⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 283414 in webkit


Ignore:
Timestamp:
Oct 1, 2021, 4:13:26 PM (5 years ago)
Author:
Alan Coon
Message:

Revert r281431. rdar://problem/81175635

This reverts r283385.

Location:
branches/safari-611.4.2.0-branch
Files:
8 deleted
8 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-611.4.2.0-branch/LayoutTests/ChangeLog

    r283385 r283414  
    1 2021-10-01  Russell Epstein  <repstein@apple.com>
    2 
    3         Cherry-pick r281431. rdar://problem/81175635
    4 
    5     Report correct blocked URI in CSP violation report
    6     https://bugs.webkit.org/show_bug.cgi?id=226316
    7     <rdar://problem/78552912>
    8    
    9     Reviewed by Alex Christensen.
    10    
    11     Source/WebCore:
    12    
    13     Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
    14            http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
    15    
    16     Currently for a blocked redirection we report the blocked URI as the
    17     target URL. This is not up to spec and we should actually report the
    18     requested URL.
    19    
    20     * loader/DocumentThreadableLoader.cpp:
    21     (WebCore::DocumentThreadableLoader::redirectReceived):
    22     (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
    23     * loader/DocumentThreadableLoader.h:
    24     * page/csp/ContentSecurityPolicy.cpp:
    25     (WebCore::ContentSecurityPolicy::allowConnectToSource const):
    26     (WebCore::ContentSecurityPolicy::reportViolation const):
    27     * page/csp/ContentSecurityPolicy.h:
    28    
    29     Source/WebKit:
    30    
    31     Currently for a blocked redirection we report the blocked URI as the
    32     target URL. This is not up to spec and we should actually report the
    33     requested URL.
    34    
    35     * NetworkProcess/NetworkLoadChecker.cpp:
    36     (WebKit::NetworkLoadChecker::check):
    37     (WebKit::NetworkLoadChecker::checkRedirection):
    38     (WebKit::NetworkLoadChecker::checkRequest):
    39     (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
    40     * NetworkProcess/NetworkLoadChecker.h:
    41    
    42     LayoutTests:
    43    
    44     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    45     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
    46     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    47     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
    48     * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    49     * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    50     * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    51     * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    52     WebKitLegacy and Win have different console logging.
    53    
    54     git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    55 
    56     2021-08-22  Kate Cheney  <katherine_cheney@apple.com>
    57 
    58             Report correct blocked URI in CSP violation report
    59             https://bugs.webkit.org/show_bug.cgi?id=226316
    60             <rdar://problem/78552912>
    61 
    62             Reviewed by Alex Christensen.
    63 
    64             * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    65             * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
    66             * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    67             * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
    68             * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    69             * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    70             * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    71             * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    72             WebKitLegacy and Win have different console logging.
    73 
    7412021-09-30  Russell Epstein  <repstein@apple.com>
    752

  • branches/safari-611.4.2.0-branch/Source/WebCore/ChangeLog

    r283385 r283414  
    1 2021-10-01  Russell Epstein  <repstein@apple.com>
    2 
    3         Cherry-pick r281431. rdar://problem/81175635
    4 
    5     Report correct blocked URI in CSP violation report
    6     https://bugs.webkit.org/show_bug.cgi?id=226316
    7     <rdar://problem/78552912>
    8    
    9     Reviewed by Alex Christensen.
    10    
    11     Source/WebCore:
    12    
    13     Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
    14            http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
    15    
    16     Currently for a blocked redirection we report the blocked URI as the
    17     target URL. This is not up to spec and we should actually report the
    18     requested URL.
    19    
    20     * loader/DocumentThreadableLoader.cpp:
    21     (WebCore::DocumentThreadableLoader::redirectReceived):
    22     (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
    23     * loader/DocumentThreadableLoader.h:
    24     * page/csp/ContentSecurityPolicy.cpp:
    25     (WebCore::ContentSecurityPolicy::allowConnectToSource const):
    26     (WebCore::ContentSecurityPolicy::reportViolation const):
    27     * page/csp/ContentSecurityPolicy.h:
    28    
    29     Source/WebKit:
    30    
    31     Currently for a blocked redirection we report the blocked URI as the
    32     target URL. This is not up to spec and we should actually report the
    33     requested URL.
    34    
    35     * NetworkProcess/NetworkLoadChecker.cpp:
    36     (WebKit::NetworkLoadChecker::check):
    37     (WebKit::NetworkLoadChecker::checkRedirection):
    38     (WebKit::NetworkLoadChecker::checkRequest):
    39     (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
    40     * NetworkProcess/NetworkLoadChecker.h:
    41    
    42     LayoutTests:
    43    
    44     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    45     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
    46     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    47     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
    48     * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    49     * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    50     * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    51     * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    52     WebKitLegacy and Win have different console logging.
    53    
    54     git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    55 
    56     2021-08-22  Kate Cheney  <katherine_cheney@apple.com>
    57 
    58             Report correct blocked URI in CSP violation report
    59             https://bugs.webkit.org/show_bug.cgi?id=226316
    60             <rdar://problem/78552912>
    61 
    62             Reviewed by Alex Christensen.
    63 
    64             Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
    65                    http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
    66 
    67             Currently for a blocked redirection we report the blocked URI as the
    68             target URL. This is not up to spec and we should actually report the
    69             requested URL.
    70 
    71             * loader/DocumentThreadableLoader.cpp:
    72             (WebCore::DocumentThreadableLoader::redirectReceived):
    73             (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
    74             * loader/DocumentThreadableLoader.h:
    75             * page/csp/ContentSecurityPolicy.cpp:
    76             (WebCore::ContentSecurityPolicy::allowConnectToSource const):
    77             (WebCore::ContentSecurityPolicy::reportViolation const):
    78             * page/csp/ContentSecurityPolicy.h:
    79 
    8012021-09-30  Russell Epstein  <repstein@apple.com>
    812

