<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[190952] releases/WebKitGTK/webkit-2.10</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/190952">190952</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2015-10-13 03:34:21 -0700 (Tue, 13 Oct 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/190413">r190413</a> - [GTK] Websites with invalid auth header keep loading forever
https://bugs.webkit.org/show_bug.cgi?id=149710
Reviewed by Martin Robinson.
Source/WebCore:
We don't correctly handle a null realm from the server when
retrieving and storing credentials from libsecret. First
secret_attributes_build() fails because we pass a null domain, and
we pass null attributes to secret_service_search() that returns
early on a g_return macro and the callback is never called so the
load doesn't continue after the auth challenge.
* platform/network/gtk/CredentialBackingStore.cpp:
(WebCore::createAttributeHashTableFromChallenge):
(WebCore::CredentialBackingStore::credentialForChallenge):
(WebCore::CredentialBackingStore::storeCredentialsForChallenge):
Source/WebKit2:
Do not show the remember credentials checkbutton in the auth
dialog if the realm is empty.
* UIProcess/API/gtk/WebKitAuthenticationDialog.cpp:
(webkitAuthenticationDialogInitialize):
Tools:
Add test case to check that we can authenticate sites with an
empty realm.
* TestWebKitAPI/Tests/WebKit2Gtk/TestAuthentication.cpp:
(testWebViewAuthenticationEmptyRealm):
(serverCallback):
(beforeAll):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCoreplatformnetworkgtkCredentialBackingStorecpp">releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebKit2ChangeLog">releases/WebKitGTK/webkit-2.10/Source/WebKit2/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebKit2UIProcessAPIgtkWebKitAuthenticationDialogcpp">releases/WebKitGTK/webkit-2.10/Source/WebKit2/UIProcess/API/gtk/WebKitAuthenticationDialog.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit210ToolsChangeLog">releases/WebKitGTK/webkit-2.10/Tools/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210ToolsTestWebKitAPITestsWebKit2GtkTestAuthenticationcpp">releases/WebKitGTK/webkit-2.10/Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestAuthentication.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit210SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (190951 => 190952)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2015-10-13 10:30:43 UTC (rev 190951)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2015-10-13 10:34:21 UTC (rev 190952)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2015-10-01 Carlos Garcia Campos <cgarcia@igalia.com>
+
+ [GTK] Websites with invalid auth header keep loading forever
+ https://bugs.webkit.org/show_bug.cgi?id=149710
+
+ Reviewed by Martin Robinson.
+
+ We don't correctly handle a null realm from the server when
+ retrieving and storing credentials from libsecret. First
+ secret_attributes_build() fails because we pass a null domain, and
+ we pass null attributes to secret_service_search() that returns
+ early on a g_return macro and the callback is never called so the
+ load doesn't continue after the auth challenge.
+
+ * platform/network/gtk/CredentialBackingStore.cpp:
+ (WebCore::createAttributeHashTableFromChallenge):
+ (WebCore::CredentialBackingStore::credentialForChallenge):
+ (WebCore::CredentialBackingStore::storeCredentialsForChallenge):
+
</ins><span class="cx"> 2015-09-30 Dean Jackson <dino@apple.com>
</span><span class="cx">
</span><span class="cx"> GraphicsContext3D::mappedSymbolName should initialize count variable
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCoreplatformnetworkgtkCredentialBackingStorecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp (190951 => 190952)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp 2015-10-13 10:30:43 UTC (rev 190951)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp 2015-10-13 10:34:21 UTC (rev 190952)
</span><span class="lines">@@ -49,10 +49,14 @@
</span><span class="cx"> #if ENABLE(CREDENTIAL_STORAGE)
</span><span class="cx"> static GRefPtr<GHashTable> createAttributeHashTableFromChallenge(const AuthenticationChallenge& challenge, const Credential& credential = Credential())
</span><span class="cx"> {
</span><ins>+ const char* realm = soup_auth_get_realm(challenge.soupAuth());
+ if (!realm)
+ return nullptr;
+
</ins><span class="cx"> SoupURI* uri = soup_message_get_uri(challenge.soupMessage());
</span><span class="cx"> GRefPtr<GHashTable> attributes = adoptGRef(secret_attributes_build(
</span><span class="cx"> SECRET_SCHEMA_COMPAT_NETWORK,
</span><del>- "domain", soup_auth_get_realm(challenge.soupAuth()),
</del><ins>+ "domain", realm,
</ins><span class="cx"> "server", uri->host,
</span><span class="cx"> "protocol", uri->scheme,
</span><span class="cx"> "authtype", soup_auth_get_scheme_name(challenge.soupAuth()),
</span><span class="lines">@@ -109,10 +113,16 @@
</span><span class="cx"> callbackData->callback = callback;
</span><span class="cx"> callbackData->data = data;
</span><span class="cx">
</span><ins>+ GRefPtr<GHashTable> attributes = createAttributeHashTableFromChallenge(challenge);
+ if (!attributes) {
+ callback(Credential(), data);
+ return;
+ }
+
</ins><span class="cx"> secret_service_search(
</span><span class="cx"> 0, // The default SecretService.
