42817 2010-07-22 04:47:34 -0700 Web Inspector: don't grant universal access to inspector front-end page 2010-07-22 09:39:54 -0700 1 1 1 Unclassified WebKit Web Inspector (Deprecated) 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 caseq webkit-unassigned bweinstein commit-queue joepeck keishi pfeldman pmuellr rik timothy yurys oldest_to_newest 254730 0 caseq 2010-07-22 04:47:34 -0700 We used to call SecurityOrigin::grantUniversalAccess() for inspector front-end page. This does not seem to be necessary anymore, so I suggest to remove it for slightly tighter security control. 254731 1 62286 caseq 2010-07-22 04:50:54 -0700 Created attachment 62286 patch 254740 2 62286 yurys 2010-07-22 05:39:07 -0700 Comment on attachment 62286 patch WebKit/chromium/src/WebDevToolsFrontendImpl.cpp:  + SecurityOrigin* origin = m_webViewImpl->page()->mainFrame()->domWindow()->securityOrigin(); IIRC we needed this to be able to set iframe content. It shouldn't be necessary with new SourceFrame implementation. 254849 3 62286 commit-queue 2010-07-22 09:39:49 -0700 Comment on attachment 62286 patch Clearing flags on attachment: 62286 Committed r63896: <http://trac.webkit.org/changeset/63896> 254851 4 commit-queue 2010-07-22 09:39:54 -0700 All reviewed patches have been landed. Closing bug. 62286 2010-07-22 04:50:54 -0700 2010-07-22 09:39:49 -0700 patch no-universal-access text/plain 2781 caseq SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA2Mzg4MSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTMgQEAKKzIwMTAtMDctMjIgIEFuZHJleSBLb3N5YWtvdiAgPGNhc2VxQGNocm9t aXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICBXZWIgSW5zcGVjdG9yOiBTdG9wIGdyYW50aW5nIHVuaXZlcnNhbCBhY2Nlc3MgdG8gaW5zcGVj dG9yIGZyb250LWVuZCBwYWdlLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9NDI4MTcKKworICAgICAgICAqIGluc3BlY3Rvci9JbnNwZWN0b3JGcm9udGVu ZENsaWVudExvY2FsLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6Okluc3BlY3RvckZyb250ZW5kQ2xp ZW50TG9jYWw6OndpbmRvd09iamVjdENsZWFyZWQpOgorCiAyMDEwLTA3LTIyICBLZW50IFRhbXVy YSAgPHRrZW50QGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBEYXJpbiBBZGxl ci4KSW5kZXg6IFdlYkNvcmUvaW5zcGVjdG9yL0luc3BlY3RvckZyb250ZW5kQ2xpZW50TG9jYWwu Y3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvaW5zcGVjdG9yL0luc3BlY3RvckZyb250ZW5kQ2xp ZW50TG9jYWwuY3BwCShyZXZpc2lvbiA2Mzg4MSkKKysrIFdlYkNvcmUvaW5zcGVjdG9yL0luc3Bl Y3RvckZyb250ZW5kQ2xpZW50TG9jYWwuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03MCw4ICs3MCw2 