  • branches/safari-611.4.2.0-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r283385 r283414  
    326326    }
    327327
    328     if (!isAllowedByContentSecurityPolicy(request.url(), redirectResponse.isNull() ? ContentSecurityPolicy::RedirectResponseReceived::No : ContentSecurityPolicy::RedirectResponseReceived::Yes, redirectResponse.url())) {
     328    if (!isAllowedByContentSecurityPolicy(request.url(), redirectResponse.isNull() ? ContentSecurityPolicy::RedirectResponseReceived::No : ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
    329329        reportContentSecurityPolicyError(redirectResponse.url());
    330330        clearResource();
    … …  
    669669}
    670670
    671 bool DocumentThreadableLoader::isAllowedByContentSecurityPolicy(const URL& url, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL)
     671bool DocumentThreadableLoader::isAllowedByContentSecurityPolicy(const URL& url, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived)
    672672{
    673673    switch (m_options.contentSecurityPolicyEnforcement) {
    … …  
    677677        return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived);
    678678    case ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective:
    679         return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
     679        return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived);
    680680    case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
    681681        return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived);

  • branches/safari-611.4.2.0-branch/Source/WebCore/loader/DocumentThreadableLoader.h

    r283385 r283414  
    104104        void loadRequest(ResourceRequest&&, SecurityCheckPolicy);
    105105        bool isAllowedRedirect(const URL&);
    106         bool isAllowedByContentSecurityPolicy(const URL&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL());
     106        bool isAllowedByContentSecurityPolicy(const URL&, ContentSecurityPolicy::RedirectResponseReceived);
    107107
    108108        SecurityOrigin& securityOrigin() const;

  • branches/safari-611.4.2.0-branch/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r283385 r283414  
    619619}
    620620
    621 bool ContentSecurityPolicy::allowConnectToSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     621bool ContentSecurityPolicy::allowConnectToSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    622622{
    623623    if (LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy(url.protocol().toStringWithoutCopying()))
    … …  
    627627    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    628628        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, "Refused to connect to");
    629         reportViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, consoleMessage, sourceURL, sourcePosition, preRedirectURL);
     629        reportViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, consoleMessage, sourceURL, sourcePosition);
    630630    };
    631631    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForConnectSource, url, redirectResponseReceived == RedirectResponseReceived::Yes);
    … …  
    678678}
    679679
    680 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state) const
    681 {
    682     return reportViolation(effectiveViolatedDirective, violatedDirective.text(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL);
    683 }
    684 
    685 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL) const
     680void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state) const
     681{
     682    return reportViolation(effectiveViolatedDirective, violatedDirective.text(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state);
     683}
     684
     685void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state) const
    686686{
    687687    logToConsole(consoleMessage, sourceURL, sourcePosition.m_line, sourcePosition.m_column, state);
    … …  
    718718    ASSERT(m_client || is<Document>(m_scriptExecutionContext));
    719719
    720     String blockedURI;
    721     if (preRedirectURL.isNull())
    722         blockedURI = deprecatedURLForReporting(blockedURL);
    723     else
    724         blockedURI = deprecatedURLForReporting(preRedirectURL);
    725 
     720    String blockedURI = deprecatedURLForReporting(blockedURL);
    726721    // FIXME: Is it policy to not use the status code for HTTPS, or is that a bug?
    727722    unsigned short httpStatusCode = m_selfSourceProtocol == "http" ? m_httpStatusCode : 0;

  • branches/safari-611.4.2.0-branch/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r283385 r283414  
    115115    bool allowChildFrameFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    116116    WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    117     WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
     117    WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    118118    bool allowFormAction(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    119119
    … …  
    211211    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, JSC::JSGlobalObject*) const;
    212212    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList&, const URL& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* = nullptr) const;
    213     void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr) const;
    214     void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL()) const;
     213    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* = nullptr) const;
     214    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*) const;
    215215    void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
    216216

  • branches/safari-611.4.2.0-branch/Source/WebKit/ChangeLog

    r283385 r283414  
    1 2021-10-01  Russell Epstein  <repstein@apple.com>
    2 
    3         Cherry-pick r281431. rdar://problem/81175635
    4 
    5     Report correct blocked URI in CSP violation report
    6     https://bugs.webkit.org/show_bug.cgi?id=226316
    7     <rdar://problem/78552912>
    8    
    9     Reviewed by Alex Christensen.
    10    
    11     Source/WebCore:
    12    
    13     Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
    14            http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
    15    
    16     Currently for a blocked redirection we report the blocked URI as the
    17     target URL. This is not up to spec and we should actually report the
    18     requested URL.
    19    
    20     * loader/DocumentThreadableLoader.cpp:
    21     (WebCore::DocumentThreadableLoader::redirectReceived):
    22     (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
    23     * loader/DocumentThreadableLoader.h:
    24     * page/csp/ContentSecurityPolicy.cpp:
    25     (WebCore::ContentSecurityPolicy::allowConnectToSource const):
    26     (WebCore::ContentSecurityPolicy::reportViolation const):
    27     * page/csp/ContentSecurityPolicy.h:
    28    
    29     Source/WebKit:
    30    
    31     Currently for a blocked redirection we report the blocked URI as the
    32     target URL. This is not up to spec and we should actually report the
    33     requested URL.
    34    
    35     * NetworkProcess/NetworkLoadChecker.cpp:
    36     (WebKit::NetworkLoadChecker::check):
    37     (WebKit::NetworkLoadChecker::checkRedirection):
    38     (WebKit::NetworkLoadChecker::checkRequest):
    39     (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
    40     * NetworkProcess/NetworkLoadChecker.h:
    41    
    42     LayoutTests:
    43    
    44     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    45     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
    46     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    47     * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
    48     * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    49     * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    50     * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
    51     * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
    52     WebKitLegacy and Win have different console logging.
    53    
    54     git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    55 
    56     2021-08-22  Kate Cheney  <katherine_cheney@apple.com>
    57 
    58             Report correct blocked URI in CSP violation report
    59             https://bugs.webkit.org/show_bug.cgi?id=226316
    60             <rdar://problem/78552912>
    61 
    62             Reviewed by Alex Christensen.
    63 
    64             Currently for a blocked redirection we report the blocked URI as the
    65             target URL. This is not up to spec and we should actually report the
    66             requested URL.
    67 
    68             * NetworkProcess/NetworkLoadChecker.cpp:
    69             (WebKit::NetworkLoadChecker::check):
    70             (WebKit::NetworkLoadChecker::checkRedirection):
    71             (WebKit::NetworkLoadChecker::checkRequest):
    72             (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
    73             * NetworkProcess/NetworkLoadChecker.h:
    74 
    7512021-08-10  Russell Epstein  <repstein@apple.com>
    762

  • branches/safari-611.4.2.0-branch/Source/WebKit/NetworkProcess/NetworkLoadChecker.h

    r283385 r283414  
    104104    bool isRedirected() const { return m_redirectCount; }
    105105
    106     void checkRequest(WebCore::ResourceRequest&&, WebCore::ContentSecurityPolicyClient*, const URL&, ValidationHandler&&);
     106    void checkRequest(WebCore::ResourceRequest&&, WebCore::ContentSecurityPolicyClient*, ValidationHandler&&);
    107107
    108     bool isAllowedByContentSecurityPolicy(const WebCore::ResourceRequest&, WebCore::ContentSecurityPolicyClient*, const URL& preRedirectURL = URL());
     108    bool isAllowedByContentSecurityPolicy(const WebCore::ResourceRequest&, WebCore::ContentSecurityPolicyClient*);
    109109
    110110    void continueCheckingRequest(WebCore::ResourceRequest&&, ValidationHandler&&);
Note: See TracChangeset for help on using the changeset viewer.