⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 197118 in webkit


Ignore:
Timestamp:
Feb 25, 2016, 8:21:40 AM (11 years ago)
Author:
dbates@webkit.org
Message:

CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
​https://bugs.webkit.org/show_bug.cgi?id=154522
<rdar://problem/24762078>

Reviewed by Brent Fulgham.

Source/WebCore:

Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
of the Content Security Policy Level 3 spec., <​https://w3c.github.io/webappsec-csp/> (24 February 2016).
Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
of whether ENABLE(CSP_NEXT) is enabled.

Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

  • WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
  • dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
  • dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this

code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
to support attributes statusCode and columnNumebr.

  • dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
and send a violation report (if applicable).

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html
to ensure that SecurityPolicyViolationEvent.statusCode is 0 when dispatched for a violation on an HTTPS-served
document per section Reporting of the Content Security Policy 2.0 spec, <​https://www.w3.org/TR/2015/CR-CSP2-20150721/>.
Update existing test results and mark more tests as PASS in file LayoutTests/TestExpectations.

  • TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS

so that we run them.

  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to

reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when
building with ENABLE(CSP_NEXT) disabled.

  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.
  • js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.
  • platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.
  • platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.
  • platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.
  • platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.
Location:
trunk
Files:
1 added
22 edited
1 copied

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r197114 r197118  
     12016-02-25  Daniel Bates  <dabates@apple.com>
     2
     3        CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
     4        https://bugs.webkit.org/show_bug.cgi?id=154522
     5        <rdar://problem/24762078>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Add new test http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html
     10        to ensure that SecurityPolicyViolationEvent.statusCode is 0 when dispatched for a violation on an HTTPS-served
     11        document per section Reporting of the Content Security Policy 2.0 spec, <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.
     12        Update existing test results and mark more tests as PASS in file LayoutTests/TestExpectations.
     13
     14        * TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS
     15        so that we run them.
     16        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to
     17        reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when
     18        building with ENABLE(CSP_NEXT) disabled.
     19        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.
     20        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.
     21        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.
     22        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.
     23        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.
     24        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.
     25        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.
     26        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.
     27        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.
     28        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.
     29        * js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.
     30        * platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.
     31        * platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.
     32        * platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.
     33        * platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.
     34
    1352016-02-25  Eric Carlson  <eric.carlson@apple.com>
    236

  • trunk/LayoutTests/TestExpectations

    r197038 r197118  
    815815http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html [ Pass ]
    816816http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php [ Pass ]
     817http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics.html [ Pass ]
     818http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html [ Pass ]
     819http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html [ Pass ]
     820http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html [ Pass ]
     821http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html [ Pass ]
     822http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html [ Pass ]
    817823webkit.org/b/154203 http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-overrides-xfo.html
    818824webkit.org/b/154203 http/tests/security/contentSecurityPolicy/1.1/scripthash-default-src.html

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt

    r195367 r197118  
    44
    55
    6 PASS typeof document.onsecuritypolicyviolation is "object"
     6FAIL typeof document.onsecuritypolicyviolation should be object. Was undefined.
    77PASS typeof SecurityPolicyViolationEvent is "function"
    88PASS typeof window.e is "object"

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt

    r195367 r197118  
    1414PASS window.e.originalPolicy is "img-src 'none'"
    1515PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html"
    16 PASS window.e.lineNumber is 23
    17 PASS window.e.columnNumber is 21
     16PASS window.e.lineNumber is 25
     17PASS window.e.columnNumber is 16
    1818PASS window.e.statusCode is 200
    1919PASS successfullyParsed is true

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt

    r195367 r197118  
    1515PASS window.e.sourceFile is "http://localhost:8000"
    1616PASS window.e.lineNumber is 3
    17 PASS window.e.columnNumber is 7
     17PASS window.e.columnNumber is 2
    1818PASS window.e.statusCode is 200
    1919PASS successfullyParsed is true

