⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 236961 in webkit


Ignore:
Timestamp:
Oct 9, 2018, 8:10:17 AM (8 years ago)
Author:
Philippe Normand
Message:

[GStreamer] Stealing cross-origin video pixel with HLS
​https://bugs.webkit.org/show_bug.cgi?id=190003

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Report the SecurityOrigin of downloaded adaptivedemux (HLS, DASH,
SmoothStreaming) fragments as tainted if their origin differs from
the manifest SecurityOrigin. SecurityOrigins are stored in the
CachedResourceStreamingClient implemented in the internal
GStreamer HTTP(S) source element.

The implementation is not ideal yet because the fragments download
is performed by the WebProcess, until bug 189967 is fixed. When
this bug is fixed, the m_hasTaintedOrigin member variable should
be removed and all checks be done unconditionally to the
webkithttpsrc element which will manage the download of the
manifests and fragments.

  • platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::loadFull): Reset the m_hasTaintedOrigin value.
(WebCore::MediaPlayerPrivateGStreamer::handleMessage): Get the
fragment URL from the adaptivedemux stats message and check if its
origin is tainted.
(WebCore::MediaPlayerPrivateGStreamer::wouldTaintOrigin const):
Initial implementation by checking the m_hasTaintedOrigin member
variable value.

  • platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
  • platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(CachedResourceStreamingClient::responseReceived): Store the
resource origin internally so it can be checked later on by
webKitSrtcWouldTaintOrigin().
(webKitSrcWouldTaintOrigin): Check given origin against cached
origins. This implementation is similar to Cocoa's
WebCoreNSURLSession implementation.

  • platform/graphics/gstreamer/WebKitWebSourceGStreamer.h:

LayoutTests:

  • platform/gtk/TestExpectations: Unflag now-passing test.
Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r236957 r236961  
     12018-10-09  Philippe Normand  <pnormand@igalia.com>
     2
     3        [GStreamer] Stealing cross-origin video pixel with HLS
     4        https://bugs.webkit.org/show_bug.cgi?id=190003
     5
     6        Reviewed by Xabier Rodriguez-Calvar.
     7
     8        * platform/gtk/TestExpectations: Unflag now-passing test.
     9
    1102018-10-08  Devin Rousso  <drousso@apple.com>
    211

  • trunk/LayoutTests/platform/gtk/TestExpectations

    r236954 r236961  
    34963496webkit.org/b/187770 media/no-fullscreen-when-hidden.html [ Failure ]
    34973497webkit.org/b/187994 compositing/backing/backing-store-attachment-fill-forwards-animation.html [ Failure ]
    3498 webkit.org/b/187996 http/tests/security/canvas-remote-read-remote-video-hls.html [ Failure ]
    34993498
    35003499webkit.org/b/188098 webanimations/accelerated-animation-with-delay.html [ ImageOnlyFailure ]

  • trunk/Source/WebCore/ChangeLog

    r236959 r236961  
     12018-10-09  Philippe Normand  <pnormand@igalia.com>
     2
     3        [GStreamer] Stealing cross-origin video pixel with HLS
     4        https://bugs.webkit.org/show_bug.cgi?id=190003
     5
     6        Reviewed by Xabier Rodriguez-Calvar.
     7
     8        Report the SecurityOrigin of downloaded adaptivedemux (HLS, DASH,
     9        SmoothStreaming) fragments as tainted if their origin differs from
     10        the manifest SecurityOrigin. SecurityOrigins are stored in the
     11        CachedResourceStreamingClient implemented in the internal
     12        GStreamer HTTP(S) source element.
     13
     14        The implementation is not ideal yet because the fragments download
     15        is performed by the WebProcess, until bug 189967 is fixed. When
     16        this bug is fixed, the m_hasTaintedOrigin member variable should
     17        be removed and all checks be done unconditionally to the
     18        webkithttpsrc element which will manage the download of the
     19        manifests and fragments.
     20
     21        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
     22        (WebCore::MediaPlayerPrivateGStreamer::loadFull): Reset the m_hasTaintedOrigin value.
     23        (WebCore::MediaPlayerPrivateGStreamer::handleMessage): Get the
     24        fragment URL from the adaptivedemux stats message and check if its
     25        origin is tainted.
     26        (WebCore::MediaPlayerPrivateGStreamer::wouldTaintOrigin const):
     27        Initial implementation by checking the m_hasTaintedOrigin member
     28        variable value.
     29        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
     30        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
     31        (CachedResourceStreamingClient::responseReceived): Store the
     32        resource origin internally so it can be checked later on by
     33        webKitSrtcWouldTaintOrigin().
     34        (webKitSrcWouldTaintOrigin): Check given origin against cached
     35        origins. This implementation is similar to Cocoa's
     36        WebCoreNSURLSession implementation.
     37        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h:
     38
    1392018-10-09  Antti Koivisto  <antti@apple.com>
    240

