176939 2017-09-14 12:20:34 -0700 Storage Access API: Deny access to nested iframes 2017-09-15 10:54:41 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 wilander wilander bfulgham buildbot cdumez commit-queue dbates esprehn+autocc kangil.han webkit-bug-importer wilander oldest_to_newest 1348917 0 wilander 2017-09-14 12:20:34 -0700 Only iframes that are direct children of the top document may ask for storage access. 1348918 1 webkit-bug-importer 2017-09-14 12:21:52 -0700 <rdar://problem/34439609> 1349010 2 320821 wilander 2017-09-14 14:26:07 -0700 Created attachment 320821 Patch 1349370 3 320821 bfulgham 2017-09-15 10:04:56 -0700 Comment on attachment 320821 Patch Good! r=me. 1349381 4 320821 wilander 2017-09-15 10:25:43 -0700 Comment on attachment 320821 Patch Thanks, Brent! 1349395 5 320821 commit-queue 2017-09-15 10:54:39 -0700 Comment on attachment 320821 Patch Clearing flags on attachment: 320821 Committed r222099: <http://trac.webkit.org/changeset/222099> 1349396 6 commit-queue 2017-09-15 10:54:41 -0700 All reviewed patches have been landed. Closing bug. 320821 2017-09-14 14:26:07 -0700 2017-09-15 10:54:39 -0700 Patch bug-176939-20170914142606.patch text/plain 6934 wilander SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIyMjA1MikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE3LTA5LTE0ICBKb2huIFdp bGFuZGVyICA8d2lsYW5kZXJAYXBwbGUuY29tPgorCisgICAgICAgIFN0b3JhZ2UgQWNjZXNzIEFQ STogRGVueSBhY2Nlc3MgdG8gbmVzdGVkIGlmcmFtZXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3NjkzOQorICAgICAgICA8cmRhcjovL3Byb2JsZW0v MzQ0Mzk2MDk+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgVGVzdDogaHR0cC90ZXN0cy9zdG9yYWdlQWNjZXNzL3JlcXVlc3QtYW5kLWdyYW50LXN0b3Jh Z2UtYWNjZXNzLWNyb3NzLW9yaWdpbi1zYW5kYm94ZWQtbmVzdGVkLWlmcmFtZS5odG1sCisKKyAg ICAgICAgKiBkb20vRG9jdW1lbnQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnQ6OnJl cXVlc3RTdG9yYWdlQWNjZXNzKToKKwogMjAxNy0wOS0xNCAgWW91ZW5uIEZhYmxldCAgPHlvdWVu bkBhcHBsZS5jb20+CiAKICAgICAgICAgUlRDRGF0YUNoYW5uZWwgY29ubmVjdGl2aXR5IGlzc3Vl cyBpbiBTYWZhcmkgMTEKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5jcHAKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAkocmV2aXNpb24gMjIy MDM1KQorKysgU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAkod29ya2luZyBjb3B5KQpA QCAtNzMxNCw5ICs3MzE0LDE2IEBAIHZvaWQgRG9jdW1lbnQ6OnJlcXVlc3RTdG9yYWdlQWNjZXNz KFJlZjwKICAgICAgICAgcHJvbWlzZS0+cmVzb2x2ZTxJRExCb29sZWFuPihmYWxzZSk7CiAgICAg ICAgIHJldHVybjsKICAgICB9Ci0gICAgCisKKyAgICAvLyBUaGUgaWZyYW1lIGhhcyB0byBiZSBh IGRpcmVjdCBjaGlsZCBvZiB0aGUgdG9wIGRvY3VtZW50LgorICAgIGF1dG8mIHRvcERvY3VtZW50 