</span><span class="cx"> SECRET_SCHEMA_COMPAT_NETWORK,
</span><del>- createAttributeHashTableFromChallenge(challenge).get(),
</del><ins>+ attributes.get(),
</ins><span class="cx"> searchFlags,
</span><span class="cx"> 0, // cancellable
</span><span class="cx"> reinterpret_cast<GAsyncReadyCallback>(credentialForChallengeAsyncReadyCallback),
</span><span class="lines">@@ -126,13 +136,17 @@
</span><span class="cx"> void CredentialBackingStore::storeCredentialsForChallenge(const AuthenticationChallenge& challenge, const Credential& credential)
</span><span class="cx"> {
</span><span class="cx"> #if ENABLE(CREDENTIAL_STORAGE)
</span><ins>+ GRefPtr<GHashTable> attributes = createAttributeHashTableFromChallenge(challenge, credential);
+ if (!attributes)
+ return;
+
</ins><span class="cx"> CString utf8Password = credential.password().utf8();
</span><span class="cx"> GRefPtr<SecretValue> newSecretValue = adoptGRef(secret_value_new(utf8Password.data(), utf8Password.length(), "text/plain"));
</span><span class="cx">
</span><span class="cx"> secret_service_store(
</span><span class="cx"> 0, // The default SecretService.
</span><span class="cx"> SECRET_SCHEMA_COMPAT_NETWORK,
</span><del>- createAttributeHashTableFromChallenge(challenge, credential).get(),
</del><ins>+ attributes.get(),
</ins><span class="cx"> SECRET_COLLECTION_DEFAULT,
</span><span class="cx"> _("WebKitGTK+ password"),
</span><span class="cx"> newSecretValue.get(),
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebKit2/ChangeLog (190951 => 190952)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebKit2/ChangeLog 2015-10-13 10:30:43 UTC (rev 190951)
+++ releases/WebKitGTK/webkit-2.10/Source/WebKit2/ChangeLog 2015-10-13 10:34:21 UTC (rev 190952)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2015-10-01 Carlos Garcia Campos <cgarcia@igalia.com>
+
+ [GTK] Websites with invalid auth header keep loading forever
+ https://bugs.webkit.org/show_bug.cgi?id=149710
+
+ Reviewed by Martin Robinson.
+
+ Do not show the remember credentials checkbutton in the auth
+ dialog if the realm is empty.
+
+ * UIProcess/API/gtk/WebKitAuthenticationDialog.cpp:
+ (webkitAuthenticationDialogInitialize):
+
</ins><span class="cx"> 2015-09-30 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, roll out r188331: "NetworkProcess: DNS prefetch happens in the Web Process"
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebKit2UIProcessAPIgtkWebKitAuthenticationDialogcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebKit2/UIProcess/API/gtk/WebKitAuthenticationDialog.cpp (190951 => 190952)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebKit2/UIProcess/API/gtk/WebKitAuthenticationDialog.cpp 2015-10-13 10:30:43 UTC (rev 190951)
+++ releases/WebKitGTK/webkit-2.10/Source/WebKit2/UIProcess/API/gtk/WebKitAuthenticationDialog.cpp 2015-10-13 10:34:21 UTC (rev 190952)
</span><span class="lines">@@ -174,7 +174,7 @@
</span><span class="cx"> gtk_box_pack_start(GTK_BOX(authBox), grid, FALSE, FALSE, 0);
</span><span class="cx">
</span><span class="cx"> gtk_entry_set_visibility(GTK_ENTRY(priv->passwordEntry), FALSE);
</span><del>- gtk_widget_set_visible(priv->rememberCheckButton, priv->credentialStorageMode != DisallowPersistentStorage);
</del><ins>+ gtk_widget_set_visible(priv->rememberCheckButton, priv->credentialStorageMode != DisallowPersistentStorage && !realm.isEmpty());
</ins><span class="cx">
</span><span class="cx"> const WebCore::Credential& credentialFromPersistentStorage = challenge.proposedCredential();
</span><span class="cx"> if (!credentialFromPersistentStorage.isEmpty()) {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210ToolsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Tools/ChangeLog (190951 => 190952)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Tools/ChangeLog 2015-10-13 10:30:43 UTC (rev 190951)
+++ releases/WebKitGTK/webkit-2.10/Tools/ChangeLog 2015-10-13 10:34:21 UTC (rev 190952)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2015-10-01 Carlos Garcia Campos <cgarcia@igalia.com>
+
+ [GTK] Websites with invalid auth header keep loading forever
+ https://bugs.webkit.org/show_bug.cgi?id=149710
+
+ Reviewed by Martin Robinson.
