84865 2012-04-25 07:59:43 -0700 SecurityOrigin::canDisplay() should return true when m_universalAccess is true 2012-06-20 13:24:23 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 yong.li.webkit webkit-unassigned abarth ap sam webkit.review.bot oldest_to_newest 609754 0 yong.li.webkit 2012-04-25 07:59:43 -0700 At the time m_universalAccess was invented, it was supposed to by-pass all security checks. http://trac.webkit.org/changeset/40449 2009-01-30 Adam Barth < abarth@webkit.org> Reviewed by Sam Weinig. Add a pref to disable web security. Then SecurityOrigin::canLoad() was added later with code moved from FrameLoader, and it doesn't respect m_universalAccess. The result is even m_universalAccess is on, there can still be some contents blocked by canLoad(). I think it makes sense that SecurityOrigin::canLoad() should also check m_universalAccess. 609880 1 yong.li.webkit 2012-04-25 10:29:54 -0700 Any objection? 611740 2 yong.li.webkit 2012-04-27 11:47:42 -0700 Actually I mean "canDisplay" 611760 3 139244 yong.li.webkit 2012-04-27 11:56:34 -0700 Created attachment 139244 the patch 653787 4 139244 yong.li.webkit 2012-06-20 12:48:13 -0700 Comment on attachment 139244 the patch Thanks! 653832 5 139244 webkit.review.bot 2012-06-20 13:24:07 -0700 Comment on attachment 139244 the patch Clearing flags on attachment: 139244 Committed r120855: <http://trac.webkit.org/changeset/120855> 653833 6 webkit.review.bot 2012-06-20 13:24:23 -0700 All reviewed patches have been landed. Closing bug. 139244 2012-04-27 11:56:34 -0700 2012-06-20 13:24:06 -0700 the patch 84865.patch text/plain 1489 yong.li.webkit ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCAwNWQzNjVmLi4xNGI1ZWQyIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjAg QEAKKzIwMTItMDQtMjcgIFlvbmcgTGkgIDx5b2xpQHJpbS5jb20+CisKKyAgICAgICAgU2VjdXJp dHlPcmlnaW46OmNhbkRpc3BsYXkoKSBzaG91bGQgcmV0dXJuIHRydWUgd2hlbiBtX3VuaXZlcnNh bEFjY2VzcyBpcyB0cnVlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD04NDg2NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIEFkZCBhbiBlYXJseSByZXR1cm4gKHRydWUpIGluIGNhbkRpc3BsYXkoKSBmb3IgaWYg KG1fdW5pdmVyc2FsQWNjZXNzKSwKKyAgICAgICAgYXMgd2UgZGlkIGZvciBjYW5BY2Nlc3MoKSBh bmQgY2FuUmVxdWVzdCgpLgorCisgICAgICAgIE5vIG5ldyB0ZXN0cy4gV2Ugc2hvdWxkIGJlIGdv b2QgYXMgbG9uZyBhcyB0aGlzIGNoYW5nZSBkb2Vzbid0IGJyZWFrIGV4aXN0aW5nCisgICAgICAg IHRlc3RzLCB3aGljaCBtZWFucyB0aGUgY29udGVudHMgc3VwcG9zZWQgdG8gYmUgYmxvY2tlZCBh cmUgc3RpbGwgYmxvY2tlZCB3aGVuCisgICAgICAgIG1fdW5pdmVyc2FsQWNjZXNzIGlzIGZhbHNl LgorCisgICAgICAgICogcGFnZS9TZWN1cml0eU9yaWdpbi5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpTZWN1cml0eU9yaWdpbjo6Y2FuRGlzcGxheSk6CisKIDIwMTItMDQtMjYgIEFsZXhhbmRlciBQ YXZsb3YgIDxhcGF2bG92QGNocm9taXVtLm9yZz4KIAogICAgICAgICBXZWIgSW5zcGVjdG9yOiBJ bXBsZW1lbnQgdGhlICJEaXNhYmxlIEphdmFTY3JpcHQiIG9wdGlvbiBpbiB0aGUgc2V0dGluZ3Mg ZGlhbG9nCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL1NlY3VyaXR5T3JpZ2luLmNw cCBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvU2VjdXJpdHlPcmlnaW4uY3BwCmluZGV4IGY1YThmOTIu LmY5NzY5ZWQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvU2VjdXJpdHlPcmlnaW4u Y3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvU2VjdXJpdHlPcmlnaW4uY3BwCkBAIC0zMzgs NiArMzM4LDkgQEAgc3RhdGljIGJvb2wgaXNGZWVkV2l0aE5lc3RlZFByb3RvY29sSW5IVFRQRmFt aWx5KGNvbnN0IEtVUkwmIHVybCkKIAogYm9vbCBTZWN1cml0eU9yaWdpbjo6Y2FuRGlzcGxheShj b25zdCBLVVJMJiB1cmwpIGNvbnN0CiB7CisgICAgaWYgKG1fdW5pdmVyc2FsQWNjZXNzKQorICAg ICAgICByZXR1cm4gdHJ1ZTsKKwogICAgIFN0cmluZyBwcm90b2NvbCA9IHVybC5wcm90b2NvbCgp Lmxvd2VyKCk7CiAKICAgICBpZiAoaXNGZWVkV2l0aE5lc3RlZFByb3RvY29sSW5IVFRQRmFtaWx5 KHVybCkpCg==