Skip to content

GitLab

T
tangled
Commit 7019944d authored by japhet@chromium.org's avatar japhet@chromium.org
Browse files
Options

Make FrameTree::uniqueName() more unique. 

Currently, it only guarantees no two siblings have the same unique name. This
patch tries much harder to guarantee that no two frames in the same page have
the same unique name.

BUG=352651
TEST=http/tests/history/frameset-repeated-name.html

Review URL: https://codereview.chromium.org/207143002

git-svn-id: svn://svn.chromium.org/blink/trunk@169764 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 89dd0eae
Hide whitespace changes
Inline Side-by-side
Showing with 50 additions and 7 deletions
third_party/WebKit/LayoutTests/http/tests/history/frameset-repeated-name-expected.txt 0 → 100644
View file @ 7019944d
============== Back Forward List ==============
curr-> http://127.0.0.1:8000/history/frameset-repeated-name.html
http://127.0.0.1:8000/history/resources/frameset-dest.html (in frame "<!--framePath //<!--frame0-->-->")
about:blank (in frame "f1")
about:blank (in frame "f2")
about:blank (in frame "f3")
about:blank (in frame "f4")
http://127.0.0.1:8000/history/resources/frameset-dest.html (in frame "<!--framePath //<!--frame1-->-->")
about:blank (in frame "<!--framePath //<!--frame1-->/<!--frame0-->-->")
about:blank (in frame "<!--framePath //<!--frame1-->/<!--frame1-->-->")
about:blank (in frame "<!--framePath //<!--frame1-->/<!--frame2-->-->")
about:blank (in frame "<!--framePath //<!--frame1-->/<!--frame3-->-->")
===============================================
third_party/WebKit/LayoutTests/http/tests/history/frameset-repeated-name.html 0 → 100644
View file @ 7019944d
<head>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.dumpBackForwardList();
}
</script>
</head>
<frameset>
<frame src="resources/frameset-dest.html">
<frame src="resources/frameset-dest.html">
</frameset>
third_party/WebKit/LayoutTests/http/tests/history/resources/frameset-dest.html 0 → 100644
View file @ 7019944d
<frameset>
<frame name="f1" id="f1">
<frame name="f2" id="f2">
<frame name="f3" id="f3">
<frame name="f4" id="f4">
</frameset>
third_party/WebKit/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-subframe-expected.txt
View file @ 7019944d
......@@ -13,6 +13,6 @@ Inner iframe on a foreign domain.
--------
Frame: 'aFrame'
Frame: '<!--framePath //aFrame/<!--frame0-->-->'
--------
Inner-inner iframe. This iframe (which is data: URL and whose parent is on a foreign domain) is the frame attempting to access the main frame. It should not have access to it.
third_party/WebKit/Source/core/page/FrameTree.cpp
View file @ 7019944d
......@@ -116,9 +116,18 @@ LocalFrame* FrameTree::lastChild() const
return toLocalFrame(m_thisFrame->loader().client()->lastChild());
}
bool FrameTree::uniqueNameExists(const AtomicString& name) const
{
for (LocalFrame* frame = top(); frame; frame = frame->tree().traverseNext()) {
if (frame->tree().uniqueName() == name)
return true;
}
return false;
}
AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
{
if (!requestedName.isEmpty() && !child(requestedName) && requestedName != "_blank")
if (!requestedName.isEmpty() && !uniqueNameExists(requestedName) && requestedName != "_blank")
return requestedName;
// Create a repeatable name for a child about to be added to us. The name must be
......@@ -184,7 +193,7 @@ LocalFrame* FrameTree::scopedChild(const AtomicString& name) const
return 0;
for (LocalFrame* child = firstChild(); child; child = child->tree().nextSibling())
if (child->tree().uniqueName() == name && child->inScope(scope))
if (child->tree().name() == name && child->inScope(scope))
return child;
return 0;
}
......@@ -226,7 +235,7 @@ unsigned FrameTree::childCount() const
LocalFrame* FrameTree::child(const AtomicString& name) const
{
for (LocalFrame* child = firstChild(); child; child = child->tree().nextSibling())
if (child->tree().uniqueName() == name)
if (child->tree().name() == name)
return child;
return 0;
}
......@@ -248,7 +257,7 @@ LocalFrame* FrameTree::find(const AtomicString& name) const
// Search subtree starting with this frame first.
for (LocalFrame* frame = m_thisFrame; frame; frame = frame->tree().traverseNext(m_thisFrame))
if (frame->tree().uniqueName() == name)
if (frame->tree().name() == name)
return frame;
// Search the entire tree for this page next.
......@@ -259,7 +268,7 @@ LocalFrame* FrameTree::find(const AtomicString& name) const
return 0;
for (LocalFrame* frame = page->mainFrame(); frame; frame = frame->tree().traverseNext())
if (frame->tree().uniqueName() == name)
if (frame->tree().name() == name)
return frame;
// Search the entire tree of each of the other pages in this namespace.
......@@ -270,7 +279,7 @@ LocalFrame* FrameTree::find(const AtomicString& name) const
Page* otherPage = *it;
if (otherPage != page) {
for (LocalFrame* frame = otherPage->mainFrame(); frame; frame = frame->tree().traverseNext()) {
if (frame->tree().uniqueName() == name)
if (frame->tree().name() == name)
return frame;
}
}
......
third_party/WebKit/Source/core/page/FrameTree.h
View file @ 7019944d
......@@ -61,6 +61,7 @@ namespace WebCore {
private:
LocalFrame* deepLastChild() const;
AtomicString uniqueChildName(const AtomicString& requestedName) const;
bool uniqueNameExists(const AtomicString& name) const;
unsigned scopedChildCount(TreeScope*) const;
LocalFrame* m_thisFrame;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment