1 /*

     2  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)

     3  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)

     4  *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.

     5  *

     6  *  This library is free software; you can redistribute it and/or

     7  *  modify it under the terms of the GNU Lesser General Public

     8  *  License as published by the Free Software Foundation; either

     9  *  version 2 of the License, or (at your option) any later version.

    10  *

    11  *  This library is distributed in the hope that it will be useful,

    12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of

    13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    14  *  Lesser General Public License for more details.

    15  *

    16  *  You should have received a copy of the GNU Lesser General Public

    17  *  License along with this library; if not, write to the Free Software

    18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA

    19  */

    20 

    21 #include "config.h"

    22 #include "ScriptController.h"

    23 

    24 #include "ScriptableDocumentParser.h"

    25 #include "Event.h"

    26 #include "EventNames.h"

    27 #include "Frame.h"

    28 #include "FrameLoaderClient.h"

    29 #include "GCController.h"

    30 #include "HTMLPlugInElement.h"

    31 #include "InspectorTimelineAgent.h"

    32 #include "JSDocument.h"

    33 #include "JSMainThreadExecState.h"

    34 #include "NP_jsobject.h"

    35 #include "Page.h"

    36 #include "PageGroup.h"

    37 #include "ScriptSourceCode.h"

    38 #include "ScriptValue.h"

    39 #include "Settings.h"

    40 #include "StorageNamespace.h"

    41 #include "UserGestureIndicator.h"

    42 #include "WebCoreJSClientData.h"

    43 #include "XSSAuditor.h"

    44 #include "npruntime_impl.h"

    45 #include "runtime_root.h"

    46 #include <debugger/Debugger.h>

    47 #include <runtime/InitializeThreading.h>

    48 #include <runtime/JSLock.h>

    49 #include <wtf/Threading.h>

    50 

    51 using namespace JSC;

    52 using namespace std;

    53 

    54 namespace WebCore {

    55 

    56 void ScriptController::initializeThreading()

    57 {

    58     JSC::initializeThreading();

    59     WTF::initializeMainThread();

    60 }

    61 

    62 ScriptController::ScriptController(Frame* frame)

    63     : m_frame(frame)

    64     , m_sourceURL(0)

    65     , m_inExecuteScript(false)

    66     , m_processingTimerCallback(false)

    67     , m_paused(false)

    68     , m_allowPopupsFromPlugin(false)

    69 #if ENABLE(NETSCAPE_PLUGIN_API)

    70     , m_windowScriptNPObject(0)

    71 #endif

    72 #if PLATFORM(MAC)

    73     , m_windowScriptObject(0)

    74 #endif

    75     , m_XSSAuditor(new XSSAuditor(frame))

    76 {

    77 #if PLATFORM(MAC) && ENABLE(JAVA_BRIDGE)

    78     static bool initializedJavaJSBindings;

    79     if (!initializedJavaJSBindings) {

    80         initializedJavaJSBindings = true;

    81         initJavaJSBindings();

    82     }

    83 #endif

    84 }

    85 

    86 ScriptController::~ScriptController()

    87 {

    88     disconnectPlatformScriptObjects();

    89 

    90     if (m_cacheableBindingRootObject) {

    91         m_cacheableBindingRootObject->invalidate();

    92         m_cacheableBindingRootObject = 0;

    93     }

    94 

    95     // It's likely that destroying m_windowShells will create a lot of garbage.

    96     if (!m_windowShells.isEmpty()) {

    97         while (!m_windowShells.isEmpty())

    98             destroyWindowShell(m_windowShells.begin()->first.get());

    99         gcController().garbageCollectSoon();

   100     }

   101 }

   102 

   103 void ScriptController::destroyWindowShell(DOMWrapperWorld* world)

   104 {

   105     ASSERT(m_windowShells.contains(world));

   106     m_windowShells.remove(world);

   107     world->didDestroyWindowShell(this);

   108 }

   109 

   110 JSDOMWindowShell* ScriptController::createWindowShell(DOMWrapperWorld* world)

   111 {

   112     ASSERT(!m_windowShells.contains(world));

   113     JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow(), world);

   114     m_windowShells.add(world, windowShell);

   115     world->didCreateWindowShell(this);

   116     return windowShell;

   117 }

   118 

   119 ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode, DOMWrapperWorld* world, ShouldAllowXSS shouldAllowXSS)

   120 {

   121     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();

   122     String sourceURL = ustringToString(jsSourceCode.provider()->url());

   123 

   124     if (shouldAllowXSS == DoNotAllowXSS && !m_XSSAuditor->canEvaluate(sourceCode.source())) {

   125         // This script is not safe to be evaluated.

