Diff
Modified: trunk/LayoutTests/ChangeLog (106981 => 106982)
--- trunk/LayoutTests/ChangeLog 2012-02-07 21:24:53 UTC (rev 106981)
+++ trunk/LayoutTests/ChangeLog 2012-02-07 21:37:17 UTC (rev 106982)
@@ -1,3 +1,16 @@
+2012-02-07 Brady Eidson <beid...@apple.com>
+
+ <rdar://problem/9567286> and https://bugs.webkit.org/show_bug.cgi?id=78003
+ WebKit associates credentials with the wrong site if the authentication challenge takes place after a redirect chain
+
+ Reviewed by Alexey Proskuryakov.
+
+ * http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials-expected.txt: Added.
+ * http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials.html: Added.
+ * http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-1-redirect-to-auth.php: Added.
+ * http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-2-auth-then-redirect-to-finish.php: Added.
+ * http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-3-output-credentials-then-finish.php: Added.
+
2012-02-07 Julien Chaffraix <jchaffr...@webkit.org>
Revert r106958.
Added: trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials-expected.txt (0 => 106982)
--- trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials-expected.txt 2012-02-07 21:37:17 UTC (rev 106982)
@@ -0,0 +1,30 @@
+main frame - didStartProvisionalLoadForFrame
+main frame - didCommitLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didStartProvisionalLoadForFrame
+main frame - didFinishDocumentLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didReceiveServerRedirectForProvisionalLoadForFrame
+<unknown> - didReceiveAuthenticationChallenge - Responding with httpUsername:httpPassword
+frame "<!--framePath //<!--frame0-->-->" - didCommitLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didFinishDocumentLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didHandleOnloadEventsForFrame
+main frame - didHandleOnloadEventsForFrame
+frame "<!--framePath //<!--frame0-->-->" - didFinishLoadForFrame
+main frame - didFinishLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - willPerformClientRedirectToURL: http://localhost:8000/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-3-output-credentials-then-finish.php
+frame "<!--framePath //<!--frame0-->-->" - didStartProvisionalLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didCancelClientRedirectForFrame
+frame "<!--framePath //<!--frame0-->-->" - didCommitLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didFinishDocumentLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didHandleOnloadEventsForFrame
+frame "<!--framePath //<!--frame0-->-->" - didFinishLoadForFrame
+This test causes an HTTP authentication challenge in the middle of a redirect chain.
+It then loads a new page after that challenge, and the new page should *not* get any credentials passed to it.
+See bug 78003 for more details.
+
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+No HTTP authentication credentials
+
Added: trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials.html (0 => 106982)
--- trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials.html (rev 0)
+++ trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials.html 2012-02-07 21:37:17 UTC (rev 106982)
@@ -0,0 +1,20 @@
+<html>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.dumpChildFramesAsText();
+ layoutTestController.waitUntilDone();
+ layoutTestController.setHandlesAuthenticationChallenges(true);
+ layoutTestController.setAuthenticationUsername("httpUsername");
+ layoutTestController.setAuthenticationPassword("httpPassword");
+}
+</script>
+
+<body>
+This test causes an HTTP authentication challenge in the middle of a redirect chain.<br>
+It then loads a new page after that challenge, and the new page should *not* get any credentials passed to it.<br>
+See <a href="" 78003</a> for more details.<br>
+<iframe src=""
+</iframe><br>
+</body>
+</html>
\ No newline at end of file
Added: trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-1-redirect-to-auth.php (0 => 106982)
--- trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-1-redirect-to-auth.php (rev 0)
+++ trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-1-redirect-to-auth.php 2012-02-07 21:37:17 UTC (rev 106982)
@@ -0,0 +1,6 @@
+<?php
+// This page was supposed to be loaded using a localhost URL.
+// That is important, and the next page has to be loaded using 127.0.0.1.
+header("Location: http://127.0.0.1:8000/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-2-auth-then-redirect-to-finish.php");
+exit;
+?>
\ No newline at end of file
Added: trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-2-auth-then-redirect-to-finish.php (0 => 106982)
--- trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-2-auth-then-redirect-to-finish.php (rev 0)
+++ trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-2-auth-then-redirect-to-finish.php 2012-02-07 21:37:17 UTC (rev 106982)
@@ -0,0 +1,13 @@
+<?php
+if (!isset($_SERVER['PHP_AUTH_USER'])) {
+ header('WWW-Authenticate: Basic');
+ header('HTTP/1.0 401 Unauthorized');
+ exit;
+}
+?>
+<script>
+// This page was supposed to be loaded using a 127.0.0.1 URL.
+// That is important, and the final page has to be loaded using localhost.
+// Plus, the redirect to the final page in this test has to be a new page load to trigger the bug; It cannot be an HTTP redirect.
