⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 283466 in webkit


Ignore:
Timestamp:
Oct 3, 2021, 10:02:40 AM (5 years ago)
Author:
Alan Coon
Message:

Cherry-pick r281431. rdar://problem/81175635

This reverts r283414.

Location:
branches/safari-611.4.2.0-branch
Files:
8 added
8 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-611.4.2.0-branch/LayoutTests/ChangeLog

    r283414 r283466  
     12021-10-01  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r281431. rdar://problem/81175635
     4
     5    Report correct blocked URI in CSP violation report
     6    https://bugs.webkit.org/show_bug.cgi?id=226316
     7    <rdar://problem/78552912>
     8   
     9    Reviewed by Alex Christensen.
     10   
     11    Source/WebCore:
     12   
     13    Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
     14           http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
     15   
     16    Currently for a blocked redirection we report the blocked URI as the
     17    target URL. This is not up to spec and we should actually report the
     18    requested URL.
     19   
     20    * loader/DocumentThreadableLoader.cpp:
     21    (WebCore::DocumentThreadableLoader::redirectReceived):
     22    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     23    * loader/DocumentThreadableLoader.h:
     24    * page/csp/ContentSecurityPolicy.cpp:
     25    (WebCore::ContentSecurityPolicy::allowConnectToSource const):
     26    (WebCore::ContentSecurityPolicy::reportViolation const):
     27    * page/csp/ContentSecurityPolicy.h:
     28   
     29    Source/WebKit:
     30   
     31    Currently for a blocked redirection we report the blocked URI as the
     32    target URL. This is not up to spec and we should actually report the
     33    requested URL.
     34   
     35    * NetworkProcess/NetworkLoadChecker.cpp:
     36    (WebKit::NetworkLoadChecker::check):
     37    (WebKit::NetworkLoadChecker::checkRedirection):
     38    (WebKit::NetworkLoadChecker::checkRequest):
     39    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     40    * NetworkProcess/NetworkLoadChecker.h:
     41   
     42    LayoutTests:
     43   
     44    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     45    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
     46    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     47    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
     48    * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     49    * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     50    * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     51    * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     52    WebKitLegacy and Win have different console logging.
     53   
     54    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     55
     56    2021-08-22  Kate Cheney  <katherine_cheney@apple.com>
     57
     58            Report correct blocked URI in CSP violation report
     59            https://bugs.webkit.org/show_bug.cgi?id=226316
     60            <rdar://problem/78552912>
     61
     62            Reviewed by Alex Christensen.
     63
     64            * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     65            * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
     66            * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     67            * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
     68            * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     69            * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     70            * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     71            * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     72            WebKitLegacy and Win have different console logging.
     73
    1742021-09-30  Russell Epstein  <repstein@apple.com>
    275

  • branches/safari-611.4.2.0-branch/Source/WebCore/ChangeLog

    r283414 r283466  
     12021-10-01  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r281431. rdar://problem/81175635
     4
     5    Report correct blocked URI in CSP violation report
     6    https://bugs.webkit.org/show_bug.cgi?id=226316
     7    <rdar://problem/78552912>
     8   
     9    Reviewed by Alex Christensen.
     10   
     11    Source/WebCore:
     12   
     13    Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
     14           http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
     15   
     16    Currently for a blocked redirection we report the blocked URI as the
     17    target URL. This is not up to spec and we should actually report the
     18    requested URL.
     19   
     20    * loader/DocumentThreadableLoader.cpp:
     21    (WebCore::DocumentThreadableLoader::redirectReceived):
     22    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     23    * loader/DocumentThreadableLoader.h:
     24    * page/csp/ContentSecurityPolicy.cpp:
     25    (WebCore::ContentSecurityPolicy::allowConnectToSource const):
     26    (WebCore::ContentSecurityPolicy::reportViolation const):
     27    * page/csp/ContentSecurityPolicy.h:
     28   
     29    Source/WebKit:
     30   
     31    Currently for a blocked redirection we report the blocked URI as the
     32    target URL. This is not up to spec and we should actually report the
     33    requested URL.
     34   
     35    * NetworkProcess/NetworkLoadChecker.cpp:
     36    (WebKit::NetworkLoadChecker::check):
     37    (WebKit::NetworkLoadChecker::checkRedirection):
     38    (WebKit::NetworkLoadChecker::checkRequest):
     39    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     40    * NetworkProcess/NetworkLoadChecker.h:
     41   
     42    LayoutTests:
     43   
     44    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     45    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
     46    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     47    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
     48    * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     49    * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     50    * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     51    * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     52    WebKitLegacy and Win have different console logging.
     53   
     54    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     55
     56    2021-08-22  Kate Cheney  <katherine_cheney@apple.com>
     57
     58            Report correct blocked URI in CSP violation report
     59            https://bugs.webkit.org/show_bug.cgi?id=226316
     60            <rdar://problem/78552912>
     61
     62            Reviewed by Alex Christensen.
     63
     64            Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
     65                   http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
     66
     67            Currently for a blocked redirection we report the blocked URI as the
     68            target URL. This is not up to spec and we should actually report the
     69            requested URL.
     70
     71            * loader/DocumentThreadableLoader.cpp:
     72            (WebCore::DocumentThreadableLoader::redirectReceived):
     73            (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     74            * loader/DocumentThreadableLoader.h:
     75            * page/csp/ContentSecurityPolicy.cpp:
     76            (WebCore::ContentSecurityPolicy::allowConnectToSource const):
     77            (WebCore::ContentSecurityPolicy::reportViolation const):
     78            * page/csp/ContentSecurityPolicy.h:
     79
    1802021-09-30  Russell Epstein  <repstein@apple.com>
    281

