cookie_jar_all_cookies(jar));
 93 for (GSList* iter = existingCookies.get(); iter; iter = g_slist_next(iter)) {
 94 GOwnPtr<SoupCookie> existingCookie(static_cast<SoupCookie*>(iter->data));
 95 if (!soup_cookie_applies_to_uri(existingCookie.get(), origin.get()))
 96 continue;
 97 if (!strcmp(soup_cookie_get_name(existingCookie.get()), soup_cookie_get_name(newCookie.get()))
 98 && !g_strcmp0(soup_cookie_get_path(existingCookie.get()), soup_cookie_get_path(newCookie.get()))) {
 99 // Attempt to overwrite existing cookie
 100 if (soup_cookie_get_http_only(existingCookie.get()))
 101 return;
 102 break;
 103 }
 104 }
 105
 106 // Check cookie jar policy and set cookie.
 107 SoupCookieJarAcceptPolicy policy = soup_cookie_jar_get_accept_policy(jar);
82108 GOwnPtr<SoupURI> firstParty(soup_uri_new(document->firstPartyForCookies().string().utf8().data()));
83  soup_cookie_jar_set_cookie_with_first_party(jar, origin.get(), firstParty.get(), value.utf8().data());
 109 if (policy != SOUP_COOKIE_JAR_ACCEPT_NEVER
 110 && (policy == SOUP_COOKIE_JAR_ACCEPT_ALWAYS || soup_cookie_domain_matches(newCookie.get(), firstParty->host)))
 111 soup_cookie_jar_add_cookie(jar, newCookie.release());
84112}
85113
86114static String cookiesForDocument(const Document* document, const KURL& url, bool forHTTPHeader)