Bust out of an <iframe> if Gerrit is embedded in one
Its a security risk to permit other web pages to insert a Gerrit
window into an iframe. They could use CSS tricks to layer some
innocent object over our page and mask the UI, so that the user
thinks they are clicking on a button to view a cute kitten, when
in fact they are submitting a change in ownership for an object
in Gerrit, like a project.
Since Gerrit isn't really intended to be used in a mashup, but
is instead a code review system that needs to be fairly paranoid
about the data it controls, its reasonable to require that we are
always the top level window for the browser.
This particular frame busting trick doesn't work in IE if the
attacker page turns off JavaScript in our <iframe>, but then
we wouldn't be able to render any of our widgets anyway, or do
any RPC calls, so no state could change as a result of such an
embedding attack.
I'm putting the code for this inside of the module load, so we
can't easily strip it out of a host page by accident, or through
some evil pre-processing trick. Its tightly compiled into the
obfuscated output, which makes it rather horrid to bypass.
We have to test for "GWT.isScript()" in order to bypass this in
the hosted mode debugging shell. That shell appears to at least
initially load Gerrit into some sort of <iframe> like environment,
and running this code there busts the debugger entirely. Since we
are only running locally from a controlled developer environment,
its not a security risk to bypass the frame busting code there.
Signed-off-by: Shawn O. Pearce <sop@google.com>
1 file changed
