Changeset 246129 in webkit

Timestamp:

Jun 5, 2019, 3:09:25 PM (7 years ago)

Author:

dbates@webkit.org

Message:

[CSP] Data URLs should inherit their CSP policy
​https://bugs.webkit.org/show_bug.cgi?id=198572
<rdar://problem/50660927>

Reviewed by Brent Fulgham.

Source/WebCore:

As per <​https://w3c.github.io/webappsec-csp/#security-inherit-csp> (Editor's Draft, 28 February 2019) data
URLs should inherit their CSP policy from their parent (if they have one).

Test: http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance.html

• dom/Document.cpp:

(WebCore::Document::shouldInheritContentSecurityPolicyFromOwner const):

LayoutTests:

Add a test to ensure that a framed data URL inherits its CSP policy from its parent document.

• http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-06-05  Daniel Bates  <dabates@apple.com>
+
+        [CSP] Data URLs should inherit their CSP policy
+        https://bugs.webkit.org/show_bug.cgi?id=198572
+        <rdar://problem/50660927>
+
+        Reviewed by Brent Fulgham.
+
+        Add a test to ensure that a framed data URL inherits its CSP policy from its parent document.
+
+        * http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance.html: Added.
+
 2019-06-05  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-06-05  Daniel Bates  <dabates@apple.com>
+
+        [CSP] Data URLs should inherit their CSP policy
+        https://bugs.webkit.org/show_bug.cgi?id=198572
+        <rdar://problem/50660927>
+
+        Reviewed by Brent Fulgham.
+
+        As per <https://w3c.github.io/webappsec-csp/#security-inherit-csp> (Editor's Draft, 28 February 2019) data
+        URLs should inherit their CSP policy from their parent (if they have one).
+
+        Test: http/tests/security/contentSecurityPolicy/subframe-with-data-url-inheritance.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::shouldInheritContentSecurityPolicyFromOwner const):
+
 2019-06-05  Saam Barati  <sbarati@apple.com>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -5904 +5904 @@
     if (SecurityPolicy::shouldInheritSecurityOriginFromOwner(m_url))
         return true;
+    if (m_url.protocolIsData())
+        return true;
     if (!isPluginDocument())
         return false;