147734 2015-08-06 11:18:32 -0700 Do not enforce "content-disposition: attachment" sandbox restrictions on a MediaDocument 2015-08-06 14:37:07 -0700 1 1 1 Unclassified WebKit Media 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 eric.carlson eric.carlson commit-queue esprehn+autocc kangil.han oldest_to_newest 1115380 0 eric.carlson 2015-08-06 11:18:32 -0700 Do not enforce "content-disposition: attachment" sandbox restrictions on a MediaDocument. A MediaDocument can't come with scripts, but we need to be able to run script in the shadow DOM for the controls to function. 1115383 1 eric.carlson 2015-08-06 11:21:36 -0700 A layout test is proving difficult, filed bug 147735 for that. 1115389 2 eric.carlson 2015-08-06 11:28:50 -0700 rdar://problem/22028179 1115390 3 258379 eric.carlson 2015-08-06 11:29:16 -0700 Created attachment 258379 Proposed patch 1115400 4 258379 commit-queue 2015-08-06 11:45:16 -0700 Comment on attachment 258379 Proposed patch Clearing flags on attachment: 258379 Committed r188051: <http://trac.webkit.org/changeset/188051> 1115401 5 commit-queue 2015-08-06 11:45:19 -0700 All reviewed patches have been landed. Closing bug. 1115441 6 eric.carlson 2015-08-06 14:08:25 -0700 Re-opening, the initial fix was not quite right. 1115442 7 258395 eric.carlson 2015-08-06 14:09:06 -0700 Created attachment 258395 Proposed patch 1115454 8 eric.carlson 2015-08-06 14:37:07 -0700 Committed r188062: https://trac.webkit.org/r188062 258379 2015-08-06 11:29:16 -0700 2015-08-06 14:09:06 -0700 Proposed patch patch_2.txt text/plain 1532 eric.carlson SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE4ODA0OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDE1LTA4LTA2ICBFcmljIENh cmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgorCisgICAgICAgIERvIG5vdCBlbmZvcmNl ICJjb250ZW50LWRpc3Bvc2l0aW9uOiBhdHRhY2htZW50IiBzYW5kYm94IHJlc3RyaWN0aW9ucyBv biBhIE1lZGlhRG9jdW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTE0NzczNAorICAgICAgICByZGFyOi8vcHJvYmxlbS8yMjAyODE3OQorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3QgdG8gZm9sbG93 LCBzZWUgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0NzczNQorCisg ICAgICAgICogZG9tL0RvY3VtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkRvY3VtZW50Ojpz aG91bGRFbmZvcmNlQ29udGVudERpc3Bvc2l0aW9uQXR0YWNobWVudFNhbmRib3gpOiBSZXR1cm4K KyAgICAgICAgICBlYXJseSBpZiB0aGUgRG9jdW1lbnQgaXMgYSBNZWRpYURvY3VtZW50LgorCiAy MDE1LTA4LTA2ICBHeXV5b3VuZyBLaW0gIDxneXV5b3VuZy5raW1Ad2Via2l0Lm9yZz4KIAogICAg ICAgICBbQ29vcmRpbmF0ZWRHcmFwaGljc10gUmVtb3ZlIHVudXNlZCBmdW5jdGlvbnMgaW4gQ29v