⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 259829 in webkit


Ignore:
Timestamp:
Apr 9, 2020, 2:31:03 PM (6 years ago)
Author:
keith_miller@apple.com
Message:

Remove legacy X-WebKit-CSP header support
​https://bugs.webkit.org/show_bug.cgi?id=210256
Source/WebCore:

<rdar://problem/60634363>

Reviewed by Geoffrey Garen.

Supporting this header is causes compatibly issues for some sites
and they appear to be misconfigured. Additionally, no other
browser has supported these headers in many years. This patch
removes all support for the legacy X-WebKit-CSP header.

  • dom/Document.cpp:

(WebCore::Document::processHttpEquiv):

  • page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList):

  • page/csp/ContentSecurityPolicyResponseHeaders.cpp:

(WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders):

  • page/csp/ContentSecurityPolicyResponseHeaders.h:
  • platform/network/HTTPHeaderNames.in:
  • platform/network/ResourceResponseBase.cpp:

(WebCore::isSafeCrossOriginResponseHeader):

LayoutTests:

Reviewed by Geoffrey Garen.

Fix tests so they ensure we don't respect legacy CSP headers anymore.

  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy.php:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:
Location:
trunk
Files:
40 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r259810 r259829  
     12020-04-09  Keith Miller  <keith_miller@apple.com>
     2
     3        Remove legacy X-WebKit-CSP header support
     4        https://bugs.webkit.org/show_bug.cgi?id=210256
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        Fix tests so they ensure we don't respect legacy CSP headers anymore.
     9
     10        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt:
     11        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html:
     12        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt:
     13        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html:
     14        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt:
     15        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html:
     16        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt:
     17        * http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html:
     18        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt:
     19        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html:
     20        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt:
     21        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html:
     22        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
     23        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy.php:
     24        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
     25        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
     26        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
     27        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
     28        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
     29        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
     30        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
     31        * http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
     32        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
     33        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php:
     34        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt:
     35        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php:
     36        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
     37        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php:
     38        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
     39        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php:
     40        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt:
     41        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html:
     42        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt:
     43        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:
     44
    1452020-04-09  Devin Rousso  <drousso@apple.com>
    246

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked-expected.txt

    r198591 r259829  
    1 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/navigation/resources/form-target.pl because it does not appear in the form-action directive of the Content Security Policy.
    2  
    3 Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
     1This page was requested with the HTTP method POST.
     2
     3Parameters:
     4
     5fieldname = fieldvalue
    46
    57============== Back Forward List ==============
    6 curr->  http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-blocked.html  **nav target**
     8        http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-blocked.html  **nav target**
     9curr->  http://127.0.0.1:8000/navigation/resources/form-target.pl  **nav target**
    710===============================================

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html

    r125772 r259829  
    2626    </form>
    2727
    28     <p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
     28    <p>
     29    Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
     30
     31    Update: Since we no longer support X-WebKit-CSP all the form should be submitted.
     32    </p>
    2933</body>
    3034</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt

    r198591 r259829  
    1 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/navigation/resources/form-target.pl?fieldname=fieldvalue because it does not appear in the form-action directive of the Content Security Policy.
    2  
    3 Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
     1This page was requested with the HTTP method GET.
     2
     3Parameters:
     4
     5fieldname = fieldvalue
    46
    57============== Back Forward List ==============
    6 curr->  http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html  **nav target**
     8curr->  http://127.0.0.1:8000/navigation/resources/form-target.pl?fieldname=fieldvalue  **nav target**
    79===============================================

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked.html

    r125772 r259829  
    2424    </form>
    2525
    26     <p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
     26    <p>
     27    Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
     28
     29    Update: Since we no longer support X-WebKit-CSP the form should be submitted.
     30    </p>
    2731</body>
    2832</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked-expected.txt

    r198591 r259829  
    1 CONSOLE MESSAGE: Refused to load javascript:alert("FAIL!") because it does not appear in the form-action directive of the Content Security Policy.
     1ALERT: RAN CODE CORRECTLY!
    22 
    3 Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.
     3Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert. Update: Since we no longer support X-WebKit-CSP the form should be submitted.
    44
    55============== Back Forward List ==============