   126         return JSValue();

   127     }

   128 

   129     // evaluate code. Returns the JS return value or 0

   130     // if there was none, an error occurred or the type couldn't be converted.

   131 

   132     // inlineCode is true for <a href="javascript:doSomething()">

   133     // and false for <script>doSomething()</script>. Check if it has the

   134     // expected value in all cases.

   135     // See smart window.open policy for where this is used.

   136     JSDOMWindowShell* shell = windowShell(world);

   137     ExecState* exec = shell->window()->globalExec();

   138     const String* savedSourceURL = m_sourceURL;

   139     m_sourceURL = &sourceURL;

   140 

   141     JSLock lock(SilenceAssertionsOnly);

   142 

   143     RefPtr<Frame> protect = m_frame;

   144 

   145 #if ENABLE(INSPECTOR)

   146     if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)

   147         timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());

   148 #endif

   149 

   150     exec->globalData().timeoutChecker.start();

   151     Completion comp = JSMainThreadExecState::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);

   152     exec->globalData().timeoutChecker.stop();

   153 

   154 #if ENABLE(INSPECTOR)

   155     if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)

   156         timelineAgent->didEvaluateScript();

   157 #endif

   158 

   159     // Evaluating the JavaScript could cause the frame to be deallocated

   160     // so we start the keep alive timer here.

   161     m_frame->keepAlive();

   162 

   163     if (comp.complType() == Normal || comp.complType() == ReturnValue) {

   164         m_sourceURL = savedSourceURL;

   165         return comp.value();

   166     }

   167 

   168     if (comp.complType() == Throw || comp.complType() == Interrupted)

   169         reportException(exec, comp.value());

   170 

   171     m_sourceURL = savedSourceURL;

   172     return JSValue();

   173 }

   174 

   175 ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS) 

   176 {

   177     return evaluateInWorld(sourceCode, mainThreadNormalWorld(), shouldAllowXSS);

   178 }

   179 

   180 PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()

   181 {

   182     return DOMWrapperWorld::create(JSDOMWindow::commonJSGlobalData());

   183 }

   184 

   185 void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)

   186 {

   187     static_cast<WebCoreJSClientData*>(JSDOMWindow::commonJSGlobalData()->clientData)->getAllWorlds(worlds);

   188 }

   189 

   190 void ScriptController::clearWindowShell(bool goingIntoPageCache)

   191 {

   192     if (m_windowShells.isEmpty())

   193         return;

   194 

   195     JSLock lock(SilenceAssertionsOnly);

   196 

   197     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {

   198         JSDOMWindowShell* windowShell = iter->second;

   199 

   200         // Clear the debugger from the current window before setting the new window.

   201         attachDebugger(windowShell, 0);

   202 

   203         windowShell->window()->willRemoveFromWindowShell();

   204         windowShell->setWindow(m_frame->domWindow());

   205 

   206         if (Page* page = m_frame->page()) {

   207             attachDebugger(windowShell, page->debugger());

   208             windowShell->window()->setProfileGroup(page->group().identifier());

   209         }

   210     }

   211 

   212     // It's likely that resetting our windows created a lot of garbage, unless

   213     // it went in a back/forward cache.

   214     if (!goingIntoPageCache)

   215         gcController().garbageCollectSoon();

   216 }

   217 

   218 JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)

   219 {

   220     ASSERT(!m_windowShells.contains(world));

   221 

   222     JSLock lock(SilenceAssertionsOnly);

   223 

   224     JSDOMWindowShell* windowShell = createWindowShell(world);

   225 

   226     windowShell->window()->updateDocument();

   227 

   228     if (Page* page = m_frame->page()) {

   229         attachDebugger(windowShell, page->debugger());

   230         windowShell->window()->setProfileGroup(page->group().identifier());

   231     }

   232 

   233     m_frame->loader()->dispatchDidClearWindowObjectInWorld(world);

   234 

   235     return windowShell;

   236 }

   237 

   238 int ScriptController::eventHandlerLineNumber() const

   239 {

   240     // JSC expects 1-based line numbers, so we must add one here to get it right.

   241     ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();

   242     if (parser)

   243         return parser->lineNumber() + 1;

   244     return 0;

   245 }

   246 

   247 bool ScriptController::processingUserGesture(DOMWrapperWorld* world) const

   248 {

   249     if (m_allowPopupsFromPlugin || isJavaScriptAnchorNavigation())

   250         return true;

   251 

   252     // If a DOM event is being processed, check that it was initiated by the user

   253     // and that it is in the whitelist of event types allowed to generate pop-ups.

