1 /* 2 * Copyright (C) 2009 Google Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are 6 * met: 7 * 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above 11 * copyright notice, this list of conditions and the following disclaimer 12 * in the documentation and/or other materials provided with the 13 * distribution. 14 * * Neither the name of Google Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived from 16 * this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 22 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 23 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include "config.h" 32 #include "bindings/core/v8/BindingSecurity.h" 33 34 #include "bindings/core/v8/V8Binding.h" 35 #include "core/dom/Document.h" 36 #include "core/frame/LocalDOMWindow.h" 37 #include "core/frame/LocalFrame.h" 38 #include "core/frame/Settings.h" 39 #include "core/html/HTMLFrameElementBase.h" 40 #include "platform/weborigin/SecurityOrigin.h" 41 42 namespace blink { 43 44 static bool isDocumentAccessibleFromDOMWindow(Document* targetDocument, LocalDOMWindow* callingWindow) 45 { 46 if (!targetDocument) 47 return false; 48 49 if (!callingWindow) 50 return false; 51 52 if (callingWindow->document()->securityOrigin()->canAccess(targetDocument->securityOrigin())) 53 return true; 54 55 return false; 56 } 57 58 static bool canAccessDocument(v8::Isolate* isolate, Document* targetDocument, ExceptionState& exceptionState) 59 { 60 LocalDOMWindow* callingWindow = callingDOMWindow(isolate); 61 if (isDocumentAccessibleFromDOMWindow(targetDocument, callingWindow)) 62 return true; 63 64 if (targetDocument->domWindow()) 65 exceptionState.throwSecurityError(targetDocument->domWindow()->sanitizedCrossDomainAccessErrorMessage(callingWindow), targetDocument->domWindow()->crossDomainAccessErrorMessage(callingWindow)); 66 return false; 67 } 68 69 static bool canAccessDocument(v8::Isolate* isolate, Document* targetDocument, SecurityReportingOption reportingOption = ReportSecurityError) 70 { 71 LocalDOMWindow* callingWindow = callingDOMWindow(isolate); 72 if (isDocumentAccessibleFromDOMWindow(targetDocument, callingWindow)) 73 return true; 74 75 if (reportingOption == ReportSecurityError && targetDocument->domWindow()) { 76 if (LocalFrame* frame = targetDocument->frame()) 77 frame->domWindow()->printErrorMessage(targetDocument->domWindow()->crossDomainAccessErrorMessage(callingWindow)); 78 } 79 80 return false; 81 } 82 83 bool BindingSecurity::shouldAllowAccessToFrame(v8::Isolate* isolate, Frame* target, SecurityReportingOption reportingOption) 84 { 85 if (!target || !target->isLocalFrame()) 86 return false; 87 return canAccessDocument(isolate, toLocalFrame(target)->document(), reportingOption); 88 } 89 90 bool BindingSecurity::shouldAllowAccessToFrame(v8::Isolate* isolate, Frame* target, ExceptionState& exceptionState) 91 { 92 if (!target || !target->isLocalFrame()) 93 return false; 94 return canAccessDocument(isolate, toLocalFrame(target)->document(), exceptionState); 95 } 96 97 bool BindingSecurity::shouldAllowAccessToNode(v8::Isolate* isolate, Node* target, ExceptionState& exceptionState) 98 { 99 return target && canAccessDocument(isolate, &target->document(), exceptionState); 100 } 101 102 } 103