Changeset 196892 in webkit

Timestamp:

Feb 21, 2016, 9:26:17 PM (11 years ago)

Author:

dbates@webkit.org

Message:

CSP: Enable form-action directive by default
​https://bugs.webkit.org/show_bug.cgi?id=154520
<rdar://problem/24762029>

Reviewed by Sam Weinig.

Source/WebCore:

• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the form-action
directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.
(WebCore::isExperimentalDirectiveName): Remove form-action from the directives considered
experimental.

LayoutTests:

Mark form-action tests as Pass so that we run them.

• TestExpectations:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-02-21  Daniel Bates  <dabates@apple.com>
+
+        CSP: Enable form-action directive by default
+        https://bugs.webkit.org/show_bug.cgi?id=154520
+        <rdar://problem/24762029>
+
+        Reviewed by Sam Weinig.
+
+        Mark form-action tests as Pass so that we run them.
+
+        * TestExpectations:
+
 2016-02-21  Chris Dumez  <cdumez@apple.com>
 

trunk/LayoutTests/TestExpectations

@@ -804 +804 @@
 webkit.org/b/85558 http/tests/security/contentSecurityPolicy/1.1
 http/tests/security/contentSecurityPolicy/1.1/child-src [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-allowed.html [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-default-ignored.html [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-allowed.html [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html [ Pass ]
+http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html [ Pass ]
 http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php [ Pass ]
 webkit.org/b/154203 http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-overrides-xfo.html

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-02-21  Daniel Bates  <dabates@apple.com>
+
+        CSP: Enable form-action directive by default
+        https://bugs.webkit.org/show_bug.cgi?id=154520
+        <rdar://problem/24762029>
+
+        Reviewed by Sam Weinig.
+
+        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
+        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the form-action
+        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.
+        (WebCore::isExperimentalDirectiveName): Remove form-action from the directives considered
+        experimental.
+
 2016-02-21  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp

@@ -61 +61 @@
 {
     return equalLettersIgnoringASCIICase(name, baseURI)
-        || equalLettersIgnoringASCIICase(name, formAction)
         || equalLettersIgnoringASCIICase(name, pluginTypes)
         || equalLettersIgnoringASCIICase(name, reflectedXSS);
@@ -600 +599 @@
     else if (equalLettersIgnoringASCIICase(name, childSrc))
         setCSPDirective<ContentSecurityPolicySourceListDirective>(name, value, m_childSrc);
+    else if (equalLettersIgnoringASCIICase(name, formAction))
+        setCSPDirective<ContentSecurityPolicySourceListDirective>(name, value, m_formAction);
     else if (equalLettersIgnoringASCIICase(name, sandbox))
         applySandboxPolicy(name, value);
@@ -608 +609 @@
         if (equalLettersIgnoringASCIICase(name, baseURI))
             setCSPDirective<ContentSecurityPolicySourceListDirective>(name, value, m_baseURI);
-        else if (equalLettersIgnoringASCIICase(name, formAction))
-            setCSPDirective<ContentSecurityPolicySourceListDirective>(name, value, m_formAction);
         else if (equalLettersIgnoringASCIICase(name, pluginTypes))
             setCSPDirective<ContentSecurityPolicyMediaListDirective>(name, value, m_pluginTypes);