cmRpbmF0ZWQgVGlsZWRCYWNraW5nU3RvcmUKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1 bWVudC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAko cmV2aXNpb24gMTg3ODYzKQorKysgU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAkod29y a2luZyBjb3B5KQpAQCAtNjcxMCw2ICs2NzEwLDkgQEAgYm9vbCBEb2N1bWVudDo6c2hvdWxkRW5m b3JjZUNvbnRlbnREaXNwbwogICAgIGlmIChtX2lzU3ludGhlc2l6ZWQpCiAgICAgICAgIHJldHVy biBmYWxzZTsKIAorICAgIGlmIChpc01lZGlhRG9jdW1lbnQoKSkKKyAgICAgICAgcmV0dXJuIGZh bHNlOworCiAgICAgYm9vbCBjb250ZW50RGlzcG9zaXRpb25BdHRhY2htZW50U2FuZGJveEVuYWJs ZWQgPSBzZXR0aW5ncygpICYmIHNldHRpbmdzKCktPmNvbnRlbnREaXNwb3NpdGlvbkF0dGFjaG1l bnRTYW5kYm94RW5hYmxlZCgpOwogICAgIGJvb2wgcmVzcG9uc2VJc0F0dGFjaG1lbnQgPSBmYWxz ZTsKICAgICBpZiAoRG9jdW1lbnRMb2FkZXIqIGRvY3VtZW50TG9hZGVyID0gbV9mcmFtZSA/IG1f ZnJhbWUtPmxvYWRlcigpLmFjdGl2ZURvY3VtZW50TG9hZGVyKCkgOiBudWxscHRyKQo= 258395 2015-08-06 14:09:06 -0700 2015-08-06 14:33:44 -0700 Proposed patch patch_3.txt text/plain 3269 eric.carlson SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE4ODA1NykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDE1LTA4LTA2ICBFcmljIENh cmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgorCisgICAgICAgIERvIG5vdCBlbmZvcmNl ICJjb250ZW50LWRpc3Bvc2l0aW9uOiBhdHRhY2htZW50IiBzYW5kYm94IHJlc3RyaWN0aW9ucyBv biBhIE1lZGlhRG9jdW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTE0NzczNAorICAgICAgICByZGFyOi8vcHJvYmxlbS8yMjAyODE3OQorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3QgdG8gZm9sbG93 LCBzZWUgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0NzczNQorCisg ICAgICAgICogZG9tL0RvY3VtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkRvY3VtZW50Ojpp bml0U2VjdXJpdHlDb250ZXh0KTogVXNlIGFwcGx5Q29udGVudERpc3Bvc2l0aW9uQXR0YWNobWVu dFNhbmRib3gKKyAgICAgICAgICBpbnN0ZWFkIG9mIHNldHRpbmcgc2FuZGJveCBmbGFncyBkaXJl Y3RseS4KKyAgICAgICAgKFdlYkNvcmU6OkRvY3VtZW50OjpzaG91bGRFbmZvcmNlQ29udGVudERp c3Bvc2l0aW9uQXR0YWNobWVudFNhbmRib3gpOiBEb24ndCBzcGVjaWFsCisgICAgICAgICAgY2Fz ZSBNZWRpYURvY3VtZW50LgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnQ6OmFwcGx5Q29udGVu dERpc3Bvc2l0aW9uQXR0YWNobWVudFNhbmRib3gpOiBBcHBseSBzYW5kYm94IGZsYWdzCisgICAg ICAgICAgYWNjb3JkaW5nIHRvIGRvY3VtZW50IHR5cGUuCisgICAgICAgICogZG9tL0RvY3VtZW50 Lmg6CisKIDIwMTUtMDgtMDYgIE15bGVzIEMuIE1heGZpZWxkICA8bW1heGZpZWxkQGFwcGxlLmNv bT4KIAogICAgICAgICBBZGQgY29tbWVudCB0byBDU1NQYXJzZXJTdHJpbmcKSW5kZXg6IFNvdXJj ZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUv ZG9tL0RvY3VtZW50LmNwcAkocmV2aXNpb24gMTg4MDUyKQorKysgU291cmNlL1dlYkNvcmUvZG9t L0RvY3VtZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDkzNiw3ICs0OTM2LDcgQEAgdm9pZCBE