ID0gdGhpcy0+dG9wRG9jdW1lbnQoKTsKKyAgICBpZiAoJnRvcERvY3VtZW50ICE9IHBhcmVudERv Y3VtZW50KCkpIHsKKyAgICAgICAgcHJvbWlzZS0+cmVzb2x2ZTxJRExCb29sZWFuPihmYWxzZSk7 CisgICAgICAgIHJldHVybjsKKyAgICB9CisKICAgICBhdXRvJiBzZWN1cml0eU9yaWdpbiA9IHRo aXMtPnNlY3VyaXR5T3JpZ2luKCk7Ci0gICAgYXV0byYgdG9wU2VjdXJpdHlPcmlnaW4gPSB0b3BE b2N1bWVudCgpLnNlY3VyaXR5T3JpZ2luKCk7CisgICAgYXV0byYgdG9wU2VjdXJpdHlPcmlnaW4g PSB0b3BEb2N1bWVudC5zZWN1cml0eU9yaWdpbigpOwogICAgIGlmIChzZWN1cml0eU9yaWdpbi5l cXVhbCgmdG9wU2VjdXJpdHlPcmlnaW4pKSB7CiAgICAgICAgIG1faGFzU3RvcmFnZUFjY2VzcyA9 IHRydWU7CiAgICAgICAgIHByb21pc2UtPnJlc29sdmU8SURMQm9vbGVhbj4odHJ1ZSk7CkluZGV4 OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCShyZXZpc2lvbiAyMjIwMzUpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcg Y29weSkKQEAgLTEsMyArMSwxNyBAQAorMjAxNy0wOS0xNCAgSm9obiBXaWxhbmRlciAgPHdpbGFu ZGVyQGFwcGxlLmNvbT4KKworICAgICAgICBTdG9yYWdlIEFjY2VzcyBBUEk6IERlbnkgYWNjZXNz IHRvIG5lc3RlZCBpZnJhbWVzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD0xNzY5MzkKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzM0NDM5NjA5PgorCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogaHR0cC90ZXN0 cy9zdG9yYWdlQWNjZXNzL3JlcXVlc3QtYW5kLWdyYW50LXN0b3JhZ2UtYWNjZXNzLWNyb3NzLW9y aWdpbi1zYW5kYm94ZWQtbmVzdGVkLWlmcmFtZS1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAg ICAqIGh0dHAvdGVzdHMvc3RvcmFnZUFjY2Vzcy9yZXF1ZXN0LWFuZC1ncmFudC1zdG9yYWdlLWFj Y2Vzcy1jcm9zcy1vcmlnaW4tc2FuZGJveGVkLW5lc3RlZC1pZnJhbWUuaHRtbDogQWRkZWQuCisg ICAgICAgICogaHR0cC90ZXN0cy9zdG9yYWdlQWNjZXNzL3Jlc291cmNlcy9uZXN0aW5nLWlmcmFt ZS5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBwbGF0Zm9ybS9tYWMtd2syL1Rlc3RFeHBlY3RhdGlv bnM6CisgICAgICAgICAgICBBZGRlZCB0aGUgbmV3IHRlc3QgYXMgYSBbIFBhc3MgXS4KKwogMjAx Ny0wOS0xNCAgTWF0dCBMZXdpcyAgPGpsZXdpczNAYXBwbGUuY29tPgogCiAgICAgICAgIEZpeGVk IHR5cG8gaW4gZXhwZWN0YXRpb25zLgpJbmRleDogTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zdG9y YWdlQWNjZXNzL3JlcXVlc3QtYW5kLWdyYW50LXN0b3JhZ2UtYWNjZXNzLWNyb3NzLW9yaWdpbi1z YW5kYm94ZWQtbmVzdGVkLWlmcmFtZS1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0 VGVzdHMvaHR0cC90ZXN0cy9zdG9yYWdlQWNjZXNzL3JlcXVlc3QtYW5kLWdyYW50LXN0b3JhZ2Ut YWNjZXNzLWNyb3NzLW9yaWdpbi1zYW5kYm94ZWQtbmVzdGVkLWlmcmFtZS1leHBlY3RlZC50eHQJ KG5vbmV4aXN0ZW50KQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zdG9yYWdlQWNjZXNzL3Jl cXVlc3QtYW5kLWdyYW50LXN0b3JhZ2UtYWNjZXNzLWNyb3NzLW9yaWdpbi1zYW5kYm94ZWQtbmVz dGVkLWlmcmFtZS1leHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxMCBAQAor Q09OU09MRSBNRVNTQUdFOiBsaW5lIDY4OiBQQVNTIGRvY3VtZW50Lmhhc1N0b3JhZ2VBY2Nlc3Mg