1 /*
2 * Copyright (C) 2007-2009 Google Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions are
6 * met:
7 *
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above
11 * copyright notice, this list of conditions and the following disclaimer
12 * in the documentation and/or other materials provided with the
13 * distribution.
14 * * Neither the name of Google Inc. nor the names of its
15 * contributors may be used to endorse or promote products derived from
16 * this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31 #include "config.h"
32 #include "V8CustomBinding.h"
33
34 #include "CSSHelper.h"
35 #include "Element.h"
36 #include "Document.h"
37 #include "DOMWindow.h"
38 #include "History.h"
39 #include "HTMLNames.h"
40 #include "HTMLFrameElementBase.h"
41 #include "Location.h"
42 #include "V8Proxy.h"
43
44 #if ENABLE(SVG)
45 #include "SVGPathSeg.h"
46 #endif
47
48 namespace WebCore {
49
allowSettingFrameSrcToJavascriptUrl(HTMLFrameElementBase * frame,String value)50 bool allowSettingFrameSrcToJavascriptUrl(HTMLFrameElementBase* frame, String value)
51 {
52 if (protocolIs(deprecatedParseURL(value), "javascript")) {
53 Node* contentDoc = frame->contentDocument();
54 if (contentDoc && !V8Proxy::checkNodeSecurity(contentDoc))
55 return false;
56 }
57 return true;
58 }
59
allowSettingSrcToJavascriptURL(Element * element,String name,String value)60 bool allowSettingSrcToJavascriptURL(Element* element, String name, String value)
61 {
62 if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)) && equalIgnoringCase(name, "src"))
63 return allowSettingFrameSrcToJavascriptUrl(static_cast<HTMLFrameElementBase*>(element), value);
64 return true;
65 }
66
67 // DOMImplementation is a singleton in WebCore. If we use our normal
68 // mapping from DOM objects to V8 wrappers, the same wrapper will be
69 // shared for all frames in the same process. This is a major
70 // security problem. Therefore, we generate a DOMImplementation
71 // wrapper per document and store it in an internal field of the
72 // document. Since the DOMImplementation object is a singleton, we do
73 // not have to do anything to keep the DOMImplementation object alive
74 // for the lifetime of the wrapper.
ACCESSOR_GETTER(DocumentImplementation)75 ACCESSOR_GETTER(DocumentImplementation)
76 {
77 ASSERT(info.Holder()->InternalFieldCount() >= kDocumentMinimumInternalFieldCount);
78
79 // Check if the internal field already contains a wrapper.
80 v8::Local<v8::Value> implementation = info.Holder()->GetInternalField(kDocumentImplementationIndex);
81 if (!implementation->IsUndefined())
82 return implementation;
83
84 // Generate a wrapper.
85 Document* document = V8DOMWrapper::convertDOMWrapperToNative<Document>(info.Holder());
86 v8::Handle<v8::Value> wrapper = V8DOMWrapper::convertDOMImplementationToV8Object(document->implementation());
87
88 // Store the wrapper in the internal field.
89 info.Holder()->SetInternalField(kDocumentImplementationIndex, wrapper);
90
91 return wrapper;
92 }
93
94 // --------------- Security Checks -------------------------
INDEXED_ACCESS_CHECK(History)95 INDEXED_ACCESS_CHECK(History)
96 {
97 ASSERT(V8ClassIndex::FromInt(data->Int32Value()) == V8ClassIndex::HISTORY);
98 // Only allow same origin access.
99 History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, host);
100 return V8Proxy::canAccessFrame(history->frame(), false);
101 }
102
NAMED_ACCESS_CHECK(History)103 NAMED_ACCESS_CHECK(History)
104 {
105 ASSERT(V8ClassIndex::FromInt(data->Int32Value()) == V8ClassIndex::HISTORY);
106 // Only allow same origin access.