+window.setTimeout("window.location = 'http://localhost:8000/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-3-output-credentials-then-finish.php';", 0);
+</script>
Added: trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-3-output-credentials-then-finish.php (0 => 106982)
--- trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-3-output-credentials-then-finish.php (rev 0)
+++ trunk/LayoutTests/http/tests/loading/authentication-after-redirect-stores-wrong-credentials/resources/wrong-credential-3-output-credentials-then-finish.php 2012-02-07 21:37:17 UTC (rev 106982)
@@ -0,0 +1,10 @@
+<?php
+if (!isset($_SERVER['PHP_AUTH_USER']))
+ echo "No HTTP authentication credentials<br>";
+else
+ echo "Authenticated as {$_SERVER['PHP_AUTH_USER']} with password {$_SERVER['PHP_AUTH_PW']}<br>";
+?>
+<script>
+if (window.layoutTestController)
+ layoutTestController.notifyDone();
+</script>
Modified: trunk/Source/WebCore/ChangeLog (106981 => 106982)
--- trunk/Source/WebCore/ChangeLog 2012-02-07 21:24:53 UTC (rev 106981)
+++ trunk/Source/WebCore/ChangeLog 2012-02-07 21:37:17 UTC (rev 106982)
@@ -1,3 +1,20 @@
+2012-02-07 Brady Eidson <beid...@apple.com>
+
+ <rdar://problem/9567286> and https://bugs.webkit.org/show_bug.cgi?id=78003
+ WebKit associates credentials with the wrong site if the authentication challenge takes place after a redirect chain
+
+ Reviewed by Alexey Proskuryakov.
+
+ Test: http/tests/loading/authentication-after-redirect-stores-wrong-credentials/authentication-after-redirect-stores-wrong-credentials.html
+
+ Associate the credential with the URL of the challenge itself, not the original request:
+ * platform/network/cf/ResourceHandleCFNet.cpp:
+ (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+ (WebCore::ResourceHandle::receivedCredential):
+ * platform/network/mac/ResourceHandleMac.mm:
+ (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+ (WebCore::ResourceHandle::receivedCredential):
+
2012-02-07 Tony Chang <t...@chromium.org>
move warning about css values and render style constants closer to where it applies
Modified: trunk/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp (106981 => 106982)
--- trunk/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp 2012-02-07 21:24:53 UTC (rev 106981)
+++ trunk/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp 2012-02-07 21:37:17 UTC (rev 106982)
@@ -604,7 +604,7 @@
KURL urlToStore;
if (challenge.failureResponse().httpStatusCode() == 401)
- urlToStore = firstRequest().url();
+ urlToStore = challenge.failureResponse().url();
CredentialStorage::set(core(credential.get()), challenge.protectionSpace(), urlToStore);
CFURLConnectionUseCredential(d->m_connection.get(), credential.get(), challenge.cfURLAuthChallengeRef());
@@ -628,7 +628,7 @@
ASSERT(credential.persistence() == CredentialPersistenceNone);
if (challenge.failureResponse().httpStatusCode() == 401) {
// Store the credential back, possibly adding it as a default for this directory.
- CredentialStorage::set(credential, challenge.protectionSpace(), firstRequest().url());
+ CredentialStorage::set(credential, challenge.protectionSpace(), challenge.failureResponse().url());
}
RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
@@ -675,7 +675,7 @@
KURL urlToStore;
if (challenge.failureResponse().httpStatusCode() == 401)
- urlToStore = firstRequest().url();
+ urlToStore = challenge.failureResponse().url();
CredentialStorage::set(webCredential, challenge.protectionSpace(), urlToStore);
CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
Modified: trunk/Source/WebCore/platform/network/mac/ResourceHandleMac.mm (106981 => 106982)
--- trunk/Source/WebCore/platform/network/mac/ResourceHandleMac.mm 2012-02-07 21:24:53 UTC (rev 106981)
+++ trunk/Source/WebCore/platform/network/mac/ResourceHandleMac.mm 2012-02-07 21:37:17 UTC (rev 106982)
@@ -562,7 +562,7 @@
ASSERT(credential.persistence() == CredentialPersistenceNone);
if (challenge.failureResponse().httpStatusCode() == 401) {
// Store the credential back, possibly adding it as a default for this directory.
- CredentialStorage::set(credential, challenge.protectionSpace(), firstRequest().url());
+ CredentialStorage::set(credential, challenge.protectionSpace(), challenge.failureResponse().url());
}
[challenge.sender() useCredential:mac(credential) forAuthenticationChallenge:mac(challenge)];
return;
@@ -620,7 +620,7 @@
Credential webCredential(credential, CredentialPersistenceNone);
KURL urlToStore;
if (challenge.failureResponse().httpStatusCode() == 401)
- urlToStore = firstRequest().url();
+ urlToStore = challenge.failureResponse().url();
CredentialStorage::set(webCredential, core([d->m_currentMacChallenge protectionSpace]), urlToStore);
[[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
} else