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html

    r195367 r197118  
    1717            'sourceFile': 'http://localhost:8000',
    1818            'lineNumber': 3,
    19             'columnNumber': 7,
     19            'columnNumber': 2,
    2020            'statusCode': 200,
    2121        };

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html

    r195367 r197118  
    1616            'originalPolicy': 'img-src \'none\'',
    1717            'sourceFile': document.location.toString(),
    18             'lineNumber': 23,
    19             'columnNumber': 21,
     18            'lineNumber': 25,
     19            'columnNumber': 16,
    2020            'statusCode': 200,
    2121        };

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt

    r195367 r197118  
    1414PASS window.e.originalPolicy is "img-src 'none'"
    1515PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    16 PASS window.e.lineNumber is 23
    17 PASS window.e.columnNumber is 21
     16PASS window.e.lineNumber is 25
     17PASS window.e.columnNumber is 16
    1818PASS window.e.statusCode is 200
    1919PASS successfullyParsed is true

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt

    r195367 r197118  
    1515PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/resources/inject-image.js"
    1616PASS window.e.lineNumber is 3
    17 PASS window.e.columnNumber is 7
     17PASS window.e.columnNumber is 2
    1818PASS window.e.statusCode is 200
    1919PASS successfullyParsed is true

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html

    r195367 r197118  
    1717            'sourceFile': 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/inject-image.js',
    1818            'lineNumber': 3,
    19             'columnNumber': 7,
     19            'columnNumber': 2,
    2020            'statusCode': 200,
    2121        };

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt

    r197114 r197118  
    11CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".
    22
     3
     4
     5--------
     6Frame: '<!--framePath //<!--frame0-->-->'
     7--------
    38Check that a SecurityPolicyViolationEvent is fired upon blocking an image.
    49
    … …  
    712
    813Kicking off the tests:
    9 PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    10 PASS window.e.referrer is ""
    11 PASS window.e.blockedURI is "http://127.0.0.1:8000/security/resources/abe.png"
     14PASS window.e.documentURI is "https://127.0.0.1:8443/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
     15PASS window.e.referrer is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html"
     16FAIL window.e.blockedURI should be http://127.0.0.1:8000/security/resources/abe.png. Was http://127.0.0.1:8000.
    1217PASS window.e.violatedDirective is "img-src 'none'"
    1318PASS window.e.effectiveDirective is "img-src"
    1419PASS window.e.originalPolicy is "img-src 'none'"
    15 PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    16 PASS window.e.lineNumber is 23
    17 PASS window.e.columnNumber is 21
    18 PASS window.e.statusCode is 200
     20PASS window.e.sourceFile is "https://127.0.0.1:8443/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
     21PASS window.e.lineNumber is 25
     22PASS window.e.columnNumber is 16
     23PASS window.e.statusCode is 0
    1924PASS successfullyParsed is true
    2025

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html

    r195367 r197118  
    1616            'originalPolicy': 'img-src \'none\'',
    1717            'sourceFile': document.location.toString(),
    18             'lineNumber': 23,
    19             'columnNumber': 21,
    20             'statusCode': 200,
     18            'lineNumber': 25,
     19            'columnNumber': 16,
     20            'statusCode': document.location.protocol === 'http:' ? 200 : 0,
    2121        };
    2222
    2323        function run() {
    2424            var img = document.createElement('img');
    25             img.src = '/security/resources/abe.png';
     25            img.src = 'http://127.0.0.1:8000/security/resources/abe.png';
    2626            document.body.appendChild(img);
    2727        }

  • trunk/LayoutTests/js/dom/global-constructors-attributes-expected.txt

    r197049 r197118  
    17191719PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').enumerable is false
    17201720PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').configurable is true
     1721PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').value is SecurityPolicyViolationEvent
     1722PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('get') is false
     1723PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('set') is false
     1724PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').enumerable is false
     1725PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').configurable is true
    17211726PASS Object.getOwnPropertyDescriptor(global, 'Selection').value is Selection
    17221727PASS Object.getOwnPropertyDescriptor(global, 'Selection').hasOwnProperty('get') is false

