commit d5d8dff80df5e6df3a090afe30c6220c020aa893
author wenson_hsieh@apple.com <wenson_hsieh@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Mon Oct 16 07:59:39 2017 +0000
committer wenson_hsieh@apple.com <wenson_hsieh@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Mon Oct 16 07:59:39 2017 +0000
tree 74a77f402e52b48d5148f5b3ec7ba77408ec22cd
parent 0f8b4d043ce6e3e58e059a68f31e33e63f84d8ba

On ToT, event.dataTransfer.getData("text/uri-list") returns an empty string when dragging an image
https://bugs.webkit.org/show_bug.cgi?id=178301
<rdar://problem/34990050>

Reviewed by Darin Adler.

Source/WebCore:

After r222656, we consider images on the pasteboard to be files. This causes DataTransfer.getData to return the
empty string for all types, which brings back https://bugs.webkit.org/show_bug.cgi?id=170637. To allow pages to
access the URL part of a dragged image, we exempt "text/uri-list" from our heurstics to hide pasteboard data
which may contain files, and return the URL as long as its protocol is either HTTP or HTTPS.

Tweaked an existing layout test to cover this scenario, as well as the scenario in which the dragged image links
to a file URL (in which case we should avoid exposing the data).

Test: editing/pasteboard/drag-drop-href-as-url.html
      DataInteractionTests.DataTransferGetDataWhenDroppingImageWithHTTPURL

* dom/DataTransfer.cpp:
(WebCore::DataTransfer::getDataForItem const):

When the pasteboard contains files, allow data for "text/uri-list" to be returned, as long as the URL string has
a white-listed protocol (currently, this is just http and https).

(WebCore::DataTransfer::shouldSuppressGetAndSetDataToAvoidExposingFilePaths const):
(WebCore::DataTransfer::setData):
(WebCore::DataTransfer::types const):

When the pasteboard contains files, allow "text/uri-list" to be added, alongside the "Files" type, if it would
have been exposed in the list of safe DOM types.

* dom/DataTransfer.h:
* platform/Pasteboard.cpp:
(WebCore::Pasteboard::canExposeURLToDOMWhenPasteboardContainsFiles):

Add a new helper method to determine whether it is safe to expose an URL string as "text/uri-list" to bindings,
if the pasteboard contains files. While this currently checks whether or not the URL is in the HTTP family, we
may want to consider tweaking this to blacklist the "file" protocol instead, and allow all other valid URLs by
default.

* platform/Pasteboard.h:
* platform/PlatformPasteboard.h:
* platform/ios/PlatformPasteboardIOS.mm:
(WebCore::pasteboardMayContainFilePaths):
(WebCore::PlatformPasteboard::stringForType const):

Mark stringForType as const, and also teach stringForType to return the null string for the platform URL type if
the pasteboard might contain file paths.

(WebCore::PlatformPasteboard::typesSafeForDOMToReadAndWrite const):

Before coercing a platform type to "text/uri-list" when building the list of DOM-safe types, check that the
stringForType is not the empty string, in which case we don't expose the type to the DOM at all. This ensures
that in cases where the URL might reveal a file path, we don't advertise "text/uri-list" as a type. We adopt a
similar strategy on iOS.

(WebCore::PlatformPasteboard::stringForType): Deleted.
* platform/mac/PlatformPasteboardMac.mm:
(WebCore::pasteboardMayContainFilePaths):
(WebCore::PlatformPasteboard::stringForType const):
(WebCore::PlatformPasteboard::typesSafeForDOMToReadAndWrite const):
(WebCore::PlatformPasteboard::stringForType): Deleted.

Tools:

Fixes issues in DumpRenderTree's LocalPasteboard to ensure that drag-drop-href-as-url.html exposes files, and
also adds a new iOS drag and drop API test.

* DumpRenderTree/mac/DumpRenderTreePasteboard.mm:
(-[LocalPasteboard addTypes:owner:]):
(-[LocalPasteboard setData:forType:]):

Fixes LocalPasteboard's implementation of changeCount to incremement when the pasteboard owner changes, rather
than every time data is changed. This is consistent with NSPasteboard behavior.

* TestWebKitAPI/Tests/ios/DataInteractionTests.mm:
(TestWebKitAPI::TEST):

Adds a new API test to verify that an image and HTTP URL written by the platform is correctly web exposed.

LayoutTests:

Fixes an existing test to account for asynchronous image decoding, and also rebaselines results to expect that
only the URL can be read, and not text.

* TestExpectations:
* editing/pasteboard/data-transfer-item-list-add-file-multiple-times-expected.txt:
* editing/pasteboard/drag-drop-href-as-text-data-expected.txt: Removed.
* editing/pasteboard/drag-drop-href-as-text-data.html: Removed.
* editing/pasteboard/drag-drop-href-as-url-expected.txt: Added.
* editing/pasteboard/drag-drop-href-as-url.html: Added.

Tweaks an existing drag and drop test to verify that an URL can be read back when dragging an image, but not
when if the URL is a file URL.

* editing/pasteboard/files-during-page-drags-expected.txt:
* editing/pasteboard/files-during-page-drags.html:

Fixes this test by decoding the dragged image element before starting the drag and drop simulation.

* platform/mac-wk1/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@223340 268f45cc-cd09-0410-ab3c-d52691b4dbfc