  • trunk/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

    r236721 r236961  
    290290    m_volumeAndMuteInitialized = false;
    291291    m_durationAtEOS = MediaTime::invalidTime();
     292    m_hasTaintedOrigin = std::nullopt;
    292293
    293294    if (!m_delayingLoad)
    … …  
    13301331                gst_structure_free(responseHeaders);
    13311332            }
     1333        } else if (gst_structure_has_name(structure, "adaptive-streaming-statistics")) {
     1334            if (WEBKIT_IS_WEB_SRC(m_source.get()))
     1335                if (const char* uri = gst_structure_get_string(structure, "uri"))
     1336                    m_hasTaintedOrigin = webKitSrcWouldTaintOrigin(WEBKIT_WEB_SRC(m_source.get()), SecurityOrigin::create(URL(URL(), uri)));
    13321337        } else
    13331338            GST_DEBUG("Unhandled element message: %" GST_PTR_FORMAT, structure);
    … …  
    26492654}
    26502655
     2656std::optional<bool> MediaPlayerPrivateGStreamer::wouldTaintOrigin(const SecurityOrigin&) const
     2657{
     2658    // Ideally the given origin should always be verified with
     2659    // webKitSrcWouldTaintOrigin() instead of only checking it for
     2660    // adaptive-streaming-statistics. We can't do this yet because HLS fragments
     2661    // are currently downloaded independently from WebKit.
     2662    // See also https://bugs.webkit.org/show_bug.cgi?id=189967.
     2663    return m_hasTaintedOrigin;
     2664}
     2665
     2666
    26512667}
    26522668

  • trunk/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h

    r235846 r236961  
    110110
    111111    bool hasSingleSecurityOrigin() const override;
     112    std::optional<bool> wouldTaintOrigin(const SecurityOrigin&) const override;
    112113
    113114    void loadStateChanged();
    … …  
    287288#endif
    288289    virtual bool isMediaSource() const { return false; }
     290
     291    std::optional<bool> m_hasTaintedOrigin { std::nullopt };
    289292};
    290293}

  • trunk/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

    r236396 r236961  
    3131#include "ResourceRequest.h"
    3232#include "ResourceResponse.h"
     33#include "SecurityOrigin.h"
    3334#include <cstdint>
    3435#include <gst/app/gstappsrc.h>
    … …  
    4344    CachedResourceStreamingClient(WebKitWebSrc*, ResourceRequest&&);
    4445    virtual ~CachedResourceStreamingClient();
     46
     47    const HashSet<RefPtr<WebCore::SecurityOrigin>>& securityOrigins() const { return m_origins; }
     48
    4549private:
    4650    void checkUpdateBlocksize(uint64_t bytesRead);
    … …  
    6468    GRefPtr<GstElement> m_src;
    6569    ResourceRequest m_request;
     70    HashSet<RefPtr<WebCore::SecurityOrigin>> m_origins;
    6671};
    6772
    … …  
    788793
    789794    GST_DEBUG_OBJECT(src, "Received response: %d", response.httpStatusCode());
     795
     796    auto origin = SecurityOrigin::create(response.url());
     797    m_origins.add(WTFMove(origin));
    790798
    791799    auto responseURI = response.url().string().utf8();
    … …  
    9951003}
    9961004
     1005bool webKitSrcWouldTaintOrigin(WebKitWebSrc* src, const SecurityOrigin& origin)
     1006{
     1007    WebKitWebSrcPrivate* priv = src->priv;
     1008
     1009    auto* cachedResourceStreamingClient = reinterpret_cast<CachedResourceStreamingClient*>(priv->resource->client());
     1010    for (auto& responseOrigin : cachedResourceStreamingClient->securityOrigins()) {
     1011        if (!origin.canAccess(*responseOrigin))
     1012            return true;
     1013    }
     1014    return false;
     1015}
     1016
    9971017#endif // ENABLE(VIDEO) && USE(GSTREAMER)

  • trunk/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h

    r226973 r236961  
    2525namespace WebCore {
    2626class MediaPlayer;
     27class SecurityOrigin;
    2728}
    2829
    … …  
    5253void webKitWebSrcSetMediaPlayer(WebKitWebSrc*, WebCore::MediaPlayer*);
    5354bool webKitSrcPassedCORSAccessCheck(WebKitWebSrc*);
     55bool webKitSrcWouldTaintOrigin(WebKitWebSrc*, const WebCore::SecurityOrigin&);
    5456
    5557G_END_DECLS
Note: See TracChangeset for help on using the changeset viewer.