107 History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, host);
108 return V8Proxy::canAccessFrame(history->frame(), false);
109 }
110
111 #undef INDEXED_ACCESS_CHECK
112 #undef NAMED_ACCESS_CHECK
113 #undef NAMED_PROPERTY_GETTER
114 #undef NAMED_PROPERTY_SETTER
115
GetTargetFrame(v8::Local<v8::Object> host,v8::Local<v8::Value> data)116 Frame* V8Custom::GetTargetFrame(v8::Local<v8::Object> host, v8::Local<v8::Value> data)
117 {
118 Frame* target = 0;
119 switch (V8ClassIndex::FromInt(data->Int32Value())) {
120 case V8ClassIndex::DOMWINDOW: {
121 v8::Handle<v8::Object> window = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, host);
122 if (window.IsEmpty())
123 return target;
124
125 DOMWindow* targetWindow = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, window);
126 target = targetWindow->frame();
127 break;
128 }
129 case V8ClassIndex::LOCATION: {
130 History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, host);
131 target = history->frame();
132 break;
133 }
134 case V8ClassIndex::HISTORY: {
135 Location* location = V8DOMWrapper::convertToNativeObject<Location>(V8ClassIndex::LOCATION, host);
136 target = location->frame();
137 break;
138 }
139 default:
140 break;
141 }
142 return target;
143 }
144
145 #if ENABLE(SVG)
DowncastSVGPathSeg(void * pathSeg)146 V8ClassIndex::V8WrapperType V8Custom::DowncastSVGPathSeg(void* pathSeg)
147 {
148 WebCore::SVGPathSeg* realPathSeg = reinterpret_cast<WebCore::SVGPathSeg*>(pathSeg);
149
150 switch (realPathSeg->pathSegType()) {
151 #define MAKE_CASE(svgValue, v8Value) case WebCore::SVGPathSeg::svgValue: return V8ClassIndex::v8Value
152
153 MAKE_CASE(PATHSEG_CLOSEPATH, SVGPATHSEGCLOSEPATH);
154 MAKE_CASE(PATHSEG_MOVETO_ABS, SVGPATHSEGMOVETOABS);
155 MAKE_CASE(PATHSEG_MOVETO_REL, SVGPATHSEGMOVETOREL);
156 MAKE_CASE(PATHSEG_LINETO_ABS, SVGPATHSEGLINETOABS);
157 MAKE_CASE(PATHSEG_LINETO_REL, SVGPATHSEGLINETOREL);
158 MAKE_CASE(PATHSEG_CURVETO_CUBIC_ABS, SVGPATHSEGCURVETOCUBICABS);
159 MAKE_CASE(PATHSEG_CURVETO_CUBIC_REL, SVGPATHSEGCURVETOCUBICREL);
160 MAKE_CASE(PATHSEG_CURVETO_QUADRATIC_ABS, SVGPATHSEGCURVETOQUADRATICABS);
161 MAKE_CASE(PATHSEG_CURVETO_QUADRATIC_REL, SVGPATHSEGCURVETOQUADRATICREL);
162 MAKE_CASE(PATHSEG_ARC_ABS, SVGPATHSEGARCABS);
163 MAKE_CASE(PATHSEG_ARC_REL, SVGPATHSEGARCREL);
164 MAKE_CASE(PATHSEG_LINETO_HORIZONTAL_ABS, SVGPATHSEGLINETOHORIZONTALABS);
165 MAKE_CASE(PATHSEG_LINETO_HORIZONTAL_REL, SVGPATHSEGLINETOHORIZONTALREL);
166 MAKE_CASE(PATHSEG_LINETO_VERTICAL_ABS, SVGPATHSEGLINETOVERTICALABS);
167 MAKE_CASE(PATHSEG_LINETO_VERTICAL_REL, SVGPATHSEGLINETOVERTICALREL);
168 MAKE_CASE(PATHSEG_CURVETO_CUBIC_SMOOTH_ABS, SVGPATHSEGCURVETOCUBICSMOOTHABS);
169 MAKE_CASE(PATHSEG_CURVETO_CUBIC_SMOOTH_REL, SVGPATHSEGCURVETOCUBICSMOOTHREL);
170 MAKE_CASE(PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS, SVGPATHSEGCURVETOQUADRATICSMOOTHABS);
171 MAKE_CASE(PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL, SVGPATHSEGCURVETOQUADRATICSMOOTHREL);
172
173 #undef MAKE_CASE
174
175 default:
176 return V8ClassIndex::INVALID_CLASS_INDEX;
177 }
178 }
179
180 #endif // ENABLE(SVG)
181
182 } // namespace WebCore
183