Changeset 228486 in webkit


Ignore:
Timestamp:
Feb 14, 2018 2:27:52 PM (6 years ago)
Author:
dbates@webkit.org
Message:

Disallow cross-origin subresources from asking for credentials
​https://bugs.webkit.org/show_bug.cgi?id=182579
<rdar://problem/36162271>

Reviewed by Andy Estes.

Source/WebCore:

Prompts for credentials to load cross-origin subresources are typically seen as unexpected
by a person that navigates to- or interacts with- a web page. The cross-origin and implicit
loading nature of these subresources makes asking for credentials questionable because they
are not being served by the same origin of the page a person explicitly loaded and are not
guaranteed to correspond to an explicit user interaction other than the initial load of the
page. We know that subresources that ask for credentials can be abused as part of a phishing
attack. It seems reasonable to disallow cross-origin subresources from asking for credentials
due to their questionable nature and the risk for abuse. This will also make the behavior
of WebKit match the behavior of Chrome.

Tests: http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials.html

http/tests/security/basic-auth-subresource.html
http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.html
http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html

  • loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::isSubresourceLoader const): Formerly non-const.
(WebCore::ResourceLoader::shouldAllowResourceToAskForCredentials const): Added.
(WebCore::ResourceLoader::didBlockAuthenticationChallenge): Emit Web Inspector console message if
the authentication challenge was blocked because the request is cross origin.
(WebCore::ResourceLoader::isAllowedToAskUserForCredentials const): Disallow a cross-origin
request from prompting for credentials.
(WebCore::ResourceLoader::isSubresourceLoader): Deleted; made const.

  • loader/ResourceLoader.h:
  • loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::SubresourceLoader): Update ResourceLoader state so that block cross-origin
subresources from prompting for credentials, if applicable.
(WebCore::SubresourceLoader::isSubresourceLoader const): Formerly non-const.
(WebCore::SubresourceLoader::isSubresourceLoader): Deleted; made const.

  • loader/SubresourceLoader.h:
  • page/Settings.yaml: Add setting allowCrossOriginSubresourcesToAskForCredentials (defaults: false -

do not allow cross origin subresources to ask for credentials).

Source/WebKit:

Add a private preference to toggle allowing non-mixed content cross-origin subresources to load.
WebKitTestRunner toggles this preference when it sees the test option allowCrossOriginSubresourcesToAskForCredential.

  • Shared/WebPreferences.yaml:
  • UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetAllowCrossOriginSubresourcesToAskForCredentials):
(WKPreferencesGetAllowCrossOriginSubresourcesToAskForCredentials):

  • UIProcess/API/C/WKPreferencesRefPrivate.h:

Source/WebKitLegacy/mac:

Add a private preference to toggle allowing non-mixed content cross-origin subresources to load.
DumpRenderTree toggles this preference when it sees the test option allowCrossOriginSubresourcesToAskForCredential.

  • WebView/WebPreferenceKeysPrivate.h:
  • WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences allowCrossOriginSubresourcesToAskForCredentials]):
(-[WebPreferences setAllowCrossOriginSubresourcesToAskForCredentials:]):

  • WebView/WebPreferencesPrivate.h:
  • WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Tools:

Add test option allowCrossOriginSubresourcesToAskForCredential (defaults to false)
so that tests can toggle between the old behavior and new behavior.

  • DumpRenderTree/TestOptions.h:
  • DumpRenderTree/TestOptions.mm:

(TestOptions::TestOptions):

  • DumpRenderTree/mac/DumpRenderTree.mm:

(setWebPreferencesForTestOptions):

  • WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues):
(WTR::updateTestOptionsFromTestHeader):

  • WebKitTestRunner/TestOptions.h:

(WTR::TestOptions::hasSameInitializationOptions const):

LayoutTests:

Copied existing tests that depended on cross-origin subresources being able prompt for credentials
to files with suffix allowCrossOriginSubresourcesToAskForCredentials. These copies were modified
to set allowCrossOriginSubresourcesToAskForCredentials to false so as to opt-into the behavior
before this change. Updated existing tests to reflect the new behavior and added new tests to
ensure that we do not regress the new behavior.

  • http/tests/media/video-auth-expected.txt:
  • http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/http/tests/media/video-auth-expected.txt.
  • http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials.html: Copied from LayoutTests/http/tests/media/video-auth.html.
  • http/tests/media/video-auth.html:
  • http/tests/security/basic-auth-subresource-expected.txt: Added.
  • http/tests/security/basic-auth-subresource.html: Added.
  • http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Renamed from LayoutTests/platform/mac-wk1/http/tests/security/credentials-iframes-expected.txt.
  • http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials.html: Added.
  • http/tests/security/credentials-iframes-expected.txt:
  • http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/insecure-basic-auth-image.https-expected.txt.
  • http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
  • http/tests/security/mixedContent/insecure-basic-auth-image.https-expected.txt:
  • http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-expected.txt.
  • http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.html: Added.
  • http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-expected.txt:
  • http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https-expected.txt.
  • http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
  • http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https-expected.txt:
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https-expected.txt.
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https-expected.txt:
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Renamed from LayoutTests/platform/mac-wk1/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt.
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt:
  • http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html:
  • http/tests/security/resources/basic-auth-subresource.html: Added.
  • http/tests/security/resources/subresource1/protected-image.php: Added.
  • http/tests/security/resources/subresource2/protected-image.php: Added.
  • platform/win/TestExpectations: Skip allowCrossOriginSubresourcesToAskForCredentials-suffixed tests as

DumpRenderTree on Windows does not support parsing test options. See <​https://bugs.webkit.org/show_bug.cgi?id=173281>.