   254     if (JSDOMWindowShell* shell = existingWindowShell(world))

   255         if (Event* event = shell->window()->currentEvent())

   256             return event->fromUserGesture();

   257 

   258     return UserGestureIndicator::processingUserGesture();

   259 }

   260 

   261 // FIXME: This seems like an insufficient check to verify a click on a javascript: anchor.

   262 bool ScriptController::isJavaScriptAnchorNavigation() const

   263 {

   264     // This is the <a href="javascript:window.open('...')> case -> we let it through

   265     if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback)

   266         return true;

   267 

   268     // This is the <script>window.open(...)</script> case or a timer callback -> block it

   269     return false;

   270 }

   271 

   272 bool ScriptController::anyPageIsProcessingUserGesture() const

   273 {

   274     Page* page = m_frame->page();

   275     if (!page)

   276         return false;

   277 

   278     const HashSet<Page*>& pages = page->group().pages();

   279     HashSet<Page*>::const_iterator end = pages.end();

   280     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {

   281         for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {

   282             ScriptController* script = frame->script();

   283 

   284             if (script->m_allowPopupsFromPlugin)

   285                 return true;

   286 

   287             const ShellMap::const_iterator iterEnd = m_windowShells.end();

   288             for (ShellMap::const_iterator iter = m_windowShells.begin(); iter != iterEnd; ++iter) {

   289                 JSDOMWindowShell* shell = iter->second.get();

   290                 Event* event = shell->window()->currentEvent();

   291                 if (event && event->fromUserGesture())

   292                     return true;

   293             }

   294 

   295             if (isJavaScriptAnchorNavigation())

   296                 return true;

   297         }

   298     }

   299 

   300     return false;

   301 }

   302 

   303 bool ScriptController::canAccessFromCurrentOrigin(Frame *frame)

   304 {

   305     ExecState* exec = JSMainThreadExecState::currentState();

   306     if (exec)

   307         return allowsAccessFromFrame(exec, frame);

   308     // If the current state is 0 we're in a call path where the DOM security 

   309     // check doesn't apply (eg. parser).

   310     return true;

   311 }

   312 

   313 void ScriptController::attachDebugger(JSC::Debugger* debugger)

   314 {

   315     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)

   316         attachDebugger(iter->second, debugger);

   317 }

   318 

   319 void ScriptController::attachDebugger(JSDOMWindowShell* shell, JSC::Debugger* debugger)

   320 {

   321     if (!shell)

   322         return;

   323 

   324     JSDOMWindow* globalObject = shell->window();

   325     if (debugger)

   326         debugger->attach(globalObject);

   327     else if (JSC::Debugger* currentDebugger = globalObject->debugger())

   328         currentDebugger->detach(globalObject);

   329 }

   330 

   331 void ScriptController::updateDocument()

   332 {

   333     if (!m_frame->document())

   334         return;

   335 

   336     JSLock lock(SilenceAssertionsOnly);

   337     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)

   338         iter->second->window()->updateDocument();

   339 }

   340 

   341 void ScriptController::updateSecurityOrigin()

   342 {

   343     // Our bindings do not do anything in this case.

   344 }

   345 

   346 Bindings::RootObject* ScriptController::cacheableBindingRootObject()

   347 {

   348     if (!canExecuteScripts(NotAboutToExecuteScript))

   349         return 0;

   350 

   351     if (!m_cacheableBindingRootObject) {

   352         JSLock lock(SilenceAssertionsOnly);

   353         m_cacheableBindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));

   354     }

   355     return m_cacheableBindingRootObject.get();

   356 }

   357 

   358 Bindings::RootObject* ScriptController::bindingRootObject()

   359 {

   360     if (!canExecuteScripts(NotAboutToExecuteScript))

   361         return 0;

   362 

   363     if (!m_bindingRootObject) {

   364         JSLock lock(SilenceAssertionsOnly);

   365         m_bindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));

   366     }

   367     return m_bindingRootObject.get();

   368 }

   369 

   370 PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* nativeHandle)

   371 {

   372     RootObjectMap::iterator it = m_rootObjects.find(nativeHandle);

   373     if (it != m_rootObjects.end())

   374         return it->second;

   375 

   376     RefPtr<Bindings::RootObject> rootObject = Bindings::RootObject::create(nativeHandle, globalObject(pluginWorld()));

   377 

   378     m_rootObjects.set(nativeHandle, rootObject);

   379     return rootObject.release();

   380 }

   381 

   382 #if ENABLE(INSPECTOR)

   383 void ScriptController::setCaptureCallStackForUncaughtExceptions(bool)

   384 {

   385 }

   386 #endif

   387 

   388 #if ENABLE(NETSCAPE_PLUGIN_API)

   389 

   390 NPObject* ScriptController::windowScriptNPObject()

   391 {

   392     if (!m_windowScriptNPObject) {

   393         if (canExecuteScripts(NotAboutToExecuteScript)) {

   394             // JavaScript is enabled, so there is a JavaScript window object.