  • trunk/LayoutTests/platform/efl/js/dom/global-constructors-attributes-expected.txt

    r197049 r197118  
    17891789PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').enumerable is false
    17901790PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').configurable is true
     1791PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').value is SecurityPolicyViolationEvent
     1792PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('get') is false
     1793PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('set') is false
     1794PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').enumerable is false
     1795PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').configurable is true
    17911796PASS Object.getOwnPropertyDescriptor(global, 'Selection').value is Selection
    17921797PASS Object.getOwnPropertyDescriptor(global, 'Selection').hasOwnProperty('get') is false

  • trunk/LayoutTests/platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt

    r197049 r197118  
    17991799PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').enumerable is false
    18001800PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').configurable is true
     1801PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').value is SecurityPolicyViolationEvent
     1802PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('get') is false
     1803PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('set') is false
     1804PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').enumerable is false
     1805PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').configurable is true
    18011806PASS Object.getOwnPropertyDescriptor(global, 'Selection').value is Selection
    18021807PASS Object.getOwnPropertyDescriptor(global, 'Selection').hasOwnProperty('get') is false

  • trunk/LayoutTests/platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt

    r197049 r197118  
    19241924PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').enumerable is false
    19251925PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').configurable is true
     1926PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').value is SecurityPolicyViolationEvent
     1927PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('get') is false
     1928PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('set') is false
     1929PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').enumerable is false
     1930PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').configurable is true
    19261931PASS Object.getOwnPropertyDescriptor(global, 'Selection').value is Selection
    19271932PASS Object.getOwnPropertyDescriptor(global, 'Selection').hasOwnProperty('get') is false

  • trunk/LayoutTests/platform/mac/js/dom/global-constructors-attributes-expected.txt

    r197049 r197118  
    19241924PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').enumerable is false
    19251925PASS Object.getOwnPropertyDescriptor(global, 'ScriptProcessorNode').configurable is true
     1926PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').value is SecurityPolicyViolationEvent
     1927PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('get') is false
     1928PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').hasOwnProperty('set') is false
     1929PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').enumerable is false
     1930PASS Object.getOwnPropertyDescriptor(global, 'SecurityPolicyViolationEvent').configurable is true
    19261931PASS Object.getOwnPropertyDescriptor(global, 'Selection').value is Selection
    19271932PASS Object.getOwnPropertyDescriptor(global, 'Selection').hasOwnProperty('get') is false

  • trunk/Source/WebCore/ChangeLog

    r197114 r197118  
     12016-02-25  Daniel Bates  <dabates@apple.com>
     2
     3        CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
     4        https://bugs.webkit.org/show_bug.cgi?id=154522
     5        <rdar://problem/24762078>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
     10        as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
     11        of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (24 February 2016).
     12        Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
     13        of whether ENABLE(CSP_NEXT) is enabled.
     14
     15        Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html
     16
     17        * WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
     18        * dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
     19        * dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this
     20        code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
     21        to support attributes statusCode and columnNumebr.
     22        * dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
     23        * page/csp/ContentSecurityPolicy.cpp:
     24        (WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
     25        and send a violation report (if applicable).
     26
    1272016-02-25  Eric Carlson  <eric.carlson@apple.com>
    228

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r197058 r197118  
    62566256                CECADFCE1537791D00E37068 /* TextInsertionBaseCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = CECADFCC1537791D00E37068 /* TextInsertionBaseCommand.h */; };
    62576257                CECCFC3B141973D5002A0AC1 /* DecodeEscapeSequences.h in Headers */ = {isa = PBXBuildFile; fileRef = CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */; };
     6258                CED06AD01C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CED06ACE1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp */; };
     6259                CED06AD11C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = CED06ACF1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h */; };
    62586260                CEDA12D7152CA1CB00D9E08D /* AlternativeTextClient.h in Headers */ = {isa = PBXBuildFile; fileRef = CEDA12D6152CA1CB00D9E08D /* AlternativeTextClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
    62596261                CEE27ACB1BBB53A20072400A /* pthreadSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = CEE27ACA1BBB53A20072400A /* pthreadSPI.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    1427914281                CECADFCC1537791D00E37068 /* TextInsertionBaseCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextInsertionBaseCommand.h; sourceTree = "<group>"; };
    1428014282                CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodeEscapeSequences.h; sourceTree = "<group>"; };
     14283                CED06ACE1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSecurityPolicyViolationEvent.cpp; sourceTree = "<group>"; };
     14284                CED06ACF1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSecurityPolicyViolationEvent.h; sourceTree = "<group>"; };
    1428114285                CEDA12D6152CA1CB00D9E08D /* AlternativeTextClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AlternativeTextClient.h; sourceTree = "<group>"; };
    1428214286                CEE27ACA1BBB53A20072400A /* pthreadSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = pthreadSPI.h; sourceTree = "<group>"; };
    … …  
    2098720991                                5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */,
    2098820992                                5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */,
     20993                                CED06ACE1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp */,
     20994                                CED06ACF1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h */,
    2098920995                                933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,
    2099020996                                933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,
    … …  
    2681826824                                9FA37EFB1172FDA600C4CD55 /* JSScriptProfile.h in Headers */,
    2681926825                                9FA37EFD1172FDA600C4CD55 /* JSScriptProfileNode.h in Headers */,
     26826                                CED06AD11C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h in Headers */,
    2682026827                                9BDA64D81B975CF2009C4387 /* JSShadowRoot.h in Headers */,
    2682126828                                CD9DE17B17AAC75B00EA386D /* JSSourceBuffer.h in Headers */,
    … …  
    3057330580                                9FA37EFA1172FDA600C4CD55 /* JSScriptProfile.cpp in Sources */,
    3057430581                                9FA37EFC1172FDA600C4CD55 /* JSScriptProfileNode.cpp in Sources */,
     30582                                CED06AD01C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp in Sources */,
    3057530583                                9BDA64D71B975CE5009C4387 /* JSShadowRoot.cpp in Sources */,
    3057630584                                CD9DE17A17AAC75B00EA386D /* JSSourceBuffer.cpp in Sources */,

  • trunk/Source/WebCore/dom/EventNames.in

    r192464 r197118  
    5858AutocompleteErrorEvent conditional=REQUEST_AUTOCOMPLETE
    5959CSSFontFaceLoadEvent conditional=FONT_LOAD_EVENTS
    60 SecurityPolicyViolationEvent conditional=CSP_NEXT
     60SecurityPolicyViolationEvent
    6161UIRequestEvent conditional=INDIE_UI
    6262GestureEvent conditional=IOS_GESTURE_EVENTS|MAC_GESTURE_EVENTS

  • trunk/Source/WebCore/dom/SecurityPolicyViolationEvent.h

    r196400 r197118  
    11/*
    22 * Copyright (C) 2013 Google Inc. All rights reserved.
     3 * Copyright (C) 2016 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    2627#define SecurityPolicyViolationEvent_h
    2728
    28 #if ENABLE(CSP_NEXT)
    29 
    3029#include "Event.h"
    3130
    … …  
    4039    String originalPolicy;
    4140    String sourceFile;
     41    unsigned short statusCode { 0 };
    4242    int lineNumber { 0 };
     43    int columnNumber { 0 };
    4344};
    4445
    4546class SecurityPolicyViolationEvent final : public Event {
    4647public:
    47     static Ref<SecurityPolicyViolationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, int lineNumber)
     48    static Ref<SecurityPolicyViolationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, unsigned short statusCode, int lineNumber, int columnNumber)
    4849    {
    49         return adoptRef(*new SecurityPolicyViolationEvent(type, canBubble, cancelable, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, lineNumber));
     50        return adoptRef(*new SecurityPolicyViolationEvent(type, canBubble, cancelable, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, statusCode, lineNumber, columnNumber));
    5051    }
    5152
    … …  
    6768    const String& originalPolicy() const { return m_originalPolicy; }
    6869    const String& sourceFile() const { return m_sourceFile; }
     70    unsigned short statusCode() const { return m_statusCode; }
    6971    int lineNumber() const { return m_lineNumber; }
     72    int columnNumber() const { return m_columnNumber; }
    7073
    7174    virtual EventInterface eventInterface() const { return SecurityPolicyViolationEventInterfaceType; }
    … …  
    7679    }
    7780
    78     SecurityPolicyViolationEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, int lineNumber)
     81    SecurityPolicyViolationEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, unsigned short statusCode, int lineNumber, int columnNumber)
    7982        : Event(type, canBubble, cancelable)
    8083        , m_documentURI(documentURI)
    … …  
    8588        , m_originalPolicy(originalPolicy)
    8689        , m_sourceFile(sourceFile)
     90        , m_statusCode(statusCode)
    8791        , m_lineNumber(lineNumber)
     92        , m_columnNumber(columnNumber)
    8893    {
    8994    }
    … …  
    98103        , m_originalPolicy(initializer.originalPolicy)
    99104        , m_sourceFile(initializer.sourceFile)
     105        , m_statusCode(initializer.statusCode)
    100106        , m_lineNumber(initializer.lineNumber)
     107        , m_columnNumber(initializer.columnNumber)
    101108    {
    102109    }
    … …  
    109116    String m_originalPolicy;
    110117    String m_sourceFile;
     118    unsigned short m_statusCode;
    111119    int m_lineNumber;
     120    int m_columnNumber;
    112121};
    113122
    114123} // namespace WebCore
    115124
    116 #endif // ENABLE(CSP_NEXT)
    117 
    118125#endif // SecurityPolicyViolationEvent_h

  • trunk/Source/WebCore/dom/SecurityPolicyViolationEvent.idl

    r146763 r197118  
    11/*
    22 * Copyright (C) 2013 Google Inc. All rights reserved.
     3 * Copyright (C) 2016 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    2425
    2526[
    26     Conditional=CSP_NEXT,
    2727    ConstructorTemplate=Event,
    2828] interface SecurityPolicyViolationEvent : Event {
    … …  
    3434    [InitializedByEventConstructor] readonly attribute DOMString originalPolicy;
    3535    [InitializedByEventConstructor] readonly attribute DOMString sourceFile;
    36     [InitializedByEventConstructor] readonly attribute long      lineNumber;
     36    [InitializedByEventConstructor] readonly attribute unsigned short statusCode;
     37    [InitializedByEventConstructor] readonly attribute long lineNumber;
     38    [InitializedByEventConstructor] readonly attribute long columnNumber;
    3739};

