mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: use appropriate site instance for cross-site nav's (#15821)

Browse source 
* fix: use Chromium's determined new site instance as candidate when navigating.

When navigating to a new address, consider using Chromium's determined site instance
for the new page as it should belong to an existing browsing instance when the
navigation was triggered by window.open().

fixes 8100.

* Revert "fix: use Chromium's determined new site instance as candidate when navigating."

This reverts commit eb95f935654a2c4d4457821297670836c10fdfd5.

* fix: delegate site instance creation back to content when sandboxed.

* fix: ensure site isolation is on

* test: adapt ut for cross-site navigation

* fix: register pending processes during a navigation.

* refactor: dont call loadURL for a window constructed from an existing webContents.

* test: add sandboxed affinity UT's.

* fix: check affinity before deciding if to force a new site instance.

* chore: adapt subsequent patch.

* refactor: constify logically const methods.

* fix: do not reuse site instances when navigation redirects cross-site.

* test: ensure localStorage accessible after x-site redirect.

* test: adapt localStorage acess denied UT for site isolation.

* fix: do not send render-view-deleted for speculative frames.

* chore: amend tests after rebase.

* test: add ut for webContents' render-view-deleted emission

* fix: introduce current-render-view-deleted for current RVH's deletions.

Revert render-view-deleted to being emitted with any RVH's deletion.
current-render-view-deleted is emitted only when the RVH being deleted
is the current one.

* refactor: style and comments fixed.
This commit is contained in:
Pedro Pontes 2018-12-05 09:03:39 +01:00 • committed by Cheng Zhao
parent 46e7214974
commit d5d1fa8290
14 changed files with 581 additions and 240 deletions
Download patch file Download diff file Expand all files Collapse all files

75
spec/chromium-spec.js
View file

@ -1016,17 +1016,21 @@ describe('chromium feature', () => {
contents = null
})
// FIXME(deepak1556): Disabled with site isolation ON
// Localstorage area is accessed on the browser process
// before checking accessibility on the renderer side,
// causing illegal origin access renderer termination.
xit('cannot access localStorage', (done) => {
ipcMain.once('local-storage-response', (event, error) => {
assert.strictEqual(
error,
'Failed to read the \'localStorage\' property from \'Window\': Access is denied for this document.')
it('cannot access localStorage', (done) => {
contents.on('crashed', (event, killed) => {
// Site isolation ON: process is killed for trying to access resources without permission.
if (process.platform !== 'win32') {
// Chromium on Windows does not set this flag correctly.
assert.strictEqual(killed, true, 'Process should\'ve been killed')
}
done()
})
ipcMain.once('local-storage-response', (event, message) => {
// Site isolation OFF: access is refused.
assert.strictEqual(
message,
'Failed to read the \'localStorage\' property from \'Window\': Access is denied for this document.')
})
contents.loadURL(protocolName + '://host/localStorage')
})
@ -1066,6 +1070,59 @@ describe('chromium feature', () => {
contents.loadURL(`${protocolName}://host/cookie`)
})
})
describe('can be accessed', () => {
let server = null
before((done) => {
server = http.createServer((req, res) => {
const respond = () => {
if (req.url === '/redirect-cross-site') {
res.setHeader('Location', `${server.cross_site_url}/redirected`)
res.statusCode = 302
res.end()
} else if (req.url === '/redirected') {
res.end('<html><script>window.localStorage</script></html>')
} else {
res.end()
}
}
setTimeout(respond, 0)
})
server.listen(0, '127.0.0.1', () => {
server.url = `http://127.0.0.1:${server.address().port}`
server.cross_site_url = `http://localhost:${server.address().port}`
done()
})
})
after(() => {
server.close()
server = null
})
const testLocalStorageAfterXSiteRedirect = (testTitle, extraPreferences = {}) => {
it(testTitle, (done) => {
const webPreferences = { show: false, ...extraPreferences }
w = new BrowserWindow(webPreferences)
let redirected = false
w.webContents.on('crashed', () => {
assert.fail('renderer crashed / was killed')
})
w.webContents.on('did-redirect-navigation', (event, url) => {
assert.strictEqual(url, `${server.cross_site_url}/redirected`)
redirected = true
})
w.webContents.on('did-finish-load', () => {
assert.strictEqual(redirected, true, 'didnt redirect')
done()
})
w.loadURL(`${server.url}/redirect-cross-site`)
})
}
testLocalStorageAfterXSiteRedirect('after a cross-site redirect')
testLocalStorageAfterXSiteRedirect('after a cross-site redirect in sandbox mode', { sandbox: true })
})
})
describe('websockets', () => {