  • platform/win/http/tests/security/basic-auth-subresource-expected.txt: Added Windows-specific result. For some reason

connections to localhost:8443 are not allowed. See <​https://bugs.webkit.org/show_bug.cgi?id=182609> for more details.

  • platform/wk2/http/tests/media/video-auth-expected.txt:
  • platform/wk2/http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/platform/wk2/http/tests/media/video-auth-expected.txt.
  • platform/wk2/http/tests/security/basic-auth-subresource-expected.txt: Added.
  • platform/wk2/http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/http/tests/security/credentials-iframes-expected.txt.
  • platform/wk2/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt.
Location:
trunk
Files:
12 added
1 deleted
33 edited
15 copied

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r228484 r228486  
     12018-02-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow cross-origin subresources from asking for credentials
     4        https://bugs.webkit.org/show_bug.cgi?id=182579
     5        <rdar://problem/36162271>
     6
     7        Reviewed by Andy Estes.
     8
     9        Copied existing tests that depended on cross-origin subresources being able prompt for credentials
     10        to files with suffix allowCrossOriginSubresourcesToAskForCredentials. These copies were modified
     11        to set allowCrossOriginSubresourcesToAskForCredentials to false so as to opt-into the behavior
     12        before this change. Updated existing tests to reflect the new behavior and added new tests to
     13        ensure that we do not regress the new behavior.
     14
     15        * http/tests/media/video-auth-expected.txt:
     16        * http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/http/tests/media/video-auth-expected.txt.
     17        * http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials.html: Copied from LayoutTests/http/tests/media/video-auth.html.
     18        * http/tests/media/video-auth.html:
     19        * http/tests/security/basic-auth-subresource-expected.txt: Added.
     20        * http/tests/security/basic-auth-subresource.html: Added.
     21        * http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Renamed from LayoutTests/platform/mac-wk1/http/tests/security/credentials-iframes-expected.txt.
     22        * http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials.html: Added.
     23        * http/tests/security/credentials-iframes-expected.txt:
     24        * http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/insecure-basic-auth-image.https-expected.txt.
     25        * http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
     26        * http/tests/security/mixedContent/insecure-basic-auth-image.https-expected.txt:
     27        * http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-expected.txt.
     28        * http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.html: Added.
     29        * http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-expected.txt:
     30        * http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https-expected.txt.
     31        * http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
     32        * http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https-expected.txt:
     33        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https-expected.txt.
     34        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
     35        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https-expected.txt:
     36        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Renamed from LayoutTests/platform/mac-wk1/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt.
     37        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html.
     38        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt:
     39        * http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html:
     40        * http/tests/security/resources/basic-auth-subresource.html: Added.
     41        * http/tests/security/resources/subresource1/protected-image.php: Added.
     42        * http/tests/security/resources/subresource2/protected-image.php: Added.
     43        * platform/win/TestExpectations: Skip allowCrossOriginSubresourcesToAskForCredentials-suffixed tests as
     44        DumpRenderTree on Windows does not support parsing test options. See <https://bugs.webkit.org/show_bug.cgi?id=173281>.
     45        * platform/win/http/tests/security/basic-auth-subresource-expected.txt: Added Windows-specific result. For some reason
     46        connections to localhost:8443 are not allowed. See <https://bugs.webkit.org/show_bug.cgi?id=182609> for more details.
     47        * platform/wk2/http/tests/media/video-auth-expected.txt:
     48        * platform/wk2/http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/platform/wk2/http/tests/media/video-auth-expected.txt.
     49        * platform/wk2/http/tests/security/basic-auth-subresource-expected.txt: Added.
     50        * platform/wk2/http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials-expected.txt: Copied from LayoutTests/http/tests/security/credentials-iframes-expected.txt.
     51        * platform/wk2/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt: Copied from LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt.
     52
    1532018-02-14  Matt Lewis  <jlewis3@apple.com>
    254

  • trunk/LayoutTests/http/tests/media/video-auth-expected.txt

    r202579 r228486  
    11http://127.0.0.1:8000/media/resources/video-auth.php?name=test.mp4&type=video/mp4 - didReceiveAuthenticationChallenge - Responding with username:password
    2 http://localhost:8000/media/resources/video-auth.php?name=test.mp4&type=video/mp4 - didReceiveAuthenticationChallenge - Responding with username:password
    32 
    43Tests that the media player sends authorization credentials when requesting a media file.
    54Testing same domain (127.0.0.1)
    65EVENT(canplay)
    7 Testing cross domain (localhost)
    8 EVENT(canplay)
    96END OF TEST
    107

  • trunk/LayoutTests/http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials.html

    r228484 r228486  
     1<!DOCTYPE html><!-- webkit-test-runner [ allowCrossOriginSubresourcesToAskForCredentials=true ] -->
    12<html>
    23    <head>

  • trunk/LayoutTests/http/tests/media/video-auth.html

    r202579 r228486  
     1<!DOCTYPE html>
    12<html>
    23    <head>
    … …  
    1920                findMediaElement();
    2021                waitForEventAndFail('error');
    21                 waitForEvent('canplay', runNextTest);
     22                waitForEventAndEnd('canplay');
    2223
    23                 tests = [
    24                     testSameDomain,
    25                     testCrossDomain,
    26                 ];
    27 
    28                 runNextTest();
    29             }
    30 
    31             function runNextTest()
    32             {
    33                 var test = tests.shift();
    34                 if (test)
    35                     test();
    36                 else
    37                     endTest();
     24                testSameDomain();
    3825            }
    3926
    … …  
    4229                consoleWrite('Testing same domain (127.0.0.1)');
    4330                video.src = 'http://127.0.0.1:8000/media/resources/video-auth.php?name=' + media + '&type=' + type;
    44                 video.load();
    45             }
    46 
    47             function testCrossDomain()
    48             {
    49                 consoleWrite('Testing cross domain (localhost)');
    50                 video.src = 'http://localhost:8000/media/resources/video-auth.php?name=' + media + '&type=' + type;
    5131                video.load();
    5232            }

  • trunk/LayoutTests/http/tests/security/credentials-iframes-expected.txt

    r211751 r228486  
    11ALERT: parent host: 127.0.0.1 iframe host: 127.0.0.1 credentials:User: same-domain-user, password: same-domain-password.
    2 127.0.0.1:8000 - didReceiveAuthenticationChallenge - Simulating cancelled authentication sheet
     2CONSOLE MESSAGE: Blocked http://127.0.0.1:8000/security/resources/cors-basic-auth.php from asking for credentials because it is a cross-origin request.
    33ALERT: parent host: localhost iframe host: 127.0.0.1 credentials:Authentication canceled
    44

  • trunk/LayoutTests/http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt

    r228484 r228486  
    1 CONSOLE MESSAGE: line 33: The page at https://127.0.0.1:8443/security/mixedContent/insecure-basic-auth-image.https.html was allowed to display insecure content from http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php.
     1CONSOLE MESSAGE: line 33: The page at https://127.0.0.1:8443/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html was allowed to display insecure content from http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php.
    22
    33CONSOLE MESSAGE: Blocked http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php from asking for credentials because it is insecure content.

  • trunk/LayoutTests/http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html

    r228484 r228486  
    1 <!DOCTYPE html>
     1<!DOCTYPE html><!-- webkit-test-runner [ allowCrossOriginSubresourcesToAskForCredentials=true ] -->
    22<html>
    3 <body>
     3<head>
    44<script src="/js-test-resources/js-test.js"></script>
    55<script>
    … …  
    1414function pass()
    1515{
    16     testPassed("did load image.");
     16    testPassed("did not load image.");
    1717    finishJSTest();
    1818}
    … …  
    2020function fail()
    2121{
    22     testFailed("did not load image.");
     22    testFailed("did load image.");
    2323    finishJSTest();
    2424}
    … …  
    2929    // the preload scanner performing mixed content checks as part of preloading the image.
    3030    let image = new Image;
    31     image.onload = pass;
    32     image.onerror = fail;
    33     image.src = "https://127.0.0.1:8443/resources/redirect.php?url=https%3A//127.0.0.1%3A8443/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php";
     31    image.onload = fail;
     32    image.onerror = pass;
     33    image.src = "http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php";
    3434    document.body.appendChild(image);
    3535}
    … …  
    3737window.onload = runTest;
    3838</script>
     39</head>
     40<body>
    3941<script>
    40 description("This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should load.");
     42description("Tests that we do not ask for credentials when loading an insecure image that requires basic authentication.");
    4143</script>
    4244</body>

  • trunk/LayoutTests/http/tests/security/mixedContent/insecure-basic-auth-image.https-expected.txt

    r228231 r228486  
    11CONSOLE MESSAGE: line 33: The page at https://127.0.0.1:8443/security/mixedContent/insecure-basic-auth-image.https.html was allowed to display insecure content from http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php.
    22
    3 CONSOLE MESSAGE: Blocked http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php from asking for credentials because it is insecure content.
     3CONSOLE MESSAGE: Blocked http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php from asking for credentials because it is a cross-origin request.
    44Tests that we do not ask for credentials when loading an insecure image that requires basic authentication.
    55

  • trunk/LayoutTests/http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-expected.txt

    r228231 r228486  
    11CONSOLE MESSAGE: line 17: The page at https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-image-redirects-to-basic-auth-secure-image.html was allowed to display insecure content from http://127.0.0.1:8080/resources/redirect.php?url=https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php.
    22
    3 CONSOLE MESSAGE: Blocked https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it was loaded via an insecure redirect from http://127.0.0.1:8080/resources/redirect.php?url=https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php.
     3CONSOLE MESSAGE: Blocked https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it is a cross-origin request.
    44This test opens a new window to a secure page that loads an insecure image that redirects to a secure image guarded by basic authentication. The secure image should be blocked because it requires credentials and was loaded via an insecure redirect.
    55

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt

    r228484 r228486  
    1 CONSOLE MESSAGE: The page at https://127.0.0.1:8443/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https.html was allowed to display insecure content from http://127.0.0.1:8080/resources/redirect.php?url=https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php.
     1CONSOLE MESSAGE: The page at https://127.0.0.1:8443/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html was allowed to display insecure content from http://127.0.0.1:8080/resources/redirect.php?url=https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php.
    22
    33CONSOLE MESSAGE: Blocked https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it was loaded via an insecure redirect from https://127.0.0.1:8443/resources/redirect.php?url=http%3A//127.0.0.1%3A8080/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php.

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html

    r228484 r228486  
    1 <!DOCTYPE html>
     1<!DOCTYPE html><!-- webkit-test-runner [ allowCrossOriginSubresourcesToAskForCredentials=true ] -->
    22<html>
    33<body>
    … …  
    1414function pass()
    1515{
    16     testPassed("did load image.");
     16    testPassed("did not load image.");
    1717    finishJSTest();
    1818}
    … …  
    2020function fail()
    2121{
    22     testFailed("did not load image.");
     22    testFailed("did load image.");
    2323    finishJSTest();
    2424}
    … …  
    2929    // the preload scanner performing mixed content checks as part of preloading the image.
    3030    let image = new Image;
    31     image.onload = pass;
    32     image.onerror = fail;
    33     image.src = "https://127.0.0.1:8443/resources/redirect.php?url=https%3A//127.0.0.1%3A8443/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php";
     31    image.onload = fail;
     32    image.onerror = pass;
     33    image.src = "https://127.0.0.1:8443/resources/redirect.php?url=http%3A//127.0.0.1%3A8080/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php";
    3434    document.body.appendChild(image);
    3535}
    … …  
    3838</script>
    3939<script>
    40 description("This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should load.");
     40description("This test loads a secure image that redirects to an insecure image that redirects to a secure image guarded by basic authentication. The secure image should be blocked because it requires credentials and was loaded via an insecure redirect.");
    4141</script>
    4242</body>

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https-expected.txt

    r228231 r228486  
    11CONSOLE MESSAGE: The page at https://127.0.0.1:8443/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https.html was allowed to display insecure content from http://127.0.0.1:8080/resources/redirect.php?url=https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php.
    22
    3 CONSOLE MESSAGE: Blocked https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it was loaded via an insecure redirect from https://127.0.0.1:8443/resources/redirect.php?url=http%3A//127.0.0.1%3A8080/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php.
     3CONSOLE MESSAGE: Blocked https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it is a cross-origin request.
    44This test loads a secure image that redirects to an insecure image that redirects to a secure image guarded by basic authentication. The secure image should be blocked because it requires credentials and was loaded via an insecure redirect.
    55

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https-expected.txt

    r228484 r228486  
    1 CONSOLE MESSAGE: The page at https://127.0.0.1:8443/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https.html was allowed to display insecure content from http://localhost:8080/security/mixedContent/resources/subresource/protected-image.php.
     1CONSOLE MESSAGE: The page at https://127.0.0.1:8443/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html was allowed to display insecure content from http://localhost:8080/security/mixedContent/resources/subresource/protected-image.php.
    22
    33CONSOLE MESSAGE: Blocked http://localhost:8080/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it is insecure content that was loaded via a redirect from https://127.0.0.1:8443/resources/redirect.php?url=https%3A//localhost%3A8443/resources/redirect.php%3Furl%3Dhttp%3A//localhost%3A8080/security/mixedContent/resources/subresource/protected-image.php.

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html

    r228484 r228486  
    1 <!DOCTYPE html>
     1<!DOCTYPE html><!-- webkit-test-runner [ allowCrossOriginSubresourcesToAskForCredentials=true ] -->
    22<html>
    33<body>
    … …  
    1414function pass()
    1515{
    16     testPassed("did load image.");
     16    testPassed("did not load image.");
    1717    finishJSTest();
    1818}
    … …  
    2020function fail()
    2121{
    22     testFailed("did not load image.");
     22    testFailed("did load image.");
    2323    finishJSTest();
    2424}
    … …  
    2929    // the preload scanner performing mixed content checks as part of preloading the image.
    3030    let image = new Image;
    31     image.onload = pass;
    32     image.onerror = fail;
    33     image.src = "https://127.0.0.1:8443/resources/redirect.php?url=https%3A//127.0.0.1%3A8443/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php";
     31    image.onload = fail;
     32    image.onerror = pass;
     33    image.src = "https://127.0.0.1:8443/resources/redirect.php?url=https%3A//localhost%3A8443/resources/redirect.php%3Furl%3Dhttp%3A//localhost%3A8080/security/mixedContent/resources/subresource/protected-image.php";
    3434    document.body.appendChild(image);
    3535}
    … …  
    3838</script>
    3939<script>
    40 description("This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should load.");
     40description("This test loads a secure image that redirects to an secure image that redirects to an insecure image guarded by basic authentication. The insecure image should be blocked because it requires credentials.");
    4141</script>
    4242</body>

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https-expected.txt

    r228231 r228486  
    11CONSOLE MESSAGE: The page at https://127.0.0.1:8443/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https.html was allowed to display insecure content from http://localhost:8080/security/mixedContent/resources/subresource/protected-image.php.
    22
    3 CONSOLE MESSAGE: Blocked http://localhost:8080/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it is insecure content that was loaded via a redirect from https://127.0.0.1:8443/resources/redirect.php?url=https%3A//localhost%3A8443/resources/redirect.php%3Furl%3Dhttp%3A//localhost%3A8080/security/mixedContent/resources/subresource/protected-image.php.
     3CONSOLE MESSAGE: Blocked http://localhost:8080/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it is a cross-origin request.
    44This test loads a secure image that redirects to an secure image that redirects to an insecure image guarded by basic authentication. The insecure image should be blocked because it requires credentials.
    55

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html

    r228484 r228486  
    1 <!DOCTYPE html>
     1<!DOCTYPE html><!-- webkit-test-runner [ allowCrossOriginSubresourcesToAskForCredentials=true ] -->
    22<html>
    33<body>

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https-expected.txt

    r224134 r228486  
    1 localhost:8443 - didReceiveAuthenticationChallenge - Responding with testUser:testPassword
    2 This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should load.
     1CONSOLE MESSAGE: Blocked https://localhost:8443/security/mixedContent/resources/subresource/protected-image.php from asking for credentials because it is a cross-origin request.
     2This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should not load because it is cross-origin.
    33
    44On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
    55
    66
    7 PASS did load image.
     7PASS did not load image.
    88PASS successfullyParsed is true
    99

  • trunk/LayoutTests/http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html

    r228187 r228486  
    1414function pass()
    1515{
    16     testPassed("did load image.");
     16    testPassed("did not load image.");
    1717    finishJSTest();
    1818}
    … …  
    2020function fail()
    2121{
    22     testFailed("did not load image.");
     22    testFailed("did load image.");
    2323    finishJSTest();
    2424}
    … …  
    2929    // the preload scanner performing mixed content checks as part of preloading the image.
    3030    let image = new Image;
    31     image.onload = pass;
    32     image.onerror = fail;
     31    image.onload = fail;
     32    image.onerror = pass;
    3333    image.src = "https://127.0.0.1:8443/resources/redirect.php?url=https%3A//127.0.0.1%3A8443/resources/redirect.php%3Furl%3Dhttps%3A//localhost%3A8443/security/mixedContent/resources/subresource/protected-image.php";
    3434    document.body.appendChild(image);
    … …  
    3838</script>
    3939<script>
    40 description("This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should load.");
     40description("This test loads a secure image that redirects to a secure image that redirects to a secure image guarded by basic authentication. The secure image should not load because it is cross-origin.");
    4141</script>
    4242</body>

  • trunk/LayoutTests/platform/win/TestExpectations

    r228427 r228486  
    9292# FIXME: Implement test options parsing (<!-- webkit-test-runner [ ... ] -->).
    9393webkit.org/b/173281 security/isSecureContext-disabled.html [ Skip ]
     94webkit.org/b/173281 http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials.html [ Skip ]
     95webkit.org/b/173281 http/tests/security/credentials-iframes-allowCrossOriginSubresourcesToAskForCredentials.html [ Skip ]
     96webkit.org/b/173281 http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html [ Skip ]
     97webkit.org/b/173281 http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.html [ Skip ]
     98webkit.org/b/173281 http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html [ Skip ]
     99webkit.org/b/173281 http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html [ Skip ]
     100webkit.org/b/173281 http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html [ Skip ]
    94101
    95102# TODO HW filters not yet supported on Windows

  • trunk/LayoutTests/platform/wk2/http/tests/media/video-auth-expected.txt

    r202587 r228486  
    11127.0.0.1:8000 - didReceiveAuthenticationChallenge - Responding with username:password
    2 localhost:8000 - didReceiveAuthenticationChallenge - Responding with username:password
    32 
    43Tests that the media player sends authorization credentials when requesting a media file.
    54Testing same domain (127.0.0.1)
    65EVENT(canplay)
    7 Testing cross domain (localhost)
    8 EVENT(canplay)
    96END OF TEST
    107

  • trunk/Source/WebCore/ChangeLog

    r228483 r228486  
     12018-02-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow cross-origin subresources from asking for credentials
     4        https://bugs.webkit.org/show_bug.cgi?id=182579
     5        <rdar://problem/36162271>
     6
     7        Reviewed by Andy Estes.
     8
     9        Prompts for credentials to load cross-origin subresources are typically seen as unexpected
     10        by a person that navigates to- or interacts with- a web page. The cross-origin and implicit
     11        loading nature of these subresources makes asking for credentials questionable because they
     12        are not being served by the same origin of the page a person explicitly loaded and are not
     13        guaranteed to correspond to an explicit user interaction other than the initial load of the
     14        page. We know that subresources that ask for credentials can be abused as part of a phishing
     15        attack. It seems reasonable to disallow cross-origin subresources from asking for credentials
     16        due to their questionable nature and the risk for abuse. This will also make the behavior
     17        of WebKit match the behavior of Chrome.
     18
     19        Tests: http/tests/media/video-auth-with-allowCrossOriginSubresourcesToAskForCredentials.html
     20               http/tests/security/basic-auth-subresource.html
     21               http/tests/security/mixedContent/insecure-basic-auth-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
     22               http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.html
     23               http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
     24               http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
     25               http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image-allowCrossOriginSubresourcesToAskForCredentials.https.html
     26
     27        * loader/ResourceLoader.cpp:
     28        (WebCore::ResourceLoader::isSubresourceLoader const): Formerly non-const.
     29        (WebCore::ResourceLoader::shouldAllowResourceToAskForCredentials const): Added.
     30        (WebCore::ResourceLoader::didBlockAuthenticationChallenge): Emit Web Inspector console message if
     31        the authentication challenge was blocked because the request is cross origin.
     32        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials const): Disallow a cross-origin
     33        request from prompting for credentials.
     34        (WebCore::ResourceLoader::isSubresourceLoader): Deleted; made const.
     35        * loader/ResourceLoader.h:
     36        * loader/SubresourceLoader.cpp:
     37        (WebCore::SubresourceLoader::SubresourceLoader): Update ResourceLoader state so that block cross-origin
     38        subresources from prompting for credentials, if applicable.
     39        (WebCore::SubresourceLoader::isSubresourceLoader const): Formerly non-const.
     40        (WebCore::SubresourceLoader::isSubresourceLoader): Deleted; made const.
     41        * loader/SubresourceLoader.h:
     42        * page/Settings.yaml: Add setting allowCrossOriginSubresourcesToAskForCredentials (defaults: false -
     43        do not allow cross origin subresources to ask for credentials).
     44
    1452018-02-14  Don Olmstead  <don.olmstead@sony.com>
    246

  • trunk/Source/WebCore/loader/ResourceLoader.cpp

    r228231 r228486  
    11/*
    2  * Copyright (C) 2006-2007, 2010-2011, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 *           (C) 2007 Graham Dennis (graham.dennis@gmail.com)
    44 *
    … …  
    327327}
    328328
    329 bool ResourceLoader::isSubresourceLoader()
     329bool ResourceLoader::isSubresourceLoader() const
    330330{
    331331    return false;
    … …  
    464464}
    465465
     466bool ResourceLoader::shouldAllowResourceToAskForCredentials() const
     467{
     468    return m_canCrossOriginRequestsAskUserForCredentials || m_frame->tree().top().document()->securityOrigin().canRequest(m_request.url());
     469}
     470
    466471void ResourceLoader::didBlockAuthenticationChallenge()
    467472{
    … …  
    470475    if (!m_canAskClientForCredentials)
    471476        return;
     477
     478    if (!shouldAllowResourceToAskForCredentials()) {
     479        FrameLoader::reportAuthenticationChallengeBlocked(m_frame.get(), m_request.url(), ASCIILiteral("it is a cross-origin request"));
     480        return;
     481    }
    472482
    473483    if (!m_wasInsecureRequestSeen)
    … …  
    740750    if (!m_canAskClientForCredentials)
    741751        return false;
     752    if (!shouldAllowResourceToAskForCredentials())
     753        return false;
    742754    if (m_wasInsecureRequestSeen)
    743755        return false;

  • trunk/Source/WebCore/loader/ResourceLoader.h

    r228231 r228486  
    9999    void clearResourceData();
    100100   
    101     virtual bool isSubresourceLoader();
     101    virtual bool isSubresourceLoader() const;
    102102
    103103    virtual void willSendRequest(ResourceRequest&&, const ResourceResponse& redirectResponse, CompletionHandler<void(ResourceRequest&&)>&& callback);
    … …  
    178178    std::unique_ptr<PreviewLoader> m_previewLoader;
    179179#endif
     180    bool m_canCrossOriginRequestsAskUserForCredentials { true };
    180181
    181182private:
    … …  
    186187    void loadDataURL();
    187188    void finishNetworkLoad();
     189
     190    bool shouldAllowResourceToAskForCredentials() const;
    188191
    189192    // ResourceHandleClient

  • trunk/Source/WebCore/loader/SubresourceLoader.cpp

    r227680 r228486  
    4646#include "ResourceTiming.h"
    4747#include "RuntimeEnabledFeatures.h"
     48#include "Settings.h"
    4849#include <wtf/CompletionHandler.h>
    4950#include <wtf/Ref.h>
    … …  
    9394    m_resourceType = toResourceType(resource.type());
    9495#endif
     96    m_canCrossOriginRequestsAskUserForCredentials = resource.type() == CachedResource::MainResource || frame.settings().allowCrossOriginSubresourcesToAskForCredentials();
    9597}
    9698
    … …  
    163165}
    164166
    165 bool SubresourceLoader::isSubresourceLoader()
     167bool SubresourceLoader::isSubresourceLoader() const
    166168{
    167169    return true;

  • trunk/Source/WebCore/loader/SubresourceLoader.h

    r226508 r228486  
    4848
    4949    void cancelIfNotFinishing();
    50     bool isSubresourceLoader() override;
     50    bool isSubresourceLoader() const override;
    5151    CachedResource* cachedResource();
    5252

  • trunk/Source/WebCore/page/Settings.yaml

    r227762 r228486  
    102102allowSettingAnyXHRHeaderFromFileURLs:
    103103  initial: false
     104allowCrossOriginSubresourcesToAskForCredentials:
     105  initial: false
    104106needsStorageAccessFromFileURLsQuirk:
    105107  initial: true

  • trunk/Source/WebKit/ChangeLog

    r228478 r228486  
     12018-02-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow cross-origin subresources from asking for credentials
     4        https://bugs.webkit.org/show_bug.cgi?id=182579
     5        <rdar://problem/36162271>
     6
     7        Reviewed by Andy Estes.
     8
     9        Add a private preference to toggle allowing non-mixed content cross-origin subresources to load.
     10        WebKitTestRunner toggles this preference when it sees the test option allowCrossOriginSubresourcesToAskForCredential.
     11
     12        * Shared/WebPreferences.yaml:
     13        * UIProcess/API/C/WKPreferences.cpp:
     14        (WKPreferencesSetAllowCrossOriginSubresourcesToAskForCredentials):
     15        (WKPreferencesGetAllowCrossOriginSubresourcesToAskForCredentials):
     16        * UIProcess/API/C/WKPreferencesRefPrivate.h:
     17
    1182018-02-14  John Wilander  <wilander@apple.com>
    219

  • trunk/Source/WebKit/Shared/WebPreferences.yaml

    r227873 r228486  
    181181
    182182AllowSettingAnyXHRHeaderFromFileURLs:
     183  type: bool
     184  defaultValue: false
     185
     186AllowCrossOriginSubresourcesToAskForCredentials:
    183187  type: bool
    184188  defaultValue: false

  • trunk/Source/WebKit/UIProcess/API/C/WKPreferences.cpp

    r227535 r228486  
    19351935}
    19361936
     1937void WKPreferencesSetAllowCrossOriginSubresourcesToAskForCredentials(WKPreferencesRef preferencesRef, bool flag)
     1938{
     1939    toImpl(preferencesRef)->setAllowCrossOriginSubresourcesToAskForCredentials(flag);
     1940}
     1941
     1942bool WKPreferencesGetAllowCrossOriginSubresourcesToAskForCredentials(WKPreferencesRef preferencesRef)
     1943{
     1944    return toImpl(preferencesRef)->allowCrossOriginSubresourcesToAskForCredentials();
     1945}

  • trunk/Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h

    r227079 r228486  
    553553WK_EXPORT void WKPreferencesSetShouldAllowUserInstalledFonts(WKPreferencesRef, bool flag);
    554554WK_EXPORT bool WKPreferencesGetShouldAllowUserInstalledFonts(WKPreferencesRef);
    555    
     555
     556// Defaults to false.
     557WK_EXPORT void WKPreferencesSetAllowCrossOriginSubresourcesToAskForCredentials(WKPreferencesRef, bool flag);
     558WK_EXPORT bool WKPreferencesGetAllowCrossOriginSubresourcesToAskForCredentials(WKPreferencesRef);
     559
    556560#ifdef __cplusplus
    557561}

  • trunk/Source/WebKitLegacy/mac/ChangeLog

    r228463 r228486  
     12018-02-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow cross-origin subresources from asking for credentials
     4        https://bugs.webkit.org/show_bug.cgi?id=182579
     5        <rdar://problem/36162271>
     6
     7        Reviewed by Andy Estes.
     8
     9        Add a private preference to toggle allowing non-mixed content cross-origin subresources to load.
     10        DumpRenderTree toggles this preference when it sees the test option allowCrossOriginSubresourcesToAskForCredential.
     11
     12        * WebView/WebPreferenceKeysPrivate.h:
     13        * WebView/WebPreferences.mm:
     14        (+[WebPreferences initialize]):
     15        (-[WebPreferences allowCrossOriginSubresourcesToAskForCredentials]):
     16        (-[WebPreferences setAllowCrossOriginSubresourcesToAskForCredentials:]):
     17        * WebView/WebPreferencesPrivate.h:
     18        * WebView/WebView.mm:
     19        (-[WebView _preferencesChanged:]):
     20
    1212018-02-14  Ross Kirsling  <ross.kirsling@sony.com>
    222

  • trunk/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h

    r227535 r228486  
    5757#define WebKitAllowUniversalAccessFromFileURLsPreferenceKey @"WebKitAllowUniversalAccessFromFileURLs"
    5858#define WebKitAllowFileAccessFromFileURLsPreferenceKey @"WebKitAllowFileAccessFromFileURLs"
     59#define WebKitAllowCrossOriginSubresourcesToAskForCredentialsKey @"WebKitAllowCrossOriginSubresourcesToAskForCredentials"
    5960#define WebKitNeedsStorageAccessFromFileURLsQuirkKey @"WebKitNeedsStorageAccessFromFileURLsQuirk"
    6061#define WebKitJavaScriptCanOpenWindowsAutomaticallyPreferenceKey @"WebKitJavaScriptCanOpenWindowsAutomatically"

  • trunk/Source/WebKitLegacy/mac/WebView/WebPreferences.mm

    r228218 r228486  
    651651
    652652        [NSNumber numberWithBool:YES], WebKitNeedsStorageAccessFromFileURLsQuirkKey,
     653        [NSNumber numberWithBool:NO], WebKitAllowCrossOriginSubresourcesToAskForCredentialsKey,
    653654#if ENABLE(MEDIA_STREAM)
    654655        [NSNumber numberWithBool:NO], WebKitMediaDevicesEnabledPreferenceKey,
    … …  
    14981499{
    14991500    [self _setBoolValue: flag forKey: WebKitAllowFileAccessFromFileURLsPreferenceKey];
     1501}
     1502
     1503- (BOOL)allowCrossOriginSubresourcesToAskForCredentials
     1504{
     1505    return [self _boolValueForKey:WebKitAllowCrossOriginSubresourcesToAskForCredentialsKey];
     1506}
     1507
     1508- (void)setAllowCrossOriginSubresourcesToAskForCredentials:(BOOL)flag
     1509{
     1510    [self _setBoolValue:flag forKey:WebKitAllowCrossOriginSubresourcesToAskForCredentialsKey];
    15001511}
    15011512

  • trunk/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h

    r227535 r228486  
    145145- (void)setAllowFileAccessFromFileURLs:(BOOL)flag;
    146146
     147- (BOOL)allowCrossOriginSubresourcesToAskForCredentials;
     148- (void)setAllowCrossOriginSubresourcesToAskForCredentials:(BOOL)flag;
     149
    147150- (BOOL)needsStorageAccessFromFileURLsQuirk;
    148151- (void)setNeedsStorageAccessFromFileURLsQuirk:(BOOL)flag;
    … …  
    599602@property (nonatomic) BOOL accessibilityObjectModelEnabled;
    600603@property (nonatomic) BOOL mediaCapabilitiesEnabled;
     604@property (nonatomic) BOOL allowCrossOriginSubresourcesToAskForCredentials;
    601605
    602606#if TARGET_OS_IPHONE