d2FzIGRlbmllZC4KK1Rlc3RzIHRoYXQgY3Jvc3Mtb3JpZ2luIGlmcmFtZSBzdG9yYWdlIGFjY2Vz cyBpcyBkZW5pZWQgaWYgdGhlIGlmcmFtZSBpcyBzYW5kYm94ZWQsIGhhcyB0aGUgYWxsb3cgdG9r ZW4sIGJ1dCBpcyBuZXN0ZWQuCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBv ZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitQQVNT IHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5 b3V0VGVzdHMvaHR0cC90ZXN0cy9zdG9yYWdlQWNjZXNzL3JlcXVlc3QtYW5kLWdyYW50LXN0b3Jh Z2UtYWNjZXNzLWNyb3NzLW9yaWdpbi1zYW5kYm94ZWQtbmVzdGVkLWlmcmFtZS5odG1sCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc3RvcmFnZUFjY2Vzcy9yZXF1ZXN0LWFu ZC1ncmFudC1zdG9yYWdlLWFjY2Vzcy1jcm9zcy1vcmlnaW4tc2FuZGJveGVkLW5lc3RlZC1pZnJh bWUuaHRtbAkobm9uZXhpc3RlbnQpCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3N0b3JhZ2VB Y2Nlc3MvcmVxdWVzdC1hbmQtZ3JhbnQtc3RvcmFnZS1hY2Nlc3MtY3Jvc3Mtb3JpZ2luLXNhbmRi b3hlZC1uZXN0ZWQtaWZyYW1lLmh0bWwJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwzNSBAQAor PCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFkPgorICAgIDxzY3JpcHQgc3JjPSIvanMtdGVz dC1yZXNvdXJjZXMvanMtdGVzdC5qcyI+PC9zY3JpcHQ+CisgICAgPHNjcmlwdCBzcmM9Ii9qcy10 ZXN0LXJlc291cmNlcy91aS1oZWxwZXIuanMiPjwvc2NyaXB0PgorICAgIDxzY3JpcHQ+CisgICAg ICAgIGRlc2NyaXB0aW9uKCJUZXN0cyB0aGF0IGNyb3NzLW9yaWdpbiBpZnJhbWUgc3RvcmFnZSBh Y2Nlc3MgaXMgZGVuaWVkIGlmIHRoZSBpZnJhbWUgaXMgc2FuZGJveGVkLCBoYXMgdGhlIGFsbG93 IHRva2VuLCBidXQgaXMgbmVzdGVkLiIpOworICAgICAgICBqc1Rlc3RJc0FzeW5jID0gdHJ1ZTsK KworICAgICAgICBmdW5jdGlvbiBhY3RpdmF0ZUVsZW1lbnQoZWxlbWVudElkKSB7CisgICAgICAg ICAgICB2YXIgZWxlbWVudCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGVsZW1lbnRJZCk7Cisg ICAgICAgICAgICB2YXIgY2VudGVyWCA9IGVsZW1lbnQub2Zmc2V0TGVmdCArIGVsZW1lbnQub2Zm c2V0V2lkdGggLyAyOworICAgICAgICAgICAgdmFyIGNlbnRlclkgPSBlbGVtZW50Lm9mZnNldFRv cCArIGVsZW1lbnQub2Zmc2V0SGVpZ2h0IC8gMjsKKyAgICAgICAgICAgIFVJSGVscGVyLmFjdGl2 YXRlQXQoY2VudGVyWCwgY2VudGVyWSkudGhlbigKKyAgICAgICAgICAgICAgICBmdW5jdGlvbiAo KSB7CisgICAgICAgICAgICAgICAgICAgIGlmICh3aW5kb3cuZXZlbnRTZW5kZXIpCisgICAgICAg ICAgICAgICAgICAgICAgICBldmVudFNlbmRlci5rZXlEb3duKCJlc2NhcGUiKTsKKyAgICAgICAg ICAgICAgICAgICAgZmluaXNoSlNUZXN0KCk7CisgICAgICAgICAgICAgICAgfSwKKyAgICAgICAg ICAgICAgICBmdW5jdGlvbiAoKSB7CisgICAgICAgICAgICAgICAgICAgIHRlc3RGYWlsZWQoIlBy b21pc2UgcmVqZWN0ZWQuIik7CisgICAgICAgICAgICAgICAgICAgIGZpbmlzaEpTVGVzdCgpOwor ICAgICAgICAgICAgICAgIH0KKyAgICAgICAgICAgICk7CisgICAgICAgIH0KKworICAgICAgICBm dW5jdGlvbiBydW5UZXN0KCkgeworICAgICAgICAgICAgc2V0VGltZW91dCgnYWN0aXZhdGVFbGVt ZW50KCJ0aGVJZnJhbWUiKScsIDUwMCk7CisgICAgICAgIH0KKyAgICA8L3NjcmlwdD4KKzwvaGVh