Commit 21a6ba2a authored by Balazs Engedy's avatar Balazs Engedy Committed by Commit Bot

Handle invalid contexts in CredentialManager callbacks better.

As of crrev.com/c/536543, it's an error to call ExecutionContext::From()
on an invalid |context|. Update guards in request/notification callbacks
in blink::CredentialsContainer to instead rely on ScriptPromiseResolver
being a ContextLifecycleObserver, which is able to safely return the
Frame (i.e. browsing context) associated with its ExecutionContext (here
always a document) if it is still active, and a nullptr otherwise.

This CL also removes a useless copy of |web_credentials|.

Bug: 794278
Change-Id: Iefe3557dbc374a81964be7f5f51a9f8b73e93e51
Reviewed-on: https://chromium-review.googlesource.com/824267
Commit-Queue: Balazs Engedy <engedy@chromium.org>
Reviewed-by: default avatarYuki Shiino <yukishiino@chromium.org>
Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524368}
parent f4fcf125
...@@ -155,9 +155,7 @@ class NotificationCallbacks ...@@ -155,9 +155,7 @@ class NotificationCallbacks
~NotificationCallbacks() override {} ~NotificationCallbacks() override {}
void OnSuccess() override { void OnSuccess() override {
Frame* frame = Frame* frame = resolver_->GetFrame();
ToDocument(ExecutionContext::From(resolver_->GetScriptState()))
->GetFrame();
SECURITY_CHECK(!frame || SECURITY_CHECK(!frame ||
same_origin_requirement_ == same_origin_requirement_ ==
SameOriginRequirement::kCanBeCrossOrigin || SameOriginRequirement::kCanBeCrossOrigin ||
...@@ -183,16 +181,10 @@ class RequestCallbacks : public WebCredentialManagerClient::RequestCallbacks { ...@@ -183,16 +181,10 @@ class RequestCallbacks : public WebCredentialManagerClient::RequestCallbacks {
: resolver_(resolver) {} : resolver_(resolver) {}
~RequestCallbacks() override {} ~RequestCallbacks() override {}
void OnSuccess(std::unique_ptr<WebCredential> web_credential) override { void OnSuccess(std::unique_ptr<WebCredential> credential) override {
ExecutionContext* context = Frame* frame = resolver_->GetFrame();
ExecutionContext::From(resolver_->GetScriptState());
if (!context)
return;
Frame* frame = ToDocument(context)->GetFrame();
SECURITY_CHECK(!frame || IsSameOriginWithAncestors(frame)); SECURITY_CHECK(!frame || IsSameOriginWithAncestors(frame));
std::unique_ptr<WebCredential> credential =
WTF::WrapUnique(web_credential.release());
if (!frame) { if (!frame) {
resolver_->Resolve(); resolver_->Resolve();
return; return;
...@@ -235,11 +227,7 @@ class PublicKeyCallbacks : public WebAuthenticationClient::PublicKeyCallbacks { ...@@ -235,11 +227,7 @@ class PublicKeyCallbacks : public WebAuthenticationClient::PublicKeyCallbacks {
void OnSuccess( void OnSuccess(
webauth::mojom::blink::PublicKeyCredentialInfoPtr credential) override { webauth::mojom::blink::PublicKeyCredentialInfoPtr credential) override {
ExecutionContext* context = Frame* frame = resolver_->GetFrame();
ExecutionContext::From(resolver_->GetScriptState());
if (!context)
return;
Frame* frame = ToDocument(context)->GetFrame();
SECURITY_CHECK(!frame || frame == frame->Tree().Top()); SECURITY_CHECK(!frame || frame == frame->Tree().Top());
if (!frame) { if (!frame) {
......
...@@ -45,8 +45,9 @@ TEST(CredentialsContainerTest, TestGetWithDocumentDestroyed) { ...@@ -45,8 +45,9 @@ TEST(CredentialsContainerTest, TestGetWithDocumentDestroyed) {
CredentialsContainer* credential_container = CredentialsContainer::Create(); CredentialsContainer* credential_container = CredentialsContainer::Create();
std::unique_ptr<WebCredentialManagerClient::RequestCallbacks> get_callback; std::unique_ptr<WebCredentialManagerClient::RequestCallbacks> get_callback;
V8TestingScope scope;
{ {
V8TestingScope scope;
// Set up. // Set up.
scope.GetDocument().SetSecurityOrigin( scope.GetDocument().SetSecurityOrigin(
SecurityOrigin::CreateFromString("https://example.test")); SecurityOrigin::CreateFromString("https://example.test"));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment