Changeset 239393 in webkit

Timestamp:

Dec 19, 2018, 2:05:29 PM (8 years ago)

Author:

Kocsen Chung

Message:

Apply patch. rdar://problem/46848447

Location:

branches/safari-606-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/TestExpectations (modified) (1 diff)
• LayoutTests/http/tests/cookies/capped-lifetime-for-cookie-set-in-js-expected.txt (added)
• LayoutTests/http/tests/cookies/capped-lifetime-for-cookie-set-in-js.html (added)
• LayoutTests/http/tests/cookies/resources/cookie-utilities.js (modified) (1 diff)
• LayoutTests/platform/ios/TestExpectations (modified) (1 diff)
• LayoutTests/platform/mac-wk2/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/PAL/pal/spi/cg/CoreGraphicsSPI.h (modified) (1 diff)
• Source/WebCore/platform/network/mac/CookieJarMac.mm (modified) (2 diffs)
• Source/WebCore/testing/Internals.cpp (modified) (2 diffs)
• Source/WebCore/testing/Internals.h (modified) (2 diffs)
• Source/WebCore/testing/Internals.idl (modified) (2 diffs)

branches/safari-606-branch/LayoutTests/ChangeLog

@@ +1 @@
+2018-12-19  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Apply patch. rdar://problem/46848447
+
+    2018-12-19  John Wilander  <wilander@apple.com>
+
+            Cap lifetime of persistent cookies created client-side through document.cookie
+            https://bugs.webkit.org/show_bug.cgi?id=189933
+            <rdar://problem/44741888>
+
+            Reviewed by Chris Dumez.
+
+            * TestExpectations:
+                Skipped the new test by default since the behavior change is for
+                Cocoa platforms only.
+            * http/tests/cookies/capped-lifetime-for-cookie-set-in-js-expected.txt: Added.
+            * http/tests/cookies/capped-lifetime-for-cookie-set-in-js.html: Added.
+            * http/tests/cookies/resources/cookie-utilities.js:
+            * platform/ios/TestExpectations:
+                Marked the new test as [ Pass ].
+            * platform/mac-wk2/TestExpectations:
+                Marked the new test as [ Pass ].
+
 2018-12-14  Alan Coon  <alancoon@apple.com>
 

branches/safari-606-branch/LayoutTests/TestExpectations

@@ -151 +151 @@
 http/tests/security/strip-referrer-to-origin-for-third-party-redirects-in-private-mode.html [ Skip ]
 http/tests/security/strip-referrer-to-origin-for-third-party-requests-in-private-mode.html [ Skip ]
+http/tests/cookies/capped-lifetime-for-cookie-set-in-js.html [ Skip ]
 
 # ApplePay is only available on iOS (greater than iOS 10) and macOS (greater than macOS 10.12) and only for WebKit2.

branches/safari-606-branch/LayoutTests/http/tests/cookies/resources/cookie-utilities.js

@@ -238 +238 @@
     return promise;
 }
+
+function createExpiresDateFromMaxAge(maxAgeInSeconds)
+{
+    let date = new Date();
+    date.setTime(date.getTime() + (maxAgeInSeconds * 1000));
+    return date.toUTCString();
+}

branches/safari-606-branch/LayoutTests/platform/ios/TestExpectations

@@ -2823 +2823 @@
 fast/events/webkit-media-key-events-constructor.html [ Failure ]
 
+http/tests/cookies/capped-lifetime-for-cookie-set-in-js.html [ Pass ]
 webkit.org/b/161143 imported/w3c/web-platform-tests/html/browsers/browsing-the-web/history-traversal/persisted-user-state-restoration/scroll-restoration-fragment-scrolling-samedoc.html [ Pass Failure ]
 

branches/safari-606-branch/LayoutTests/platform/mac-wk2/TestExpectations

@@ -770 +770 @@
 
 webkit.org/b/175341 accessibility/mac/select-element-selection-with-optgroups.html [ Pass Failure ]
+http/tests/cookies/capped-lifetime-for-cookie-set-in-js.html [ Pass ]
 
 webkit.org/b/172044 [ Debug ] imported/w3c/web-platform-tests/IndexedDB/open-request-queue.html [ Pass Timeout ]

branches/safari-606-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2018-12-19  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Apply patch. rdar://problem/46848447
+
+    2018-12-19  John Wilander  <wilander@apple.com>
+
+            Cap lifetime of persistent cookies created client-side through document.cookie
+            https://bugs.webkit.org/show_bug.cgi?id=189933
+            <rdar://problem/44741888>
+
+            Reviewed by Chris Dumez.
+
+            Test: http/tests/cookies/capped-lifetime-for-cookie-set-in-js.html
+
+            As pointed out in https://github.com/mikewest/http-state-tokens:
+
+            1) Cookies are available to JavaScript by default via document.cookie, which
+            enables a smooth upgrade from one-time XSS to theft of persistent credentials
+            and also makes cookies available to Spectre-like attacks on memory.
+
+            2) Though the HttpOnly attribute was introduced well over a decade ago, only
+            ~8.31% of Set-Cookie operations use it today (stats from Chrome). We need
+            developer incentives to put proper protections in place.
+
+            3) The median (uncompressed) Cookie request header is 409 bytes, while the 90th
+            percentile is 1,589 bytes, the 95th 2,549 bytes, the 99th 4,601 bytes, and
+            ~0.1% of Cookie headers are over 10kB (stats from Chrome). This is bad for load
+            performance.
+
+            In addition to this, third-party scripts running in first-party contexts can
+            read user data through document.cookie and even store cross-site tracking data
+            in them.
+
+            Authentication cookies should be HttpOnly and thus not be affected by
+            restrictions to document.cookie. Cookies that persist for a long time should
+            be Secure, HttpOnly, and SameSite to provide good security and privacy.
+
+            By capping the lifetime of persistent cookies set through document.cookie we
+            embark on a journey towards better cookie management on the web.
+
+            * platform/network/cocoa/NetworkStorageSessionCocoa.mm:
+            (WebCore::filterCookies):
+                Now caps the life time of persistent cookies to one week (seven days).
+            * testing/Internals.cpp:
+            (WebCore::Internals::getCookies const):
+                New test function to get to cookie meta data such as expiry.
+            * testing/Internals.h:
+            * testing/Internals.idl:
+
 2018-12-14  Alan Coon  <alancoon@apple.com>
 