IEBAIEluc3BlY3RvckZyb250ZW5kQ2xpZW50TG9jYWw6On5JbnNwZWN0b3IKICAgICAKIHZvaWQg SW5zcGVjdG9yRnJvbnRlbmRDbGllbnRMb2NhbDo6d2luZG93T2JqZWN0Q2xlYXJlZCgpCiB7Ci0g ICAgLy8gR3JhbnQgdGhlIGluc3BlY3RvciB0aGUgYWJpbGl0eSB0byBzY3JpcHQgdGhlIGluc3Bl Y3RlZCBwYWdlLgotICAgIG1fZnJvbnRlbmRQYWdlLT5tYWluRnJhbWUoKS0+ZG9jdW1lbnQoKS0+ c2VjdXJpdHlPcmlnaW4oKS0+Z3JhbnRVbml2ZXJzYWxBY2Nlc3MoKTsKICAgICAvLyBGSVhNRTog ZG9uJ3Qga2VlcCByZWZlcmVuY2UgdG8gdGhlIHNjcmlwdCBzdGF0ZQogICAgIG1fZnJvbnRlbmRT Y3JpcHRTdGF0ZSA9IHNjcmlwdFN0YXRlRnJvbVBhZ2UoZGVidWdnZXJXb3JsZCgpLCBtX2Zyb250 ZW5kUGFnZSk7CiAgICAgU2NyaXB0R2xvYmFsT2JqZWN0OjpzZXQobV9mcm9udGVuZFNjcmlwdFN0 YXRlLCAiSW5zcGVjdG9yQmFja2VuZCIsIG1faW5zcGVjdG9yQ29udHJvbGxlci0+aW5zcGVjdG9y QmFja2VuZCgpKTsKSW5kZXg6IFdlYktpdC9jaHJvbWl1bS9DaGFuZ2VMb2cKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gV2ViS2l0L2Nocm9taXVtL0NoYW5nZUxvZwkocmV2aXNpb24gNjM4ODEpCisrKyBXZWJLaXQv Y2hyb21pdW0vQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTAt MDctMjIgIEFuZHJleSBLb3N5YWtvdiAgPGNhc2VxQGNocm9taXVtLm9yZz4KKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXZWIgSW5zcGVjdG9yOiBTdG9w IGdyYW50aW5nIHVuaXZlcnNhbCBhY2Nlc3MgdG8gaW5zcGVjdG9yIGZyb250LWVuZCBwYWdlLgor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDI4MTcKKwor ICAgICAgICAqIHNyYy9XZWJEZXZUb29sc0Zyb250ZW5kSW1wbC5jcHA6CisgICAgICAgIChXZWJL aXQ6OldlYkRldlRvb2xzRnJvbnRlbmRJbXBsOjpmcm9udGVuZExvYWRlZCk6CisKIDIwMTAtMDct MjEgIEtlbnQgVGFtdXJhICA8dGtlbnRAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2Vk IGJ5IERpbWl0cmkgR2xhemtvdi4KSW5kZXg6IFdlYktpdC9jaHJvbWl1bS9zcmMvV2ViRGV2VG9v bHNGcm9udGVuZEltcGwuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYktpdC9jaHJvbWl1bS9zcmMvV2Vi RGV2VG9vbHNGcm9udGVuZEltcGwuY3BwCShyZXZpc2lvbiA2Mzg4MSkKKysrIFdlYktpdC9jaHJv bWl1bS9zcmMvV2ViRGV2VG9vbHNGcm9udGVuZEltcGwuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0x NTAsMTAgKzE1MCw2IEBAIHZvaWQgV2ViRGV2VG9vbHNGcm9udGVuZEltcGw6OmZyb250ZW5kTG8K IHsKICAgICBtX2xvYWRlZCA9IHRydWU7CiAKLSAgICAvLyBHcmFudCB0aGUgZGV2dG9vbHMgcGFn ZSB0aGUgYWJpbGl0eSB0byBoYXZlIHNvdXJjZSB2aWV3IGlmcmFtZXMuCi0gICAgU2VjdXJpdHlP cmlnaW4qIG9yaWdpbiA9IG1fd2ViVmlld0ltcGwtPnBhZ2UoKS0+bWFpbkZyYW1lKCktPmRvbVdp bmRvdygpLT5zZWN1cml0eU9yaWdpbigpOwotICAgIG9yaWdpbi0+Z3JhbnRVbml2ZXJzYWxBY2Nl c3MoKTsKLQogICAgIGZvciAoVmVjdG9yPFZlY3RvcjxTdHJpbmc+ID46Oml0ZXJhdG9yIGl0ID0g bV9wZW5kaW5nSW5jb21pbmdNZXNzYWdlcy5iZWdpbigpOwogICAgICAgICAgaXQgIT0gbV9wZW5k aW5nSW5jb21pbmdNZXNzYWdlcy5lbmQoKTsKICAgICAgICAgICsraXQpIHsK