Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(771)

Issue 19883004: Reland 154747 "Throw exceptions on all failed cross-origin acces..." (Closed)

Created:
7 years, 5 months ago by Mike West
Modified:
7 years, 5 months ago
Reviewers:
haraken
CC:
blink-reviews, Nils Barth (inactive), kojih, jsbell+bindings_chromium.org, eae+blinkwatch, abarth-chromium, marja+watch_chromium.org, dglazkov+blink, adamk+blink_chromium.org, mkwst+watchlist_chromium.org, haraken, Nate Chapin, do-not-use
Visibility:
Public.

Description

Reland 154747 "Throw exceptions on all failed cross-origin acces..." > Throw exceptions on all failed cross-origin access checks. > > Rather than special-casing access to Location properties[1], we should > allow developers to safely swallow cross-origin access check failures > by > throwing an exception upon access to potentially interesting > properties. > > For example, Firefox currently throws exceptions for cross-origin > access > such as `window.parent.NaN` and `window.parent.history`. This patch > matches that behavior by throwing on access to Window properties and > the > History object. > > [1]: http://src.chromium.org/viewvc/blink?view=rev&rev=154564 > > BUG=17325, 237080 > R=abarth@chromium.org > > Review URL: https://chromiumcodereview.appspot.com/19932002 Relanding this CL after fixing the single Chromium test that it broke in https://codereview.chromium.org/19783003/. TBR=haraken@chromium.org Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=154770

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+318 lines, -726 lines) Patch
M LayoutTests/fast/frames/sandboxed-iframe-history-denied.html View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt View 1 chunk +2 lines, -2 lines 0 comments Download
M LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/history/cross-origin-replace-history-object-child.html View 1 chunk +10 lines, -3 lines 0 comments Download
M LayoutTests/http/tests/history/cross-origin-replace-history-object-child-expected.txt View 1 chunk +2 lines, -4 lines 0 comments Download
M LayoutTests/http/tests/history/cross-origin-replace-history-object-expected.txt View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/history/resources/cross-origin-replaces-history-object-iframe.html View 1 chunk +5 lines, -1 line 0 comments Download
M LayoutTests/http/tests/plugins/cross-frame-object-access-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/plugins/resources/cross-frame-object-access.html View 1 chunk +8 lines, -4 lines 0 comments Download
M LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write.html View 3 chunks +4 lines, -4 lines 0 comments Download
M LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html View 1 chunk +4 lines, -3 lines 0 comments Download
M LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-child-explicit-domain-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt View 1 chunk +0 lines, -18 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-delete.html View 1 chunk +2 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-delete-expected.txt View 1 chunk +2 lines, -4 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-document-direct-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-enumeration.html View 2 chunks +15 lines, -10 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt View 2 chunks +0 lines, -4 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-first-time-expected.txt View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-get-custom-property-cached.html View 1 chunk +10 lines, -5 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-get-custom-property-cached-expected.txt View 1 chunk +3 lines, -6 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-get-expected.txt View 1 chunk +0 lines, -187 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html View 1 chunk +1 line, -6 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt View 2 chunks +1 line, -138 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-name-getter-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-object-getPrototypeOf.html View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-object-getPrototypeOf-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-object-prototype.html View 1 chunk +3 lines, -4 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-object-prototype-expected.txt View 1 chunk +5 lines, -8 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-parent-explicit-domain-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-port-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-protocol-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-protocol-explicit-domain-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-put-expected.txt View 2 chunks +186 lines, -186 lines 0 comments Download
M LayoutTests/http/tests/security/cross-frame-access-selection-expected.txt View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-subframe-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-window-open-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-uppercase-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-window-open-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/inactive-document-with-empty-security-origin.html View 1 chunk +5 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/inactive-document-with-empty-security-origin-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-subframe-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-window-open-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/listener/xss-inactive-closure-expected.txt View 1 chunk +2 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/listener/xss-window-onclick-shortcut-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/resources/cross-frame-access.js View 1 chunk +11 lines, -0 lines 0 comments Download
M LayoutTests/http/tests/security/sandboxed-iframe-modify-self-expected.txt View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/sandboxed-iframe-origin-add-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/sandboxed-iframe-origin-remove-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/srcdoc-in-sandbox-cannot-access-parent-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/svg-image-leak-expected.txt View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/window-named-proto-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt View 1 chunk +0 lines, -18 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-frame-name-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto.html View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-invalid-domain-change-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt View 1 chunk +0 lines, -2 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-sandboxed-iframe-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-synchronous-form-expected.txt View 1 chunk +0 lines, -1 line 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-window-index-assign.html View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-window-index-assign-expected.txt View 1 chunk +2 lines, -6 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-window-name-navigator-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml View 1 chunk +7 lines, -3 lines 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/xss-DENIED-xsl-external-entity-redirect-expected.txt View 1 chunk +4 lines, -0 lines 0 comments Download
M LayoutTests/http/tests/security/xss-eval.html View 1 chunk +1 line, -1 line 0 comments Download
M LayoutTests/http/tests/security/xss-eval-expected.txt View 1 chunk +1 line, -2 lines 0 comments Download
M Source/bindings/v8/V8Initializer.cpp View 1 chunk +1 line, -6 lines 0 comments Download

Messages

Total messages: 3 (0 generated)
Mike West
Kentaro-san, would you mind rubber-stamping this reland? I'll push it into the CQ once https://codereview.chromium.org/19783003/ ...
7 years, 5 months ago (2013-07-23 13:31:38 UTC) #1
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-status.appspot.com/cq/mkwst@chromium.org/19883004/1
7 years, 5 months ago (2013-07-23 18:09:31 UTC) #2
commit-bot: I haz the power
7 years, 5 months ago (2013-07-23 18:14:54 UTC) #3
Message was sent while issue was closed.
Change committed as 154770

Powered by Google App Engine
This is Rietveld 408576698