⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 259772 in webkit


Ignore:
Timestamp:
Apr 8, 2020, 5:42:25 PM (6 years ago)
Author:
commit-queue@webkit.org
Message:

_corsDisablingPatterns should allow security policy access to those patterns
​https://bugs.webkit.org/show_bug.cgi?id=210218
<rdar://problem/61395166>

Patch by Alex Christensen <​achristensen@webkit.org> on 2020-04-08
Reviewed by Timothy Hatcher.

Source/WebCore:

This gives WKWebViewConfiguration._corsDisablingPatterns power similar to WKBundleAddOriginAccessWhitelistEntry
but its API is per-WKWebView (even if its implementation is unfortunately currently process global in the web process).
Functionality covered by a new API test.

  • page/Page.cpp:

(WebCore::m_loadsFromNetwork):

  • page/PageConfiguration.h:
  • page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::canRequest const):
(WebCore::SecurityOrigin::canDisplay const):

  • page/SecurityPolicy.cpp:

(WebCore::originAccessPatterns):
(WebCore::SecurityPolicy::isAccessWhiteListed):
(WebCore::SecurityPolicy::allowAccessTo):
(WebCore::SecurityPolicy::isAccessToURLWhiteListed): Deleted.

  • page/SecurityPolicy.h:

Source/WebKit:

  • WebProcess/WebPage/WebPage.cpp:

(WebKit::m_processDisplayName):

Tools:

  • TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
Location:
trunk
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r259766 r259772  
     12020-04-08  Alex Christensen  <achristensen@webkit.org>
     2
     3        _corsDisablingPatterns should allow security policy access to those patterns
     4        https://bugs.webkit.org/show_bug.cgi?id=210218
     5        <rdar://problem/61395166>
     6
     7        Reviewed by Timothy Hatcher.
     8
     9        This gives WKWebViewConfiguration._corsDisablingPatterns power similar to WKBundleAddOriginAccessWhitelistEntry
     10        but its API is per-WKWebView (even if its implementation is unfortunately currently process global in the web process).
     11        Functionality covered by a new API test.
     12
     13        * page/Page.cpp:
     14        (WebCore::m_loadsFromNetwork):
     15        * page/PageConfiguration.h:
     16        * page/SecurityOrigin.cpp:
     17        (WebCore::SecurityOrigin::canRequest const):
     18        (WebCore::SecurityOrigin::canDisplay const):
     19        * page/SecurityPolicy.cpp:
     20        (WebCore::originAccessPatterns):
     21        (WebCore::SecurityPolicy::isAccessWhiteListed):
     22        (WebCore::SecurityPolicy::allowAccessTo):
     23        (WebCore::SecurityPolicy::isAccessToURLWhiteListed): Deleted.
     24        * page/SecurityPolicy.h:
     25
    1262020-04-08  Wenson Hsieh  <wenson_hsieh@apple.com>
    227

  • trunk/Source/WebCore/page/Page.cpp

    r259650 r259772  
    292292    , m_deviceOrientationUpdateProvider(WTFMove(pageConfiguration.deviceOrientationUpdateProvider))
    293293#endif
     294    , m_corsDisablingPatterns(WTFMove(pageConfiguration.corsDisablingPatterns))
    294295    , m_loadsSubresources(pageConfiguration.loadsSubresources)
    295296    , m_loadsFromNetwork(pageConfiguration.loadsFromNetwork)
    … …  
    331332    m_libWebRTCProvider->supportsH265(RuntimeEnabledFeatures::sharedFeatures().webRTCH265CodecEnabled());
    332333#endif
    333 
    334     m_corsDisablingPatterns.reserveInitialCapacity(pageConfiguration.corsDisablingPatterns.size());
    335     for (auto&& pattern : WTFMove(pageConfiguration.corsDisablingPatterns)) {
    336         UserContentURLPattern parsedPattern(WTFMove(pattern));
    337         if (parsedPattern.isValid())
    338             m_corsDisablingPatterns.uncheckedAppend(WTFMove(parsedPattern));
    339     }
    340     m_corsDisablingPatterns.shrinkToFit();
    341334   
    342335    if (!pageConfiguration.userScriptsShouldWaitUntilNotification)