branches/safari-606-branch/Source/WebCore/PAL/pal/spi/cg/CoreGraphicsSPI.h

@@ -303 +303 @@
 size_t CGDisplayModeGetPixelsHigh(CGDisplayModeRef);
 
+#if ENABLE(WEBPROCESS_WINDOWSERVER_BLOCKING)
+CGError CGSSetDenyWindowServerConnections(bool);
+
+typedef int32_t CGSDisplayID;
+CGSDisplayID CGSMainDisplayID(void);
+
+#endif // ENABLE(WEBPROCESS_WINDOWSERVER_BLOCKING)
+
 #endif
 

branches/safari-606-branch/Source/WebCore/platform/network/mac/CookieJarMac.mm

@@ -152 +152 @@
     RetainPtr<NSMutableArray> filteredCookies = adoptNS([[NSMutableArray alloc] initWithCapacity:count]);
 
+    const NSTimeInterval secondsPerWeek = 7 * 24 * 60 * 60;
     for (NSUInteger i = 0; i < count; ++i) {
         NSHTTPCookie *cookie = (NSHTTPCookie *)[unfilteredCookies objectAtIndex:i];
@@ -164 +165 @@
         if ([cookie isHTTPOnly])
             continue;
+
+        // Cap lifetime of persistent, client-side cookies to a week.
+        if (![cookie isSessionOnly]) {
+            if (!cookie.expiresDate || cookie.expiresDate.timeIntervalSinceNow > secondsPerWeek) {
+                RetainPtr<NSMutableDictionary<NSHTTPCookiePropertyKey, id>> properties = adoptNS([[cookie properties] mutableCopy]);
+                RetainPtr<NSDate> dateInAWeek = adoptNS([[NSDate alloc] initWithTimeIntervalSinceNow:secondsPerWeek]);
+                [properties setObject:dateInAWeek.get() forKey:NSHTTPCookieExpires];
+                cookie = [NSHTTPCookie cookieWithProperties:properties.get()];
+            }
+        }
 
         [filteredCookies.get() addObject:cookie];

branches/safari-606-branch/Source/WebCore/testing/Internals.cpp

@@ -48 +48 @@
 #include "ClientOrigin.h"
 #include "ComposedTreeIterator.h"
+#include "CookieJar.h"
 #include "Cursor.h"
 #include "DOMRect.h"
@@ -4698 +4699 @@
 }
 
+auto Internals::getCookies() const -> Vector<CookieData>
+{
+    auto* document = contextDocument();
+    if (!document)
+        return { };
+
+    Vector<Cookie> cookies;
+    getRawCookies(*document, document->cookieURL(), cookies);
+    return WTF::map(cookies, [](auto& cookie) {
+        return CookieData { cookie };
+    });
+}
+
 } // namespace WebCore

branches/safari-606-branch/Source/WebCore/testing/Internals.h

@@ -29 +29 @@
 #include "CSSComputedStyleDeclaration.h"
 #include "ContextDestructionObserver.h"
+#include "Cookie.h"
 #include "ExceptionOr.h"
 #include "JSDOMPromiseDeferred.h"
@@ -728 +729 @@
     void setAlwaysAllowLocalWebarchive() const;
 
+    struct CookieData {
+        String name;
+        String value;
+        String domain;
+        // Expiration dates are expressed as milliseconds since the UNIX epoch.
+        double expires { 0 };
+        bool isHttpOnly { false };
+        bool isSecure { false };
+        bool isSession { false };
+        bool isSameSiteLax { false };
+        bool isSameSiteStrict { false };
+
+        CookieData(Cookie cookie)
+            : name(cookie.name)
+            , value(cookie.value)
+            , domain(cookie.domain)
+            , expires(cookie.expires)
+            , isHttpOnly(cookie.httpOnly)
+            , isSecure(cookie.secure)
+            , isSession(cookie.session)
+            , isSameSiteLax(cookie.sameSite == Cookie::SameSitePolicy::Lax)
+            , isSameSiteStrict(cookie.sameSite == Cookie::SameSitePolicy::Strict)
+        {
+            ASSERT(!(isSameSiteLax && isSameSiteStrict));
+        }
+
+        CookieData()
+        {
+        }
+    };
+    Vector<CookieData> getCookies() const;
+
 private:
     explicit Internals(Document&);

branches/safari-606-branch/Source/WebCore/testing/Internals.idl

@@ -125 +125 @@
 [
     ExportMacro=WEBCORE_TESTSUPPORT_EXPORT,
+    JSGenerateToJSObject,
+] dictionary CookieData {
+    DOMString name;
+    DOMString value;
+    DOMString domain;
+    double expires;
+    boolean isHttpOnly;
+    boolean isSecure;
+    boolean isSession;
+    boolean isSameSiteLax;
+    boolean isSameSiteStrict;
+};
+
+[
+    ExportMacro=WEBCORE_TESTSUPPORT_EXPORT,
     NoInterfaceObject,
 ] interface Internals {
@@ -667 +682 @@
 
     void setAlwaysAllowLocalWebarchive();
-};
+
+    sequence<CookieData> getCookies();
+};