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-javascript-blocked.html

    r125772 r259829  
    2121</head>
    2222<body>
    23     <form action='javascript:alert("FAIL!")' id='theform' method='post'>
     23    <form action='javascript:alert("RAN CODE CORRECTLY!")' id='theform' method='post'>
    2424        <input type='text' name='fieldname' value='fieldvalue'>
    2525        <input type='submit' id='submit' value='submit'>
    2626    </form>
    2727
    28     <p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.</p>
     28    <p>
     29    Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.
     30
     31    Update: Since we no longer support X-WebKit-CSP the form should be submitted.
     32    </p>
    2933</body>
    3034</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked-expected.txt

    r198591 r259829  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/navigation/resources/form-target.pl because it does not appear in the form-action directive of the Content Security Policy.
    2  
    3 Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
     1This page was requested with the HTTP method GET.
    42
    5 ============== Back Forward List ==============
    6 curr->  http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html  **nav target**
    7 ===============================================
     3Parameters:
     4
     5

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html

    r125772 r259829  
    2626    </form>
    2727
    28     <p>Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
     28    <p>
     29    Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
     30
     31    Update: Since we no longer support X-WebKit-CSP the form should be submitted.
     32    </p>
    2933</body>
    3034</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked-expected.txt

    r231450 r259829  
    1 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    3 Only the first two of these scripts should execute even though there are parse errors in the policy.
     1Only the first two of these scripts should execute even though there are parse errors in the policy. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
    42
    53

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-blocked.html

    r208788 r259829  
    88    ['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],
    99    ['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],
    10     ['no', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
    11     ['no', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
     10    ['yes', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
     11    ['yes', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
    1212];
    1313</script>
    … …  
    1616  <p>
    1717    Only the first two of these scripts should execute even though there are parse errors in the policy.
     18
     19    Update: Since we no longer support X-WebKit-CSP all the scripts should run.
    1820  </p>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce-expected.txt

    r231450 r259829  
    1 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''n'. It will be ignored.
    2 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
    4 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    5 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
    6 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    7 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    8 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    9 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    10 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    11 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
    12 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    13 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    14 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
    15 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    16 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    17 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
    18 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    19 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
    20 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    21 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
    22 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    23 None of these scripts should execute, as all the nonces are invalid.
     1None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should run.
    242
    253

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-invalidnonce.html

    r208788 r259829  
    55<script>
    66var tests = [
    7     ['no', 'script-src \'n', 'resources/script.js', ''],
    8     ['no', 'script-src \'nonce', 'resources/script.js', ''],
    9     ['no', 'script-src \'nonce-\'', 'resources/script.js', ''],
    10     ['no', 'script-src \'nonce-', 'resources/script.js', ''],
    11     ['no', 'script-src nonce-abcd', 'resources/script.js', ''],
    12     ['no', 'script-src \'nonce- \'', 'resources/script.js', ''],
    13     ['no', 'script-src \'nonce-     \'', 'resources/script.js', ''],
    14     ['no', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
    15     ['no', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
    16     ['no', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
     7    ['yes', 'script-src \'n', 'resources/script.js', ''],
     8    ['yes', 'script-src \'nonce', 'resources/script.js', ''],
     9    ['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
     10    ['yes', 'script-src \'nonce-', 'resources/script.js', ''],
     11    ['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
     12    ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
     13    ['yes', 'script-src \'nonce-     \'', 'resources/script.js', ''],
     14    ['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
     15    ['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
     16    ['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
    1717];
    1818</script>
    … …  
    2121    <p>
    2222        None of these scripts should execute, as all the nonces are invalid.
     23
     24        Update: Since we no longer support X-WebKit-CSP all the scripts should run.
    2325    </p>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt

    r231450 r259829  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    2 CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    4 PASS did not execute script.
    5 
    6 
    7 
    8 --------
    9 Frame: '<!--frame1-->'
    10 --------
    11 CSP report received:
    12 CONTENT_TYPE: application/csp-report
    13 HTTP_HOST: 127.0.0.1:8000
    14 HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
    15 REQUEST_METHOD: POST
    16 REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
    17 === POST DATA ===
    18 {"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","blocked-uri":"","status-code":200}}
     2CONSOLE MESSAGE: line 11: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     3PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php

    r203434 r259829  
    77<head>
    88<script nonce="dump-as-text">
    9 if (window.testRunner) {
     9if (window.testRunner)
    1010    testRunner.dumpAsText();
    11     testRunner.dumpChildFramesAsText();
    12 }
    1311</script>
    1412</head>
    1513<body>
    16 <p id="result">PASS did not execute script.</p>
     14<p id="result">FAIL did not execute script.</p>
    1715<script>
    18 document.getElementById("result").textContent = "FAIL did execute script.";
     16document.getElementById("result").textContent = "PASS did execute script.";
    1917</script>
     18<!-- Call testRunner.dumpChildFramesAsText() and load
    2019<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php"></iframe>
     20once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
    2121</body>
    2222</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt

    r203434 r259829  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'sha256-AJqUvsXuHfMNXALcBPVqeiKkFk8OLvn3U7ksHP/QQ90=' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    2 CONSOLE MESSAGE: line 12: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 PASS did not execute script.
     2CONSOLE MESSAGE: line 12: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     3PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php

    r203434 r259829  
    1212</head>
    1313<body>
    14 <p id="result">PASS did not execute script.</p>
     14<p id="result">FAIL did not execute script.</p>
    1515<script>
    16 document.getElementById("result").textContent = "FAIL did execute script.";
     16document.getElementById("result").textContent = "PASS did execute script.";
    1717</script>
    1818</body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt

    r231450 r259829  
    11CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 PASS did not execute script.
     2PASS did execute script.
    43
    54

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php

    r203434 r259829  
    1414</head>
    1515<body>
    16 <p id="result">PASS did not execute script.</p>
     16<p id="result">FAIL did not execute script.</p>
    1717<script>
    18 document.getElementById("result").textContent = "FAIL did execute script.";
     18document.getElementById("result").textContent = "PASS did execute script.";
    1919</script>
    2020<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt

    r231450 r259829  
    11CONSOLE MESSAGE: line 14: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: line 14: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 PASS did not execute script.
     2PASS did execute script.
    43
    54

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php

    r203434 r259829  
    1414</head>
    1515<body>
    16 <p id="result">PASS did not execute script.</p>
     16<p id="result">FAIL did not execute script.</p>
    1717<script>
    18 document.getElementById("result").textContent = "FAIL did execute script.";
     18document.getElementById("result").textContent = "PASS did execute script.";
    1919</script>
    2020<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt

    r231450 r259829  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    2 CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    4 CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    5 PASS did not execute script.
    6 
    7 
    8 
    9 --------
    10 Frame: '<!--frame1-->'
    11 --------
    12 CSP report received:
    13 CONTENT_TYPE: application/csp-report
    14 HTTP_HOST: 127.0.0.1:8000
    15 HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
    16 REQUEST_METHOD: POST
    17 REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php
    18 === POST DATA ===
    19 {"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php","blocked-uri":"","status-code":200}}
     2PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php

    r203434 r259829  
    77<head>
    88<script nonce="dump-as-text">
    9 if (window.testRunner) {
     9if (window.testRunner)
    1010    testRunner.dumpAsText();
    11     testRunner.dumpChildFramesAsText();
    12 }
    1311</script>
    1412</head>
    1513<body>
    16 <p id="result">PASS did not execute script.</p>
     14<p id="result">FAIL did not execute script.</p>
    1715<script nonce="dummy">
    18 document.getElementById("result").textContent = "FAIL did execute script.";
     16document.getElementById("result").textContent = "PASS did execute script.";
    1917</script>
     18<!-- Call testRunner.dumpChildFramesAsText() and load
    2019<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy.php"></iframe>
     20once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
    2121</body>
    2222</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2-expected.txt

    r203434 r259829  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    2 CONSOLE MESSAGE: line 12: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: line 12: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    4 PASS did not execute script.
     2PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy2.php

    r203434 r259829  
    1212</head>
    1313<body>
    14 <p id="result">PASS did not execute script.</p>
     14<p id="result">FAIL did not execute script.</p>
    1515<script nonce="dummy">
    16 document.getElementById("result").textContent = "FAIL did execute script.";
     16document.getElementById("result").textContent = "PASS did execute script.";
    1717</script>
    1818</body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt

    r231450 r259829  
    1 CONSOLE MESSAGE: line 13: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: line 13: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 PASS did not execute script.
    4 
    5 
    6 
    7 --------
    8 Frame: '<!--frame1-->'
    9 --------
    10 CSP report received:
    11 CONTENT_TYPE: application/csp-report
    12 HTTP_HOST: 127.0.0.1:8000
    13 HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
    14 REQUEST_METHOD: POST
    15 REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
    16 === POST DATA ===
    17 {"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","referrer":"","violated-directive":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","blocked-uri":"","status-code":200}}
     1PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php

    r203434 r259829  
    77<head>
    88<script nonce="dump-as-text">
    9 if (window.testRunner) {
     9if (window.testRunner)
    1010    testRunner.dumpAsText();
    11     testRunner.dumpChildFramesAsText();
    12 }
    1311</script>
    1412</head>
    1513<body>
    16 <p id="result">PASS did not execute script.</p>
     14<p id="result">FAIL did not execute script.</p>
    1715<script nonce="dummy">
    18 document.getElementById("result").textContent = "FAIL did execute script.";
     16document.getElementById("result").textContent = "PASS did execute script.";
    1917</script>
     18<!-- Call testRunner.dumpChildFramesAsText() and load
    2019<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php"></iframe>
     20once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
    2121</body>
    2222</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt

    r231450 r259829  
    1 CONSOLE MESSAGE: line 14: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: line 14: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 PASS did not execute script.
    4 
    5 
    6 
    7 --------
    8 Frame: '<!--frame1-->'
    9 --------
    10 CSP report received:
    11 CONTENT_TYPE: application/csp-report
    12 HTTP_HOST: 127.0.0.1:8000
    13 HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php
    14 REQUEST_METHOD: POST
    15 REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php
    16 === POST DATA ===
    17 {"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php","referrer":"","violated-directive":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'","effective-directive":"script-src","original-policy":"script-src 'nonce-that-is-not-equal-to-dummy' 'nonce-dump-as-text'; report-uri ../resources/save-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php","blocked-uri":"","status-code":200}}
     1PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2.php

    r203434 r259829  
    77<meta http-equiv="X-WebKit-CSP" content="script-src 'nonce-dump-as-text'">
    88<script nonce="dump-as-text">
    9 if (window.testRunner) {
     9if (window.testRunner)
    1010    testRunner.dumpAsText();
    11     testRunner.dumpChildFramesAsText();
    12 }
    1311</script>
    1412</head>
    1513<body>
    16 <p id="result">PASS did not execute script.</p>
     14<p id="result">FAIL did not execute script.</p>
    1715<script nonce="dummy">
    18 document.getElementById("result").textContent = "FAIL did execute script.";
     16document.getElementById("result").textContent = "PASS did execute script.";
    1917</script>
     18<!-- Call testRunner.dumpChildFramesAsText() and load
    2019<iframe src="../resources/echo-report.php?test=/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy.php"></iframe>
     20once we fix reporting of nonce violations for report-only policies. See <https://bugs.webkit.org/show_bug.cgi?id=159830>. -->
    2121</body>
    2222</html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-expected.txt

    r231450 r259829  
    1 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    3 Only the first two of these scripts should execute even though there are parse errors in the policy.
     1Only the first two of these scripts should execute even though there are parse errors in the policy. Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
    42
    53

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html

    r195367 r259829  
    88    ['yes', 'script-src 127.0.0.1:8000 \'nonce-nonce\'', 'resources/script.js', 'nonce'],
    99    ['yes', 'script-src 127.0.0.1:8000 \'nonce-base64has+and/characters\'', 'resources/script.js', 'base64has+and/characters'],
    10     ['no', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
    11     ['no', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
     10    ['yes', 'script-src \'nonce-nonce\'', 'resources/script.js', 'notnonce'],
     11    ['yes', 'script-src \'nonce-notnonce\'', 'resources/script.js', 'nonce'],
    1212];
    1313</script>
    … …  
    1616  <p>
    1717    Only the first two of these scripts should execute even though there are parse errors in the policy.
     18
     19    Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
    1820  </p>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt

    r231450 r259829  
    1 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''n'. It will be ignored.
    2 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce'. It will be ignored.
    4 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    5 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-''. It will be ignored.
    6 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    7 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    8 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    9 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    10 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    11 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
    12 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    13 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    14 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: '''. It will be ignored.
    15 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    16 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-'. It will be ignored.
    17 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: 'spaces''. It will be ignored.
    18 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    19 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-{}''. It will be ignored.
    20 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    21 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''nonce-/\''. It will be ignored.
    22 CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js because it does not appear in the script-src directive of the Content Security Policy.
    23 None of these scripts should execute, as all the nonces are invalid.
     1None of these scripts should execute, as all the nonces are invalid. Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
    242
    253

