Implemented: remove browsing context name on cross origin navigation

When updating the history after a cross-origin navigation, the HTML Standard says: "If the browsing context is a top-level browsing context, but not an auxiliary browsing context, then set the browsing context's name to the empty string." Currently we are not doing this which means there's potential information leak. Spec: https://html.spec.whatwg.org/multipage/browsers.html#resetBCName I2I: https://groups.google.com/a/chromium.org/d/msg/blink-dev/fhUIycdlINU/RLVEOKaNAwAJ Webkit change: https://trac.webkit.org/changeset/209076/webkit Bug: crbug.com/706350 Change-Id: I70cb3efcef06a3442ed4bf9ddd3733e24ccde19d Reviewed-on: https://chromium-review.googlesource.com/645309 Commit-Queue: Andy Paicu <andypaicu@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Cr-Commit-Position: refs/heads/master@{#506708}
jakearchibald · Nov 16, 2017 · 933db30 · 933db30
1 parent 78ee59a
commit 933db30
Show file tree

Hide file tree

Showing 8 changed files with 130 additions and 0 deletions.
diff --git a/security/support/window-name-navigation.sub.html b/security/support/window-name-navigation.sub.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+    <script>
+        var url = new URL(window.location.href);
+        url.hostname = "{{GET[hostname]}}";
+        url.pathname = "/security/support/window-name-test.sub.html";
+        url.search = "shouldhavename={{GET[shouldhavename]}}&sendmessage={{GET[sendmessage]}}";
+        window.name = "test";
+        document.location = url.href;
+    </script>
+</html>
diff --git a/security/support/window-name-test.sub.html b/security/support/window-name-test.sub.html
@@ -0,0 +1,23 @@
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script>
+  function process_test_result(passed, test_name) {
+    if ({{GET[sendmessage]}}) {
+      if (window.opener) {
+        window.opener.postMessage(passed, "*");
+      } else {
+        parent.postMessage(passed, "*");
+      }
+    } else {
+      test(function(t) {
+        assert_equals(passed, true);
+      }, test_name);
+    }
+  }
+
+  if ({{GET[shouldhavename]}}) {
+    process_test_result(window.name == "test", "Test that window name is present");
+  } else {
+    process_test_result(window.name == "", "Test that window name is not present");
+  }
+</script>
diff --git a/security/window-name-after-cross-origin-aux-frame-navigation.sub.html b/security/window-name-after-cross-origin-aux-frame-navigation.sub.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <!-- window.name should equal "test" after a cross-origin auxiliary frame navigation. -->
+    <script src='/resources/testharness.js'></script>
+    <script src='/resources/testharnessreport.js'></script>
+</head>
+<body>
+    <script>
+        t = async_test("Test that the window name is correct");
+        window.addEventListener("message", t.step_func_done(function(e) {
+            assert_equals(e.data, true);
+        }));
+        window.open("support/window-name-navigation.sub.html?hostname={{domains[www1]}}&shouldhavename=true&sendmessage=true");
+    </script>
+</body>
+</html>
diff --git a/security/window-name-after-cross-origin-main-frame-navigation.sub.html b/security/window-name-after-cross-origin-main-frame-navigation.sub.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <!-- window.name should equal "" after a cross-origin main frame navigation. -->
+    <script src='/resources/testharness.js'></script>
+    <script src='/resources/testharnessreport.js'></script>
+</head>
+<body>
+    <script>
+        document.location = "support/window-name-navigation.sub.html?hostname={{domains[www1]}}&shouldhavename=false&sendmessage=false";
+    </script>
+</body>
+</html>
diff --git a/security/window-name-after-cross-origin-sub-frame-navigation.sub.html b/security/window-name-after-cross-origin-sub-frame-navigation.sub.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <!-- window.name should equal "test" after a cross-origin sub frame navigation. -->
+    <script src='/resources/testharness.js'></script>
+    <script src='/resources/testharnessreport.js'></script>
+</head>
+<body>
+    <script>
+        t = async_test("Test that the window name is correct");
+        window.addEventListener("message", t.step_func_done(function(e) {
+            assert_equals(e.data, true);
+        }));
+    </script>
+    <iframe src="support/window-name-navigation.sub.html?hostname={{domains[www1]}}&shouldhavename=true&sendmessage=true";
+    </iframe>
+</body>
+</html>
diff --git a/security/window-name-after-same-origin-aux-frame-navigation.sub.html b/security/window-name-after-same-origin-aux-frame-navigation.sub.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <!-- window.name should equal "test" after a same-origin auxiliary frame navigation. -->
+    <script src='/resources/testharness.js'></script>
+    <script src='/resources/testharnessreport.js'></script>
+</head>
+<body>
+    <script>
+        t = async_test("Test that the window name is correct");
+        window.addEventListener("message", t.step_func_done(function(e) {
+            assert_equals(e.data, true);
+        }));
+        window.open("support/window-name-navigation.sub.html?hostname={{host}}&shouldhavename=true&sendmessage=true");
+    </script>
+</body>
+</html>
diff --git a/security/window-name-after-same-origin-main-frame-navigation.sub.html b/security/window-name-after-same-origin-main-frame-navigation.sub.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <!-- window.name should equal "test" after a same-origin main frame navigation. -->
+    <script src='/resources/testharness.js'></script>
+    <script src='/resources/testharnessreport.js'></script>
+</head>
+<body>
+    <script>
+        document.location = "support/window-name-navigation.sub.html?hostname={{host}}&shouldhavename=true&sendmessage=false";
+    </script>
+</body>
+</html>
diff --git a/security/window-name-after-same-origin-sub-frame-navigation.sub.html b/security/window-name-after-same-origin-sub-frame-navigation.sub.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <!-- window.name should equal "test" after a same-origin sub frame navigation. -->
+    <script src='/resources/testharness.js'></script>
+    <script src='/resources/testharnessreport.js'></script>
+</head>
+<body>
+    <script>
+        t = async_test("Test that the window name is correct");
+        window.addEventListener("message", t.step_func_done(function(e) {
+            assert_equals(e.data, true);
+        }));
+    </script>
+    <iframe src="support/window-name-navigation.sub.html?hostname={{host}}&shouldhavename=true&sendmessage=true";
+    </iframe>
+</body>
+</html>