Title: [288078] trunk
- Revision
- 288078
- Author
- beid...@apple.com
- Date
- 2022-01-16 19:35:16 -0800 (Sun, 16 Jan 2022)
Log Message
database names leak cross-origin within the same browser session
https://bugs.webkit.org/show_bug.cgi?id=233548
Reviewed by Geoff Garen.
Source/WebCore:
Test: http/tests/security/getdatabases-crossorigin.html
* Modules/indexeddb/server/IDBServer.cpp:
(WebCore::IDBServer::IDBServer::getAllDatabaseNamesAndVersions): When iterating the set of all open
UniqueIDBDatabases, only add them to the results list if their origins match.
* page/ClientOrigin.h:
(WebCore::ClientOrigin::operator!= const):
LayoutTests:
* http/tests/security/getdatabases-crossorigin-expected.txt: Added.
* http/tests/security/getdatabases-crossorigin.html: Added.
* http/tests/security/resources/getdatabases-otherframe.html: Added.
* http/tests/security/resources/getdatabases-otherwindow.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (288077 => 288078)
--- trunk/LayoutTests/ChangeLog 2022-01-17 01:04:56 UTC (rev 288077)
+++ trunk/LayoutTests/ChangeLog 2022-01-17 03:35:16 UTC (rev 288078)
@@ -1,3 +1,15 @@
+2022-01-16 Brady Eidson <beid...@apple.com>
+
+ database names leak cross-origin within the same browser session
+ https://bugs.webkit.org/show_bug.cgi?id=233548
+
+ Reviewed by Geoff Garen.
+
+ * http/tests/security/getdatabases-crossorigin-expected.txt: Added.
+ * http/tests/security/getdatabases-crossorigin.html: Added.
+ * http/tests/security/resources/getdatabases-otherframe.html: Added.
+ * http/tests/security/resources/getdatabases-otherwindow.html: Added.
+
2022-01-16 Fujii Hironori <hironori.fu...@sony.com>
[WinCairo] Unreviewed test gardening
Added: trunk/LayoutTests/http/tests/security/getdatabases-crossorigin-expected.txt (0 => 288078)
--- trunk/LayoutTests/http/tests/security/getdatabases-crossorigin-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/getdatabases-crossorigin-expected.txt 2022-01-17 03:35:16 UTC (rev 288078)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: Message received from other context
+CONSOLE MESSAGE: Message received from other context
+CONSOLE MESSAGE: PASS
+
Added: trunk/LayoutTests/http/tests/security/getdatabases-crossorigin.html (0 => 288078)
--- trunk/LayoutTests/http/tests/security/getdatabases-crossorigin.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/getdatabases-crossorigin.html 2022-01-17 03:35:16 UTC (rev 288078)
@@ -0,0 +1,43 @@
+<!-- webkit-test-runner [ _javascript_CanOpenWindowsAutomatically=true ] -->
+<html>
+<head>
+<script>
+
+if (window.location.hostname == "localhost")
+ console.log("FAIL: Must be run as 127.0.0.1, not localhost");
+
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+var messagesReceived = 0;
+
+window._onmessage_ = function(event) {
+ console.log("Message received from other context")
+
+ if (++messagesReceived < 2)
+ return;
+
+ indexedDB.databases().then((result) => {
+ databases = result;
+ if (databases.length != 0)
+ console.log("FAIL: There are " + databases.length + " database(s) when there should be 0");
+ else
+ console.log("PASS");
+ if (testRunner)
+ testRunner.notifyDone();
+ });
+};
+
+function openOtherWindow()
+{
+ window.open("http://localhost:8000/security/resources/getdatabases-otherwindow.html")
+}
+
+</script>
+</head>
+<body _onload_="openOtherWindow()">
+<iframe src=""
+</body>
+</html>
\ No newline at end of file
Added: trunk/LayoutTests/http/tests/security/resources/getdatabases-otherframe.html (0 => 288078)
--- trunk/LayoutTests/http/tests/security/resources/getdatabases-otherframe.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/getdatabases-otherframe.html 2022-01-17 03:35:16 UTC (rev 288078)
@@ -0,0 +1,9 @@
+<head>
+<script>
+indexedDB.deleteDatabase('getdatabase-otherframe')._onsuccess_ = () => {
+ indexedDB.open('getdatabase-otherframe')._onsuccess_ = () => {
+ window.parent.postMessage("Hi there!", "*");
+ }
+}
+</script>
+</head>
Added: trunk/LayoutTests/http/tests/security/resources/getdatabases-otherwindow.html (0 => 288078)
--- trunk/LayoutTests/http/tests/security/resources/getdatabases-otherwindow.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/getdatabases-otherwindow.html 2022-01-17 03:35:16 UTC (rev 288078)
@@ -0,0 +1,9 @@
+<head>
+<script>
+indexedDB.deleteDatabase('getdatabase-otherwindow')._onsuccess_ = () => {
+ indexedDB.open('getdatabase-otherwindow')._onsuccess_ = () => {
+ window.opener.postMessage("Hi there!", "*");
+ }
+}
+</script>
+</head>
Modified: trunk/Source/WebCore/ChangeLog (288077 => 288078)
--- trunk/Source/WebCore/ChangeLog 2022-01-17 01:04:56 UTC (rev 288077)
+++ trunk/Source/WebCore/ChangeLog 2022-01-17 03:35:16 UTC (rev 288078)
@@ -1,3 +1,19 @@
+2022-01-16 Brady Eidson <beid...@apple.com>
+
+ database names leak cross-origin within the same browser session
+ https://bugs.webkit.org/show_bug.cgi?id=233548
+
+ Reviewed by Geoff Garen.
+
+ Test: http/tests/security/getdatabases-crossorigin.html
+
+ * Modules/indexeddb/server/IDBServer.cpp:
+ (WebCore::IDBServer::IDBServer::getAllDatabaseNamesAndVersions): When iterating the set of all open
+ UniqueIDBDatabases, only add them to the results list if their origins match.
+
+ * page/ClientOrigin.h:
+ (WebCore::ClientOrigin::operator!= const):
+
2022-01-16 Myles C. Maxfield <mmaxfi...@apple.com>
[Win] Use character names instead of codepoint values in overrideControlCharacters()
Modified: trunk/Source/WebCore/Modules/indexeddb/server/IDBServer.cpp (288077 => 288078)
--- trunk/Source/WebCore/Modules/indexeddb/server/IDBServer.cpp 2022-01-17 01:04:56 UTC (rev 288077)
+++ trunk/Source/WebCore/Modules/indexeddb/server/IDBServer.cpp 2022-01-17 03:35:16 UTC (rev 288078)
@@ -530,6 +530,9 @@
HashSet<String> visitedDatabasePaths;
for (auto& database : m_uniqueIDBDatabaseMap.values()) {
+ if (database->identifier().origin() != origin)
+ continue;
+
auto path = database->filePath();
if (!path.isEmpty())
visitedDatabasePaths.add(path);
Modified: trunk/Source/WebCore/page/ClientOrigin.h (288077 => 288078)
--- trunk/Source/WebCore/page/ClientOrigin.h 2022-01-17 01:04:56 UTC (rev 288077)
+++ trunk/Source/WebCore/page/ClientOrigin.h 2022-01-17 03:35:16 UTC (rev 288078)
@@ -37,6 +37,7 @@
unsigned hash() const;
bool operator==(const ClientOrigin&) const;
+ bool operator!=(const ClientOrigin& other) const { return !(*this == other); }
template<class Encoder> void encode(Encoder&) const;
template<class Decoder> static std::optional<ClientOrigin> decode(Decoder&);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