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r196877 r197118  
    343343        return;
    344344
    345 #if ENABLE(CSP_NEXT)
    346     if (experimentalFeaturesEnabled()) {
    347         // FIXME: This code means that we're gathering information like line numbers twice. Once we can bring this out from behind the flag, we should reuse the data gathered here when generating the JSON report below.
    348         String documentURI = document.url().string();
    349         String referrer = document.referrer();
    350         String blockedURI = stripURLForUseInReport(document, blockedURL);
    351         String violatedDirective = directiveText;
    352         String originalPolicy = header;
    353         String sourceFile = String();
    354         int lineNumber = 0;
    355        
    356         Ref<ScriptCallStack> stack = createScriptCallStack(JSMainThreadExecState::currentState(), 2);
    357         const ScriptCallFrame* callFrame = stack->firstNonNativeCallFrame();
    358         if (callFrame && callFrame->lineNumber()) {
    359             URL source = URL(URL(), callFrame->sourceURL());
    360             sourceFile = stripURLForUseInReport(document, source);
    361             lineNumber = callFrame->lineNumber();
    362         }
    363 
    364         document.enqueueDocumentEvent(SecurityPolicyViolationEvent::create(eventNames().securitypolicyviolationEvent, false, false, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, lineNumber));
    365     }
    366 #endif
    367 
     345    String documentURI = document.url().strippedForUseAsReferrer();
     346    String referrer = document.referrer();
     347    String blockedURI = stripURLForUseInReport(document, blockedURL);
     348    String violatedDirective = directiveText;
     349    String originalPolicy = header;
     350    ASSERT(document.loader());
     351    unsigned short statusCode = document.url().protocolIs("http") && document.loader() ? document.loader()->response().httpStatusCode() : 0;
     352
     353    String sourceFile;
     354    int lineNumber = 0;
     355    int columnNumber = 0;
     356    RefPtr<ScriptCallStack> stack = createScriptCallStack(JSMainThreadExecState::currentState(), 2);
     357    const ScriptCallFrame* callFrame = stack->firstNonNativeCallFrame();
     358    if (callFrame && callFrame->lineNumber()) {
     359        sourceFile = stripURLForUseInReport(document, URL(URL(), callFrame->sourceURL()));
     360        lineNumber = callFrame->lineNumber();
     361        columnNumber = callFrame->columnNumber();
     362    }
     363
     364    // 1. Dispatch violation event.
     365    bool canBubble = false;
     366    bool cancelable = false;
     367    document.enqueueDocumentEvent(SecurityPolicyViolationEvent::create(eventNames().securitypolicyviolationEvent, canBubble, cancelable, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, statusCode, lineNumber, columnNumber));
     368
     369    // 2. Send violation report (if applicable).
    368370    if (reportURIs.isEmpty())
    369371        return;
    … …  
    380382
    381383    RefPtr<InspectorObject> cspReport = InspectorObject::create();
    382     cspReport->setString(ASCIILiteral("document-uri"), document.url().strippedForUseAsReferrer());
    383     cspReport->setString(ASCIILiteral("referrer"), document.referrer());
     384    cspReport->setString(ASCIILiteral("document-uri"), documentURI);
     385    cspReport->setString(ASCIILiteral("referrer"), referrer);
    384386    cspReport->setString(ASCIILiteral("violated-directive"), directiveText);
    385387    cspReport->setString(ASCIILiteral("effective-directive"), effectiveDirective);
    386     cspReport->setString(ASCIILiteral("original-policy"), header);
    387     cspReport->setString(ASCIILiteral("blocked-uri"), stripURLForUseInReport(document, blockedURL));
    388 
    389     ASSERT(document.loader());
    390     cspReport->setInteger(ASCIILiteral("status-code"), document.url().protocolIs("http") && document.loader() ? document.loader()->response().httpStatusCode() : 0);
    391 
    392     RefPtr<ScriptCallStack> stack = createScriptCallStack(JSMainThreadExecState::currentState(), 2);
    393     const ScriptCallFrame* callFrame = stack->firstNonNativeCallFrame();
    394     if (callFrame && callFrame->lineNumber()) {
    395         URL source = URL(URL(), callFrame->sourceURL());
    396         cspReport->setString(ASCIILiteral("source-file"), stripURLForUseInReport(document, source));
    397         cspReport->setInteger(ASCIILiteral("line-number"), callFrame->lineNumber());
    398         cspReport->setInteger(ASCIILiteral("column-number"), callFrame->columnNumber());
     388    cspReport->setString(ASCIILiteral("original-policy"), originalPolicy);
     389    cspReport->setString(ASCIILiteral("blocked-uri"), blockedURI);
     390    cspReport->setInteger(ASCIILiteral("status-code"), statusCode);
     391    if (!sourceFile.isNull()) {
     392        cspReport->setString(ASCIILiteral("source-file"), sourceFile);
     393        cspReport->setInteger(ASCIILiteral("line-number"), lineNumber);
     394        cspReport->setInteger(ASCIILiteral("column-number"), columnNumber);
    399395    }
    400396
    … …  
    403399
    404400    RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());
    405 
    406401    for (const auto& url : reportURIs)
    407402        PingLoader::sendViolationReport(*frame, document.completeURL(url), report.copyRef(), ViolationReportType::ContentSecurityPolicy);
Note: See TracChangeset for help on using the changeset viewer.