Bug 14692 – Cross frame scripting allowed by Webkit in layout test

• Component: New Bugs
• Status: RESOLVED WORKSFORME

[Sridhar Gurivireddy]

The layout test exposes that webkit allows cross-frame scripting fast\events\keypress-focus-change.html

Other browsers on windows do not allow this, probably for security reasons.

[David Kilzer (:ddkilzer)]

Please note that the layoutTestController and eventSender objects used in the test case are only available through the DumpRenderTree testing harness.

When the test is loaded in the browser via file:/// URL, you must perform the test manually by clicking in the lower-left text field, then typing at least two characters.  The first character should appear in the text field you clicked in, then subsequent text should appear in the text field within the iframe.

This works in Firefox 2.0.0.4 (no errors) and ToT WebKit.  This does not work in Opera 9.21, though.

I don't believe being able to set focus to an element in a child iframe from the parent page is considered a security issue.

[Sridhar Gurivireddy]

Created attachment 15854 [details]
XSS Cookie demo

Please find an example of HTML to read cookie of google.com. This HTML can be on any domain.

[David Kilzer (:ddkilzer)]

(In reply to comment #2)
> Created an attachment (id=15854) [edit]
> XSS Cookie demo
> 
> Please find an example of HTML to read cookie of google.com. This HTML can be
> on any domain.

Using this demo, I get three errors (as expected?) using both Safari 2.0.4 (419.3) and Safari 3 Public Beta v. 3.0.3 (522.12.1) on Mac OS X 10.4.10 (8R218):

Unsafe JavaScript attempt to access frame with URL http://bugs.webkit.org/attachment.cgi?id=15854&action=view from frame with URL http://www.yahoo.com/. Domains must match.
Unsafe JavaScript attempt to access frame with URL http://www.yahoo.com/ from frame with URL http://bugs.webkit.org/attachment.cgi?id=15854&action=view. Domains must match.
[6346] http://bugs.webkit.org/attachment.cgi?id=15854&action=view:TypeError - Undefined value
Unsafe JavaScript attempt to access frame with URL http://bugs.webkit.org/attachment.cgi?id=15854&action=view from frame with URL http://www.yahoo.com/. Domains must match.

I get the same errors when the xss_cookie.html file is saved locally and opened.