Changeset 198687 in webkit for trunk/Source/WebCore/page/History.cpp

Timestamp:

Mar 25, 2016, 1:37:49 PM (10 years ago)

Author:

[email protected]

Message:

Soften push/replaceState frequency restrictions.
<rdar://problem/25228439> and ​https://bugs.webkit.org/show_bug.cgi?id=155901
.:

Rubber-stamped by Timothy Hatcher.

• ManualTests/state-objects-time-limit.html: Added.

Source/WebCore:

Rubber-stamped by Timothy Hatcher.

Covered by existing LayoutTests and a new Manual Test.

• page/History.cpp:

(WebCore::History::stateObjectAdded): Allow 100 state object operations every 30 seconds.

• page/History.h:

LayoutTests:

Rubber-stamped by Timothy Hatcher.

• fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt: Removed.
• fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html: Removed.
• fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt: Removed.
• fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html: Removed.

File:

• trunk/Source/WebCore/page/History.cpp (modified) (3 diffs)

trunk/Source/WebCore/page/History.cpp

@@ -141 +141 @@
     // Each unique main-frame document is only allowed to send 64mb of state object payload to the UI client/process.
     static uint32_t totalStateObjectPayloadLimit = 0x4000000;
-    static unsigned perUserGestureStateObjectLimit = 100;
+    static double stateObjectTimeSpan = 30.0;
+    static unsigned perStateObjectTimeSpanLimit = 100;
 
     if (!m_frame || !m_frame->page())
@@ -162 +163 @@
         return;
 
-    bool processingUserGesture = ScriptController::processingUserGesture();
-    if (!processingUserGesture && mainHistory->m_nonUserGestureObjectsAdded >= perUserGestureStateObjectLimit) {
+    double currentTimestamp = currentTime();
+    if (currentTimestamp - mainHistory->m_currentStateObjectTimeSpanStart > stateObjectTimeSpan) {
+        mainHistory->m_currentStateObjectTimeSpanStart = currentTimestamp;
+        mainHistory->m_currentStateObjectTimeSpanObjectsAdded = 0;
+    }
+    
+    if (mainHistory->m_currentStateObjectTimeSpanObjectsAdded >= perStateObjectTimeSpanLimit) {
         ec.code = SECURITY_ERR;
         if (stateObjectType == StateObjectType::Replace)
-            ec.message = String::format("Attempt to use history.replaceState() more than %u times without a user gesture", perUserGestureStateObjectLimit);
+            ec.message = String::format("Attempt to use history.replaceState() more than %u times per %f seconds", perStateObjectTimeSpanLimit, stateObjectTimeSpan);
         else
-            ec.message = String::format("Attempt to use history.pushState() more than %u times without a user gesture", perUserGestureStateObjectLimit);
-        return;
-    }
-
-    double userGestureTimestamp = mainDocument->lastHandledUserGestureTimestamp();
-    if (processingUserGesture) {
-        if (mainHistory->m_currentUserGestureTimestamp < userGestureTimestamp) {
-            mainHistory->m_currentUserGestureTimestamp = userGestureTimestamp;
-            mainHistory->m_currentUserGestureObjectsAdded = 0;
-        }
-
-        if (mainHistory->m_currentUserGestureObjectsAdded >= perUserGestureStateObjectLimit) {
-            ec.code = SECURITY_ERR;
-            if (stateObjectType == StateObjectType::Replace)
-                ec.message = String::format("Attempt to use history.replaceState() more than %u times per gesture", perUserGestureStateObjectLimit);
-            else
-                ec.message = String::format("Attempt to use history.pushState() more than %u times per user gesture", perUserGestureStateObjectLimit);
-            return;
-        }
+            ec.message = String::format("Attempt to use history.pushState() more than %u times per %f seconds", perStateObjectTimeSpanLimit, stateObjectTimeSpan);
+        return;
     }
 
@@ -217 +206 @@
 
     mainHistory->m_totalStateObjectUsage = newTotalUsage.unsafeGet();
-    if (processingUserGesture)
-        ++mainHistory->m_currentUserGestureObjectsAdded;
-    else
-        ++mainHistory->m_nonUserGestureObjectsAdded;
+    ++mainHistory->m_currentStateObjectTimeSpanObjectsAdded;
 
     if (!urlString.isEmpty())