+
+ Add test case to check that we can authenticate sites with an
+ empty realm.
+
+ * TestWebKitAPI/Tests/WebKit2Gtk/TestAuthentication.cpp:
+ (testWebViewAuthenticationEmptyRealm):
+ (serverCallback):
+ (beforeAll):
+
</ins><span class="cx"> 2015-09-21 Carlos Garcia Campos <cgarcia@igalia.com>
</span><span class="cx">
</span><span class="cx"> [GTK] run-gtk-tests doesn't provide feedback about crashing google tests
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210ToolsTestWebKitAPITestsWebKit2GtkTestAuthenticationcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestAuthentication.cpp (190951 => 190952)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestAuthentication.cpp 2015-10-13 10:30:43 UTC (rev 190951)
+++ releases/WebKitGTK/webkit-2.10/Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestAuthentication.cpp 2015-10-13 10:34:21 UTC (rev 190952)
</span><span class="lines">@@ -232,6 +232,22 @@
</span><span class="cx"> g_assert_cmpstr(webkit_web_view_get_title(test->m_webView), ==, authExpectedSuccessTitle);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+static void testWebViewAuthenticationEmptyRealm(AuthenticationTest* test, gconstpointer)
+{
+ test->loadURI(kServer->getURIForPath("/empty-realm.html").data());
+ WebKitAuthenticationRequest* request = test->waitForAuthenticationRequest();
+ WebKitCredential* credential = webkit_credential_new(authTestUsername, authTestPassword, WEBKIT_CREDENTIAL_PERSISTENCE_FOR_SESSION);
+ webkit_authentication_request_authenticate(request, credential);
+ webkit_credential_free(credential);
+ test->waitUntilLoadFinished();
+
+ g_assert_cmpint(test->m_loadEvents.size(), ==, 3);
+ g_assert_cmpint(test->m_loadEvents[0], ==, LoadTrackingTest::ProvisionalLoadStarted);
+ g_assert_cmpint(test->m_loadEvents[1], ==, LoadTrackingTest::LoadCommitted);
+ g_assert_cmpint(test->m_loadEvents[2], ==, LoadTrackingTest::LoadFinished);
+ g_assert_cmpstr(webkit_web_view_get_title(test->m_webView), ==, authExpectedSuccessTitle);
+}
+
</ins><span class="cx"> static void serverCallback(SoupServer*, SoupMessage* message, const char* path, GHashTable*, SoupClientContext*, void*)
</span><span class="cx"> {
</span><span class="cx"> if (message->method != SOUP_METHOD_GET) {
</span><span class="lines">@@ -239,7 +255,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (!strcmp(path, "/auth-test.html")) {
</del><ins>+ if (!strcmp(path, "/auth-test.html") || !strcmp(path, "/empty-realm.html")) {
</ins><span class="cx"> const char* authorization = soup_message_headers_get_one(message->request_headers, "Authorization");
</span><span class="cx"> // Require authentication.
</span><span class="cx"> if (!g_strcmp0(authorization, authExpectedAuthorization)) {
</span><span class="lines">@@ -250,7 +266,10 @@
</span><span class="cx"> } else if (++AuthenticationTest::authenticationRetries < 3) {
</span><span class="cx"> // No or invalid authorization header provided by the client, request authentication twice then fail.
</span><span class="cx"> soup_message_set_status(message, SOUP_STATUS_UNAUTHORIZED);
</span><del>- soup_message_headers_append(message->response_headers, "WWW-Authenticate", "Basic realm=\"my realm\"");
</del><ins>+ if (!strcmp(path, "/empty-realm.html"))
+ soup_message_headers_append(message->response_headers, "WWW-Authenticate", "Basic");
+ else
+ soup_message_headers_append(message->response_headers, "WWW-Authenticate", "Basic realm=\"my realm\"");
</ins><span class="cx"> // Include a failure message in case the user attempts to proceed without authentication.
</span><span class="cx"> soup_message_body_append(message->response_body, SOUP_MEMORY_STATIC, authFailureHTMLString, strlen(authFailureHTMLString));
</span><span class="cx"> } else {
</span><span class="lines">@@ -276,6 +295,7 @@
</span><span class="cx"> AuthenticationTest::add("WebKitWebView", "authentication-failure", testWebViewAuthenticationFailure);
</span><span class="cx"> AuthenticationTest::add("WebKitWebView", "authentication-no-credential", testWebViewAuthenticationNoCredential);
</span><span class="cx"> AuthenticationTest::add("WebKitWebView", "authentication-storage", testWebViewAuthenticationStorage);
</span><ins>+ AuthenticationTest::add("WebKitWebView", "authentication-empty-realm", testWebViewAuthenticationEmptyRealm);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void afterAll()
</span></span></pre>
</div>
</div>
</body>
</html>