SpeechRecognition interface and friends should be SecureContext

youennf · youennf · commit f60ba77b15ca · 2025-05-14T01:34:02.000-07:00
rdar://151240414 https://bugs.webkit.org/show_bug.cgi?id=292941 Reviewed by Brady Eidson, Per Arne Vollan, and Sihui Liu. Align implementation with WebAudio/web-speech-api#31. * LayoutTests/http/wpt/mediastream/speechrecognition-insecure-expected.txt: Added. * LayoutTests/http/wpt/mediastream/speechrecognition-insecure.html: Added. * Source/WebCore/Modules/speech/SpeechRecognition.idl: * Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl: * Source/WebCore/Modules/speech/SpeechRecognitionErrorEvent.idl: * Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl: * Source/WebCore/Modules/speech/SpeechRecognitionResult.idl: Canonical link: https://commits.webkit.org/294887@main
diff --git a/LayoutTests/http/wpt/mediastream/speechrecognition-insecure-expected.txt b/LayoutTests/http/wpt/mediastream/speechrecognition-insecure-expected.txt
@@ -0,0 +1,4 @@
+
+
+PASS SpeechRecognition and friends should not exist in insecure context
+
diff --git a/LayoutTests/http/wpt/mediastream/speechrecognition-insecure.html b/LayoutTests/http/wpt/mediastream/speechrecognition-insecure.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<head>
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<script>
+if (window.internals)
+    internals.markContextAsInsecure();
+
+function with_iframe(url) {
+    return new Promise(function(resolve) {
+        var frame = document.createElement('iframe');
+        frame.className = 'test-iframe';
+        frame.src = url;
+        frame.onload = function() { resolve(frame); };
+        document.body.appendChild(frame);
+    });
+}
+
+promise_test(async () => {
+    const frame = await with_iframe("/");
+    const w = frame.contentWindow;
+    assert_equals(w.SpeechRecognition, undefined);
+    assert_equals(w.SpeechRecognitionAlternative, undefined);
+    assert_equals(w.SpeechRecognitionErrorEvent, undefined);
+    assert_equals(w.SpeechRecognitionEvent, undefined);
+    assert_equals(w.SpeechRecognitionResult, undefined);
+},'SpeechRecognition and friends should not exist in insecure context');
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.idl b/Source/WebCore/Modules/speech/SpeechRecognition.idl
@@ -27,6 +27,7 @@
     ActiveDOMObject,
     EnabledBySetting=SpeechRecognitionEnabled,
     InterfaceName=webkitSpeechRecognition,
+    SecureContext,
     Exposed=Window
 ] interface SpeechRecognition : EventTarget {
     [CallWith=CurrentDocument] constructor();
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl
@@ -25,6 +25,7 @@
 
 [
     EnabledBySetting=SpeechRecognitionEnabled,
+    SecureContext,
     Exposed=Window
 ] interface SpeechRecognitionAlternative {
     readonly attribute DOMString transcript;
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionErrorEvent.idl b/Source/WebCore/Modules/speech/SpeechRecognitionErrorEvent.idl
@@ -25,6 +25,7 @@
 
 [
     EnabledBySetting=SpeechRecognitionEnabled,
+    SecureContext,
     Exposed=Window
 ] interface SpeechRecognitionErrorEvent : Event {
     constructor([AtomString] DOMString type, SpeechRecognitionErrorEventInit eventInitDict);
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl
@@ -25,6 +25,7 @@
 
 [
     EnabledBySetting=SpeechRecognitionEnabled,
+    SecureContext,
     Exposed=Window
 ] interface SpeechRecognitionEvent : Event {
     constructor([AtomString] DOMString type, SpeechRecognitionEventInit eventInitDict);
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
@@ -25,6 +25,7 @@
 
 [
     EnabledBySetting=SpeechRecognitionEnabled,
+    SecureContext,
     Exposed=Window
 ] interface SpeechRecognitionResult {
     readonly attribute unsigned long length;

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
++
++
 +PASS SpeechRecognition and friends should not exist in insecure context
++
Original file line number	Diff line number	Diff line change
`@@ -25,6 +25,7 @@`
`25`	`25`
`26`	`26`	`[`
`27`	`27`	`EnabledBySetting=SpeechRecognitionEnabled,`
	`28`	`+ SecureContext,`
`28`	`29`	`Exposed=Window`
`29`	`30`	`] interface SpeechRecognitionAlternative {`
`30`	`31`	`readonly attribute DOMString transcript;`