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html

    r195367 r259829  
    55<script>
    66var tests = [
    7     ['no', 'script-src \'n', 'resources/script.js', ''],
    8     ['no', 'script-src \'nonce', 'resources/script.js', ''],
    9     ['no', 'script-src \'nonce-\'', 'resources/script.js', ''],
    10     ['no', 'script-src \'nonce-', 'resources/script.js', ''],
    11     ['no', 'script-src nonce-abcd', 'resources/script.js', ''],
    12     ['no', 'script-src \'nonce- \'', 'resources/script.js', ''],
    13     ['no', 'script-src \'nonce-     \'', 'resources/script.js', ''],
    14     ['no', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
    15     ['no', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
    16     ['no', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
     7    ['yes', 'script-src \'n', 'resources/script.js', ''],
     8    ['yes', 'script-src \'nonce', 'resources/script.js', ''],
     9    ['yes', 'script-src \'nonce-\'', 'resources/script.js', ''],
     10    ['yes', 'script-src \'nonce-', 'resources/script.js', ''],
     11    ['yes', 'script-src nonce-abcd', 'resources/script.js', ''],
     12    ['yes', 'script-src \'nonce- \'', 'resources/script.js', ''],
     13    ['yes', 'script-src \'nonce-     \'', 'resources/script.js', ''],
     14    ['yes', 'script-src \'nonce- nonces have no spaces\'', 'resources/script.js', ''],
     15    ['yes', 'script-src \'nonce-{}\'', 'resources/script.js', '{}'],
     16    ['yes', 'script-src \'nonce-/\\\'', 'resources/script.js', '/\\'],
    1717];
    1818</script>
    … …  
    2121  <p>
    2222      None of these scripts should execute, as all the nonces are invalid.
     23
     24      Update: Since we no longer support X-WebKit-CSP all the scripts should be executed.
    2325  </p>

  • trunk/Source/WebCore/ChangeLog

    r259827 r259829  
     12020-04-09  Keith Miller  <keith_miller@apple.com>
     2
     3        Remove legacy X-WebKit-CSP header support
     4        https://bugs.webkit.org/show_bug.cgi?id=210256
     5        <rdar://problem/60634363>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        Supporting this header is causes compatibly issues for some sites
     10        and they appear to be misconfigured. Additionally, no other
     11        browser has supported these headers in many years. This patch
     12        removes all support for the legacy X-WebKit-CSP header.
     13
     14        * dom/Document.cpp:
     15        (WebCore::Document::processHttpEquiv):
     16        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
     17        (WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList):
     18        * page/csp/ContentSecurityPolicyResponseHeaders.cpp:
     19        (WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders):
     20        * page/csp/ContentSecurityPolicyResponseHeaders.h:
     21        * platform/network/HTTPHeaderNames.in:
     22        * platform/network/ResourceResponseBase.cpp:
     23        (WebCore::isSafeCrossOriginResponseHeader):
     24
    1252020-04-09  Per Arne Vollan  <pvollan@apple.com>
    226

  • trunk/Source/WebCore/dom/Document.cpp

    r259761 r259829  
    36463646        break;
    36473647
    3648     case HTTPHeaderName::XWebKitCSP:
    3649         if (isInDocumentHead)
    3650             contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicyHeaderType::PrefixedEnforce, ContentSecurityPolicy::PolicyFrom::HTTPEquivMeta, referrer(), httpStatusCode);
    3651         break;
    3652 
    36533648    default:
    36543649        break;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp

    r251887 r259829  
    118118    : m_policy(policy)
    119119    , m_headerType(type)
    120 {
    121     m_reportOnly = (type == ContentSecurityPolicyHeaderType::Report || type == ContentSecurityPolicyHeaderType::PrefixedReport);
     120    , m_reportOnly(type == ContentSecurityPolicyHeaderType::Report)
     121{
    122122}
    123123

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.cpp

    r231464 r259829  
    4242        m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::Report });
    4343
    44     policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSP);
    45     if (!policyValue.isEmpty())
    46         m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedEnforce });
    47 
    48     policyValue = response.httpHeaderField(HTTPHeaderName::XWebKitCSPReportOnly);
    49     if (!policyValue.isEmpty())
    50         m_headers.append({ policyValue, ContentSecurityPolicyHeaderType::PrefixedReport });
    51 
    5244    m_httpStatusCode = response.httpStatusCode();
    5345}

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h

    r256482 r259829  
    3737    Report,
    3838    Enforce,
    39     PrefixedReport,
    40     PrefixedEnforce,
    4139};
    4240

  • trunk/Source/WebCore/platform/network/HTTPHeaderNames.in

    r253102 r259829  
    103103X-Frame-Options
    104104X-SourceMap
    105 X-WebKit-CSP
    106 X-WebKit-CSP-Report-Only
    107105X-XSS-Protection
    108106X-Temp-Tablet

  • trunk/Source/WebCore/platform/network/ResourceResponseBase.cpp

    r258631 r259829  
    436436        || name == HTTPHeaderName::XDNSPrefetchControl
    437437        || name == HTTPHeaderName::XFrameOptions
    438         || name == HTTPHeaderName::XWebKitCSP
    439         || name == HTTPHeaderName::XWebKitCSPReportOnly
    440438        || name == HTTPHeaderName::XXSSProtection;
    441439}
Note: See TracChangeset for help on using the changeset viewer.