  • trunk/Source/WebCore/page/PageConfiguration.h

    r259523 r259772  
    6464class StorageNamespaceProvider;
    6565class UserContentProvider;
     66class UserContentURLPattern;
    6667class ValidationMessageClient;
    6768class VisitedLinkStore;
    … …  
    126127    RefPtr<DeviceOrientationUpdateProvider> deviceOrientationUpdateProvider;
    127128#endif
    128     Vector<String> corsDisablingPatterns;
     129    Vector<UserContentURLPattern> corsDisablingPatterns;
    129130    UniqueRef<MediaRecorderProvider> mediaRecorderProvider;
    130131    bool loadsSubresources { true };

  • trunk/Source/WebCore/page/SecurityOrigin.cpp

    r258494 r259772  
    324324        return true;
    325325
    326     if (SecurityPolicy::isAccessWhiteListed(this, &targetOrigin.get()))
     326    if (SecurityPolicy::isAccessWhiteListed(*this, targetOrigin.get(), url))
    327327        return true;
    328328
    … …  
    383383
    384384    if (LegacySchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
    385         return equalIgnoringASCIICase(m_data.protocol, protocol) || SecurityPolicy::isAccessToURLWhiteListed(this, url);
     385        return equalIgnoringASCIICase(m_data.protocol, protocol) || SecurityPolicy::isAccessWhiteListed(*this, url);
    386386
    387387    if (!SecurityPolicy::restrictAccessToLocal())
    … …  
    392392
    393393    if (LegacySchemeRegistry::shouldTreatURLSchemeAsLocal(protocol))
    394         return canLoadLocalResources() || SecurityPolicy::isAccessToURLWhiteListed(this, url);
     394        return canLoadLocalResources() || SecurityPolicy::isAccessWhiteListed(*this, url);
    395395
    396396    return true;

  • trunk/Source/WebCore/page/SecurityPolicy.cpp

    r258869 r259772  
    3232#include "OriginAccessEntry.h"
    3333#include "SecurityOrigin.h"
     34#include "UserContentURLPattern.h"
    3435#include <memory>
    3536#include <wtf/HashMap.h>
    … …  
    5253    static NeverDestroyed<OriginAccessMap> originAccessMap;
    5354    return originAccessMap;
     55}
     56
     57static Lock originAccessPatternLock;
     58static Vector<UserContentURLPattern>& originAccessPatterns()
     59{
     60    ASSERT(originAccessPatternLock.isHeld());
     61    static NeverDestroyed<Vector<UserContentURLPattern>> originAccessPatterns;
     62    return originAccessPatterns;
    5463}
    5564
    … …  
    192201}
    193202
    194 bool SecurityPolicy::isAccessWhiteListed(const SecurityOrigin* activeOrigin, const SecurityOrigin* targetOrigin)
    195 {
    196     Locker<Lock> locker(originAccessMapLock);
    197     if (OriginAccessWhiteList* list = originAccessMap().get(activeOrigin->toString())) {
    198         for (auto& entry : *list) {
    199             if (entry.matchesOrigin(*targetOrigin))
    200                 return true;
     203bool SecurityPolicy::isAccessWhiteListed(const SecurityOrigin& activeOrigin, const SecurityOrigin& targetOrigin, const URL& targetURL)
     204{
     205    ASSERT(targetOrigin.equal(SecurityOrigin::create(targetURL).ptr()));
     206    {
     207        Locker<Lock> locker(originAccessMapLock);
     208        if (OriginAccessWhiteList* list = originAccessMap().get(activeOrigin.toString())) {
     209            for (auto& entry : *list) {
     210                if (entry.matchesOrigin(targetOrigin))
     211                    return true;
     212            }
    201213        }
    202214    }
     215    Locker<Lock> locker(originAccessPatternLock);
     216    for (const auto& pattern : originAccessPatterns()) {
     217        if (pattern.matches(targetURL))
     218            return true;
     219    }
    203220    return false;
    204221}
    205222
    206 bool SecurityPolicy::isAccessToURLWhiteListed(const SecurityOrigin* activeOrigin, const URL& url)
    207 {
    208     Ref<SecurityOrigin> targetOrigin(SecurityOrigin::create(url));
    209     return isAccessWhiteListed(activeOrigin, &targetOrigin.get());
     223bool SecurityPolicy::isAccessWhiteListed(const SecurityOrigin& activeOrigin, const URL& url)
     224{
     225    return isAccessWhiteListed(activeOrigin, SecurityOrigin::create(url).get(), url);
    210226}
    211227
    … …  
    256272}
    257273
     274void SecurityPolicy::allowAccessTo(const UserContentURLPattern& pattern)
     275{
     276    Locker<Lock> locker(originAccessPatternLock);
     277    originAccessPatterns().append(pattern);
     278}
     279
    258280} // namespace WebCore