   395             // Return an NPObject bound to the window object.

   396             JSC::JSLock lock(SilenceAssertionsOnly);

   397             JSObject* win = windowShell(pluginWorld())->window();

   398             ASSERT(win);

   399             Bindings::RootObject* root = bindingRootObject();

   400             m_windowScriptNPObject = _NPN_CreateScriptObject(0, win, root);

   401         } else {

   402             // JavaScript is not enabled, so we cannot bind the NPObject to the JavaScript window object.

   403             // Instead, we create an NPObject of a different class, one which is not bound to a JavaScript object.

   404             m_windowScriptNPObject = _NPN_CreateNoScriptObject();

   405         }

   406     }

   407 

   408     return m_windowScriptNPObject;

   409 }

   410 

   411 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)

   412 {

   413     JSObject* object = jsObjectForPluginElement(plugin);

   414     if (!object)

   415         return _NPN_CreateNoScriptObject();

   416 

   417     // Wrap the JSObject in an NPObject

   418     return _NPN_CreateScriptObject(0, object, bindingRootObject());

   419 }

   420 

   421 #endif

   422 

   423 JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)

   424 {

   425     // Can't create JSObjects when JavaScript is disabled

   426     if (!canExecuteScripts(NotAboutToExecuteScript))

   427         return 0;

   428 

   429     // Create a JSObject bound to this element

   430     JSLock lock(SilenceAssertionsOnly);

   431     JSDOMWindow* globalObj = globalObject(pluginWorld());

   432     // FIXME: is normal okay? - used for NP plugins?

   433     JSValue jsElementValue = toJS(globalObj->globalExec(), globalObj, plugin);

   434     if (!jsElementValue || !jsElementValue.isObject())

   435         return 0;

   436     

   437     return jsElementValue.getObject();

   438 }

   439 

   440 #if !PLATFORM(MAC)

   441 

   442 void ScriptController::updatePlatformScriptObjects()

   443 {

   444 }

   445 

   446 void ScriptController::disconnectPlatformScriptObjects()

   447 {

   448 }

   449 

   450 #endif

   451 

   452 void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)

   453 {

   454     RootObjectMap::iterator it = m_rootObjects.find(nativeHandle);

   455 

   456     if (it == m_rootObjects.end())

   457         return;

   458 

   459     it->second->invalidate();

   460     m_rootObjects.remove(it);

   461 }

   462 

   463 void ScriptController::clearScriptObjects()

   464 {

   465     JSLock lock(SilenceAssertionsOnly);

   466 

   467     RootObjectMap::const_iterator end = m_rootObjects.end();

   468     for (RootObjectMap::const_iterator it = m_rootObjects.begin(); it != end; ++it)

   469         it->second->invalidate();

   470 

   471     m_rootObjects.clear();

   472 

   473     if (m_bindingRootObject) {

   474         m_bindingRootObject->invalidate();

   475         m_bindingRootObject = 0;

   476     }

   477 

   478 #if ENABLE(NETSCAPE_PLUGIN_API)

   479     if (m_windowScriptNPObject) {

   480         // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window

   481         // script object properly.

   482         // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.

   483         _NPN_DeallocateObject(m_windowScriptNPObject);

   484         m_windowScriptNPObject = 0;

   485     }

   486 #endif

   487 }

   488 

   489 ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture, ShouldAllowXSS shouldAllowXSS)

   490 {

   491     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());

   492 

   493     if (!canExecuteScripts(AboutToExecuteScript) || isPaused())

   494         return ScriptValue();

   495 

   496     bool wasInExecuteScript = m_inExecuteScript;

   497     m_inExecuteScript = true;

   498 

   499     ScriptValue result = evaluateInWorld(sourceCode, world, shouldAllowXSS);

   500 

   501     if (!wasInExecuteScript) {

   502         m_inExecuteScript = false;

   503         Document::updateStyleForAllDocuments();

   504     }

   505 

   506     return result;

   507 }

   508 

   509 } // namespace WebCore