ZD4KKzxib2R5PgorPGlmcmFtZSBzYW5kYm94PSJhbGxvdy1zdG9yYWdlLWFjY2Vzcy1ieS11c2Vy LWFjdGl2YXRpb24gYWxsb3ctc2NyaXB0cyBhbGxvdy1zYW1lLW9yaWdpbiBhbGxvdy1tb2RhbHMi IG9ubG9hZD0icnVuVGVzdCgpIiBpZD0idGhlSWZyYW1lIiBzcmM9InJlc291cmNlcy9uZXN0aW5n LWlmcmFtZS5odG1sIj48L2lmcmFtZT4KKzwvYm9keT4KKzwvaHRtbD4KXCBObyBuZXdsaW5lIGF0 IGVuZCBvZiBmaWxlCkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3N0b3JhZ2VBY2Nlc3Mv cmVzb3VyY2VzL25lc3RpbmctaWZyYW1lLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv aHR0cC90ZXN0cy9zdG9yYWdlQWNjZXNzL3Jlc291cmNlcy9uZXN0aW5nLWlmcmFtZS5odG1sCShu b25leGlzdGVudCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc3RvcmFnZUFjY2Vzcy9yZXNv dXJjZXMvbmVzdGluZy1pZnJhbWUuaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDggQEAK KzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzwvaGVhZD4KKzxib2R5PgorPGlmcmFt ZSBzYW5kYm94PSJhbGxvdy1zdG9yYWdlLWFjY2Vzcy1ieS11c2VyLWFjdGl2YXRpb24gYWxsb3ct c2NyaXB0cyBhbGxvdy1zYW1lLW9yaWdpbiBhbGxvdy1tb2RhbHMiIGlkPSJ0aGVJZnJhbWUiIHNy Yz0iaHR0cDovL2xvY2FsaG9zdDo4MDAwL3N0b3JhZ2VBY2Nlc3MvcmVzb3VyY2VzL3JlcXVlc3Qt c3RvcmFnZS1hY2Nlc3MtaWZyYW1lLmh0bWwjdXNlclNob3VsZEdyYW50QWNjZXNzLHVzZXJTaG91 bGROb3RCZUNvbnN1bHRlZCxwb2xpY3lTaG91bGREZW55QWNjZXNzLGlzTm90U2FtZU9yaWdpbklm cmFtZSI+PC9pZnJhbWU+Cis8L2JvZHk+Cis8L2h0bWw+ClwgTm8gbmV3bGluZSBhdCBlbmQgb2Yg ZmlsZQpJbmRleDogTGF5b3V0VGVzdHMvcGxhdGZvcm0vbWFjLXdrMi9UZXN0RXhwZWN0YXRpb25z Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL3BsYXRmb3JtL21hYy13azIvVGVzdEV4cGVjdGF0 aW9ucwkocmV2aXNpb24gMjIyMDM1KQorKysgTGF5b3V0VGVzdHMvcGxhdGZvcm0vbWFjLXdrMi9U ZXN0RXhwZWN0YXRpb25zCSh3b3JraW5nIGNvcHkpCkBAIC03NTUsNiArNzU1LDcgQEAgaHR0cC90 ZXN0cy9zdG9yYWdlQWNjZXNzL3JlcXVlc3Qtc3RvcmFnZQogaHR0cC90ZXN0cy9zdG9yYWdlQWNj ZXNzL3JlcXVlc3Qtc3RvcmFnZS1hY2Nlc3Mtc2FtZS1vcmlnaW4taWZyYW1lLmh0bWwgWyBQYXNz IF0KIGh0dHAvdGVzdHMvc3RvcmFnZUFjY2Vzcy9yZXF1ZXN0LXN0b3JhZ2UtYWNjZXNzLXNhbWUt b3JpZ2luLXNhbmRib3hlZC1pZnJhbWUtd2l0aG91dC1hbGxvdy10b2tlbi5odG1sIFsgUGFzcyBd CiBodHRwL3Rlc3RzL3N0b3JhZ2VBY2Nlc3MvcmVxdWVzdC1zdG9yYWdlLWFjY2Vzcy1zYW1lLW9y aWdpbi1zYW5kYm94ZWQtaWZyYW1lLmh0bWwgWyBQYXNzIF0KK2h0dHAvdGVzdHMvc3RvcmFnZUFj Y2Vzcy9yZXF1ZXN0LWFuZC1ncmFudC1zdG9yYWdlLWFjY2Vzcy1jcm9zcy1vcmlnaW4tc2FuZGJv eGVkLW5lc3RlZC1pZnJhbWUuaHRtbCBbIFBhc3MgXQogCiB3ZWJraXQub3JnL2IvMTczODYxIFsg UmVsZWFzZSBdIGh0dHAvdGVzdHMvd2VicnRjL2ZpbHRlcmluZy1pY2UtY2FuZGlkYXRlLXNhbWUt b3JpZ2luLWZyYW1lLmh0bWwgWyBQYXNzIFRpbWVvdXQgXQogd2Via2l0Lm9yZy9iLzE3Mzg2MSBb IFJlbGVhc2UgXSBodHRwL3Rlc3RzL3dlYnJ0Yy9maWx0ZXJpbmctaWNlLWNhbmRpZGF0ZS1jcm9z cy1vcmlnaW4tZnJhbWUuaHRtbCBbIFBhc3MgVGltZW91dCBdCg==