  • trunk/Source/WebCore/page/SecurityPolicy.h

    r257729 r259772  
    3535
    3636class SecurityOrigin;
     37class UserContentURLPattern;
    3738
    3839class SecurityPolicy {
    … …  
    6768    static bool allowSubstituteDataAccessToLocal();
    6869
     70    WEBCORE_EXPORT static void allowAccessTo(const UserContentURLPattern&);
    6971    WEBCORE_EXPORT static void addOriginAccessWhitelistEntry(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomain, bool allowDestinationSubdomains);
    7072    WEBCORE_EXPORT static void removeOriginAccessWhitelistEntry(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomain, bool allowDestinationSubdomains);
    7173    WEBCORE_EXPORT static void resetOriginAccessWhitelists();
    7274
    73     static bool isAccessWhiteListed(const SecurityOrigin* activeOrigin, const SecurityOrigin* targetOrigin);
    74     static bool isAccessToURLWhiteListed(const SecurityOrigin* activeOrigin, const URL&);
     75    static bool isAccessWhiteListed(const SecurityOrigin& activeOrigin, const SecurityOrigin& targetOrigin, const URL& targetURL);
     76    static bool isAccessWhiteListed(const SecurityOrigin& activeOrigin, const URL& targetURL);
    7577};
    7678

  • trunk/Source/WebKit/ChangeLog

    r259771 r259772  
     12020-04-08  Alex Christensen  <achristensen@webkit.org>
     2
     3        _corsDisablingPatterns should allow security policy access to those patterns
     4        https://bugs.webkit.org/show_bug.cgi?id=210218
     5        <rdar://problem/61395166>
     6
     7        Reviewed by Timothy Hatcher.
     8
     9        * WebProcess/WebPage/WebPage.cpp:
     10        (WebKit::m_processDisplayName):
     11
    1122020-04-08  Brent Fulgham  <bfulgham@apple.com>
    213

  • trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

    r259523 r259772  
    221221#include <WebCore/SWClientConnection.h>
    222222#include <WebCore/ScriptController.h>
     223#include <WebCore/SecurityPolicy.h>
    223224#include <WebCore/SerializedScriptValue.h>
    224225#include <WebCore/Settings.h>
    … …  
    229230#include <WebCore/SubstituteData.h>
    230231#include <WebCore/TextIterator.h>
     232#include <WebCore/UserContentURLPattern.h>
    231233#include <WebCore/UserGestureIndicator.h>
    232234#include <WebCore/UserInputBridge.h>
    … …  
    529531#endif
    530532
    531     pageConfiguration.corsDisablingPatterns = WTFMove(parameters.corsDisablingPatterns);
     533    Vector<UserContentURLPattern> parsedPatterns;
     534    parsedPatterns.reserveInitialCapacity(parameters.corsDisablingPatterns.size());
     535    for (auto&& pattern : WTFMove(parameters.corsDisablingPatterns)) {
     536        UserContentURLPattern parsedPattern(WTFMove(pattern));
     537        if (parsedPattern.isValid()) {
     538            WebCore::SecurityPolicy::allowAccessTo(parsedPattern);
     539            parsedPatterns.uncheckedAppend(WTFMove(parsedPattern));
     540        }
     541    }
     542    parsedPatterns.shrinkToFit();
     543   
     544    pageConfiguration.corsDisablingPatterns = WTFMove(parsedPatterns);
    532545    pageConfiguration.userScriptsShouldWaitUntilNotification = parameters.userScriptsShouldWaitUntilNotification;
    533546    pageConfiguration.loadsSubresources = parameters.loadsSubresources;