  • trunk/Source/WebKitLegacy/mac/WebView/WebView.mm

    r228308 r228486  
    27612761    settings.setAllowUniversalAccessFromFileURLs([preferences allowUniversalAccessFromFileURLs]);
    27622762    settings.setAllowFileAccessFromFileURLs([preferences allowFileAccessFromFileURLs]);
     2763    settings.setAllowCrossOriginSubresourcesToAskForCredentials([preferences allowCrossOriginSubresourcesToAskForCredentials]);
    27632764    settings.setNeedsStorageAccessFromFileURLsQuirk([preferences needsStorageAccessFromFileURLsQuirk]);
    27642765    settings.setMinimumFontSize([preferences minimumFontSize]);

  • trunk/Tools/ChangeLog

    r228482 r228486  
     12018-02-14  Daniel Bates  <dabates@apple.com>
     2
     3        Disallow cross-origin subresources from asking for credentials
     4        https://bugs.webkit.org/show_bug.cgi?id=182579
     5        <rdar://problem/36162271>
     6
     7        Reviewed by Andy Estes.
     8
     9        Add test option allowCrossOriginSubresourcesToAskForCredential (defaults to false)
     10        so that tests can toggle between the old behavior and new behavior.
     11
     12        * DumpRenderTree/TestOptions.h:
     13        * DumpRenderTree/TestOptions.mm:
     14        (TestOptions::TestOptions):
     15        * DumpRenderTree/mac/DumpRenderTree.mm:
     16        (setWebPreferencesForTestOptions):
     17        * WebKitTestRunner/TestController.cpp:
     18        (WTR::TestController::resetPreferencesToConsistentValues):
     19        (WTR::updateTestOptionsFromTestHeader):
     20        * WebKitTestRunner/TestOptions.h:
     21        (WTR::TestOptions::hasSameInitializationOptions const):
     22
    1232018-02-12  Ryosuke Niwa  <rniwa@webkit.org>
    224

  • trunk/Tools/DumpRenderTree/TestOptions.h

    r226341 r228486  
    4242    bool enableInspectorAdditions { false };
    4343    bool dumpJSConsoleLogInStdErr { false };
     44    bool allowCrossOriginSubresourcesToAskForCredentials { false };
    4445
    4546    TestOptions(NSURL*, const TestCommand&);

  • trunk/Tools/DumpRenderTree/TestOptions.mm

    r226341 r228486  
    103103        else if (key == "dumpJSConsoleLogInStdErr")
    104104            this->dumpJSConsoleLogInStdErr = parseBooleanTestHeaderValue(value);
     105        else if (key == "allowCrossOriginSubresourcesToAskForCredentials")
     106            this->allowCrossOriginSubresourcesToAskForCredentials = parseBooleanTestHeaderValue(value);
    105107        pairStart = pairEnd + 1;
    106108    }

  • trunk/Tools/DumpRenderTree/mac/DumpRenderTree.mm

    r227551 r228486  
    995995    preferences.isSecureContextAttributeEnabled = options.enableIsSecureContextAttribute;
    996996    preferences.inspectorAdditionsEnabled = options.enableInspectorAdditions;
     997    preferences.allowCrossOriginSubresourcesToAskForCredentials = options.allowCrossOriginSubresourcesToAskForCredentials;
    997998}
    998999

  • trunk/Tools/WebKitTestRunner/TestController.cpp

    r228416 r228486  
    693693    WKPreferencesSetWebAuthenticationEnabled(preferences, options.enableWebAuthentication);
    694694    WKPreferencesSetIsSecureContextAttributeEnabled(preferences, options.enableIsSecureContextAttribute);
     695    WKPreferencesSetAllowCrossOriginSubresourcesToAskForCredentials(preferences, options.allowCrossOriginSubresourcesToAskForCredentials);
    695696
    696697    static WKStringRef defaultTextEncoding = WKStringCreateWithUTF8CString("ISO-8859-1");
    … …  
    10691070        if (key == "applicationManifest")
    10701071            testOptions.applicationManifest = parseStringTestHeaderValueAsRelativePath(value, pathOrURL);
     1072        if (key == "allowCrossOriginSubresourcesToAskForCredentials")
     1073            testOptions.allowCrossOriginSubresourcesToAskForCredentials = parseBooleanTestHeaderValue(value);
    10711074        pairStart = pairEnd + 1;
    10721075    }

  • trunk/Tools/WebKitTestRunner/TestOptions.h

    r226341 r228486  
    5555    bool shouldShowTouches { false };
    5656    bool dumpJSConsoleLogInStdErr { false };
     57    bool allowCrossOriginSubresourcesToAskForCredentials { false };
    5758
    5859    float deviceScaleFactor { 1 };
    … …  
    8384            || enableInspectorAdditions != options.enableInspectorAdditions
    8485            || dumpJSConsoleLogInStdErr != options.dumpJSConsoleLogInStdErr
    85             || applicationManifest != options.applicationManifest)
     86            || applicationManifest != options.applicationManifest
     87            || allowCrossOriginSubresourcesToAskForCredentials != options.allowCrossOriginSubresourcesToAskForCredentials)
    8688            return false;
    8789
Note: See TracChangeset for help on using the changeset viewer.