Bug 120266 – No need for isURLAllowed function in Frame

• Status: RESOLVED
• Resolution: FIXED
• Component: Page Loading

[Darin Adler]

No need for isURLAllowed function in Frame

[Darin Adler]

Created attachment 209578 [details]
Patch

[Build Bot]

Comment on attachment 209578 [details]
Patch

Attachment 209578 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/1555802

New failing tests:
http/tests/security/xss-DENIED-object-element.html

[Build Bot]

Created attachment 209583 [details]
Archive of layout-test-results from webkit-ews-07 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-07  Port: mac-mountainlion  Platform: Mac OS X 10.8.4

[Andreas Kling]

Comment on attachment 209578 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=209578&action=review

> Source/WebCore/html/HTMLPlugInImageElement.cpp:-175
> -    if (contentFrame() && protocolIsJavaScript(completeURL)
> -        && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))
> -        return false;

I suppose this check is not equivalent to the new, shared one.

[Build Bot]

Comment on attachment 209578 [details]
Patch

Attachment 209578 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/1561485

New failing tests:
http/tests/security/xss-DENIED-object-element.html

[Build Bot]

Created attachment 209586 [details]
Archive of layout-test-results from webkit-ews-04 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-04  Port: mac-mountainlion  Platform: Mac OS X 10.8.4

[Build Bot]

Comment on attachment 209578 [details]
Patch

Attachment 209578 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/1542917

New failing tests:
http/tests/security/xss-DENIED-object-element.html

[Build Bot]

Created attachment 209594 [details]
Archive of layout-test-results from webkit-ews-11 for mac-mountainlion-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: webkit-ews-11  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.4

[Darin Adler]

Created attachment 373203 [details]
Patch

[Darin Adler]

The new patch should not have the mistake from the one I posted about 6 years ago.

[Darin Adler]

Since EWS is all green, adding some possible reviewers to the cc list.

[Darin Adler]

I chose the names that start with "can" to match the style of existing functions, including the ones in SecurityOrigin. I also consider names that start with "may" and various other wording. I’m open to suggestions for other naming schemes.

[Alex Christensen]

Comment on attachment 373203 [details]
Patch

This looks like it's full of subtle changes.  Could we hold off on this and land it at a better time in our release cycle?  It's been waiting 6 years, what's a few more weeks?

[Darin Adler]

(In reply to Alex Christensen from comment #13)
> This looks like it's full of subtle changes.  Could we hold off on this and
> land it at a better time in our release cycle?  It's been waiting 6 years,
> what's a few more weeks?

Yes, sure, reviewing this and landing this could wait a few more weeks, months, or even years.

[Darin Adler]

I guess it would be best to review and land this soon after Apple makes the internal major release branches, which is weeks or months away.

[Alex Christensen]

Comment on attachment 373203 [details]
Patch

Let's do this

[WebKit Commit Bot]

Comment on attachment 373203 [details]
Patch

Clearing flags on attachment: 373203

Committed r247529: <https://trac.webkit.org/changeset/247529>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/53216964>