  • trunk/Tools/ChangeLog

    r259770 r259772  
     12020-04-08  Alex Christensen  <achristensen@webkit.org>
     2
     3        _corsDisablingPatterns should allow security policy access to those patterns
     4        https://bugs.webkit.org/show_bug.cgi?id=210218
     5        <rdar://problem/61395166>
     6
     7        Reviewed by Timothy Hatcher.
     8
     9        * TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
     10
    1112020-04-08  Alex Christensen  <achristensen@webkit.org>
    212

  • trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm

    r259392 r259772  
    10051005}
    10061006
     1007TEST(URLSchemeHandler, DisableCORSCanvas)
     1008{
     1009    bool corssuccess = false;
     1010    bool corsfailure = false;
     1011    bool done = false;
     1012
     1013    auto handler = adoptNS([TestURLSchemeHandler new]);
     1014
     1015    WKWebViewConfiguration *configuration = [[[WKWebViewConfiguration alloc] init] autorelease];
     1016    [configuration setURLSchemeHandler:handler.get() forURLScheme:@"cors"];
     1017
     1018    [handler setStartURLSchemeTaskHandler:[&](WKWebView *, id<WKURLSchemeTask> task) {
     1019        NSData *response = nil;
     1020        NSString *mimeType = nil;
     1021        if ([task.request.URL.path isEqualToString:@"/main.html"]) {
     1022            mimeType = @"text/html";
     1023            response = [@"<canvas id='canvas'></canvas><img src='cors://host2/image.png' onload='imageloaded()' id='img'></img><script>"
     1024                "function imageloaded() {"
     1025                    "let canvas = document.getElementById('canvas');"
     1026                    "let context = canvas.getContext('2d');"
     1027                    "let img = document.getElementById('img');"
     1028                    "context.drawImage(img, 0, 0);"
     1029                    "try {"
     1030                        "let dataURL = canvas.toDataURL('image/png', 1);"
     1031                        "fetch('corssuccess');"
     1032                    "} catch(err) {"
     1033                        "fetch('corsfailure');"
     1034                    "}"
     1035                "}"
     1036            "</script>" dataUsingEncoding:NSUTF8StringEncoding];
     1037        } else if ([task.request.URL.path isEqualToString:@"/corssuccess"]) {
     1038            corssuccess = true;
     1039            done = true;
     1040        } else if ([task.request.URL.path isEqualToString:@"/corsfailure"]) {
     1041            corsfailure = true;
     1042            done = true;
     1043        } else if ([task.request.URL.path isEqualToString:@"/image.png"]) {
     1044            mimeType = @"image/png";
     1045            response = [NSData dataWithContentsOfURL:[[NSBundle mainBundle] URLForResource:@"400x400-green" withExtension:@"png" subdirectory:@"TestWebKitAPI.resources"]];
     1046        } else
     1047            ASSERT_NOT_REACHED();
     1048
     1049        if (response) {
     1050            [task didReceiveResponse:[[[NSURLResponse alloc] initWithURL:task.request.URL MIMEType:mimeType expectedContentLength:response.length textEncodingName:nil] autorelease]];
     1051            [task didReceiveData:response];
     1052            [task didFinish];
     1053        }
     1054    }];
     1055
     1056    {
     1057        auto webView = adoptNS([[WKWebView alloc] initWithFrame:CGRectMake(0, 0, 800, 600) configuration:configuration]);
     1058        [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"cors://host1/main.html"]]];
     1059        TestWebKitAPI::Util::run(&done);
     1060    }
     1061    EXPECT_FALSE(corssuccess);
     1062    EXPECT_TRUE(corsfailure);
     1063
     1064    corssuccess = false;
     1065    corsfailure = false;
     1066    done = false;
     1067
     1068    configuration._corsDisablingPatterns = @[@"*://*/*"];
     1069    {
     1070        auto webView = adoptNS([[WKWebView alloc] initWithFrame:CGRectMake(0, 0, 800, 600) configuration:configuration]);
     1071        [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"cors://host1/main.html"]]];
     1072        TestWebKitAPI::Util::run(&done);
     1073    }
     1074    EXPECT_TRUE(corssuccess);
     1075    EXPECT_FALSE(corsfailure);
     1076}
     1077
    10071078TEST(URLSchemeHandler, LoadsFromNetwork)
    10081079{
Note: See TracChangeset for help on using the changeset viewer.