b2N1bWVudDo6aW5pdFNlY3VyaXR5Q29udGV4dCgpCiAgICAgZW5mb3JjZVNhbmRib3hGbGFncyht X2ZyYW1lLT5sb2FkZXIoKS5lZmZlY3RpdmVTYW5kYm94RmxhZ3MoKSk7CiAKICAgICBpZiAoc2hv dWxkRW5mb3JjZUNvbnRlbnREaXNwb3NpdGlvbkF0dGFjaG1lbnRTYW5kYm94KCkpCi0gICAgICAg IGVuZm9yY2VTYW5kYm94RmxhZ3MoU2FuZGJveEFsbCk7CisgICAgICAgIGFwcGx5Q29udGVudERp c3Bvc2l0aW9uQXR0YWNobWVudFNhbmRib3goKTsKIAogICAgIHNldFNlY3VyaXR5T3JpZ2luUG9s aWN5KFNlY3VyaXR5T3JpZ2luUG9saWN5OjpjcmVhdGUoaXNTYW5kYm94ZWQoU2FuZGJveE9yaWdp bikgPyBTZWN1cml0eU9yaWdpbjo6Y3JlYXRlVW5pcXVlKCkgOiBTZWN1cml0eU9yaWdpbjo6Y3Jl YXRlKG1fdXJsKSkpOwogICAgIHNldENvbnRlbnRTZWN1cml0eVBvbGljeShzdGQ6Om1ha2VfdW5p cXVlPENvbnRlbnRTZWN1cml0eVBvbGljeT4odGhpcykpOwpAQCAtNjcxNyw5ICs2NzE3LDYgQEAg Ym9vbCBEb2N1bWVudDo6c2hvdWxkRW5mb3JjZUNvbnRlbnREaXNwbwogICAgIGlmIChtX2lzU3lu dGhlc2l6ZWQpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIAotICAgIGlmIChpc01lZGlhRG9jdW1l bnQoKSkKLSAgICAgICAgcmV0dXJuIGZhbHNlOwotCiAgICAgYm9vbCBjb250ZW50RGlzcG9zaXRp b25BdHRhY2htZW50U2FuZGJveEVuYWJsZWQgPSBzZXR0aW5ncygpICYmIHNldHRpbmdzKCktPmNv bnRlbnREaXNwb3NpdGlvbkF0dGFjaG1lbnRTYW5kYm94RW5hYmxlZCgpOwogICAgIGJvb2wgcmVz cG9uc2VJc0F0dGFjaG1lbnQgPSBmYWxzZTsKICAgICBpZiAoRG9jdW1lbnRMb2FkZXIqIGRvY3Vt ZW50TG9hZGVyID0gbV9mcmFtZSA/IG1fZnJhbWUtPmxvYWRlcigpLmFjdGl2ZURvY3VtZW50TG9h ZGVyKCkgOiBudWxscHRyKQpAQCAtNjcyOCw0ICs2NzI1LDE0IEBAIGJvb2wgRG9jdW1lbnQ6OnNo b3VsZEVuZm9yY2VDb250ZW50RGlzcG8KICAgICByZXR1cm4gY29udGVudERpc3Bvc2l0aW9uQXR0 YWNobWVudFNhbmRib3hFbmFibGVkICYmIHJlc3BvbnNlSXNBdHRhY2htZW50OwogfQogCit2b2lk IERvY3VtZW50OjphcHBseUNvbnRlbnREaXNwb3NpdGlvbkF0dGFjaG1lbnRTYW5kYm94KCkKK3sK KyAgICBBU1NFUlQoc2hvdWxkRW5mb3JjZUNvbnRlbnREaXNwb3NpdGlvbkF0dGFjaG1lbnRTYW5k Ym94KCkpOworCisgICAgaWYgKCFpc01lZGlhRG9jdW1lbnQoKSkKKyAgICAgICAgZW5mb3JjZVNh bmRib3hGbGFncyhTYW5kYm94QWxsKTsKKyAgICBlbHNlCisgICAgICAgIGVuZm9yY2VTYW5kYm94 RmxhZ3MoU2FuZGJveE9yaWdpbik7Cit9CisKIH0gLy8gbmFtZXNwYWNlIFdlYkNvcmUKSW5kZXg6 IFNvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJD b3JlL2RvbS9Eb2N1bWVudC5oCShyZXZpc2lvbiAxODgwNTIpCisrKyBTb3VyY2UvV2ViQ29yZS9k b20vRG9jdW1lbnQuaAkod29ya2luZyBjb3B5KQpAQCAtMTI3OSw2ICsxMjc5LDcgQEAgcHVibGlj OgogCiAgICAgU2hvdWxkT3BlbkV4dGVybmFsVVJMc1BvbGljeSBzaG91bGRPcGVuRXh0ZXJuYWxV UkxzUG9saWN5VG9Qcm9wYWdhdGUoKSBjb25zdDsKICAgICBib29sIHNob3VsZEVuZm9yY2VDb250 ZW50RGlzcG9zaXRpb25BdHRhY2htZW50U2FuZGJveCgpIGNvbnN0OworICAgIHZvaWQgYXBwbHlD b250ZW50RGlzcG9zaXRpb25BdHRhY2htZW50U2FuZGJveCgpOwogCiBwcm90ZWN0ZWQ6CiAgICAg ZW51bSBDb25zdHJ1Y3Rpb25GbGFncyB7IFN5bnRoZXNpemVkID0gMSwgTm9uUmVuZGVyZWRQbGFj ZWhvbGRlciA9IDEgPDwgMSB9Owo=