  • branches/safari-611.4.2.0-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r283414 r283466  
    326326    }
    327327
    328     if (!isAllowedByContentSecurityPolicy(request.url(), redirectResponse.isNull() ? ContentSecurityPolicy::RedirectResponseReceived::No : ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
     328    if (!isAllowedByContentSecurityPolicy(request.url(), redirectResponse.isNull() ? ContentSecurityPolicy::RedirectResponseReceived::No : ContentSecurityPolicy::RedirectResponseReceived::Yes, redirectResponse.url())) {
    329329        reportContentSecurityPolicyError(redirectResponse.url());
    330330        clearResource();
    … …  
    669669}
    670670
    671 bool DocumentThreadableLoader::isAllowedByContentSecurityPolicy(const URL& url, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived)
     671bool DocumentThreadableLoader::isAllowedByContentSecurityPolicy(const URL& url, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL)
    672672{
    673673    switch (m_options.contentSecurityPolicyEnforcement) {
    … …  
    677677        return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived);
    678678    case ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective:
    679         return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived);
     679        return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
    680680    case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
    681681        return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived);

  • branches/safari-611.4.2.0-branch/Source/WebCore/loader/DocumentThreadableLoader.h

    r283414 r283466  
    104104        void loadRequest(ResourceRequest&&, SecurityCheckPolicy);
    105105        bool isAllowedRedirect(const URL&);
    106         bool isAllowedByContentSecurityPolicy(const URL&, ContentSecurityPolicy::RedirectResponseReceived);
     106        bool isAllowedByContentSecurityPolicy(const URL&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL());
    107107
    108108        SecurityOrigin& securityOrigin() const;

  • branches/safari-611.4.2.0-branch/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r283414 r283466  
    619619}
    620620
    621 bool ContentSecurityPolicy::allowConnectToSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
     621bool ContentSecurityPolicy::allowConnectToSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
    622622{
    623623    if (LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy(url.protocol().toStringWithoutCopying()))
    … …  
    627627    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    628628        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, "Refused to connect to");
    629         reportViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, consoleMessage, sourceURL, sourcePosition);
     629        reportViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, consoleMessage, sourceURL, sourcePosition, preRedirectURL);
    630630    };
    631631    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForConnectSource, url, redirectResponseReceived == RedirectResponseReceived::Yes);
    … …  
    678678}
    679679
    680 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state) const
    681 {
    682     return reportViolation(effectiveViolatedDirective, violatedDirective.text(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state);
    683 }
    684 
    685 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state) const
     680void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state) const
     681{
     682    return reportViolation(effectiveViolatedDirective, violatedDirective.text(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL);
     683}
     684
     685void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL) const
    686686{
    687687    logToConsole(consoleMessage, sourceURL, sourcePosition.m_line, sourcePosition.m_column, state);
    … …  
    718718    ASSERT(m_client || is<Document>(m_scriptExecutionContext));
    719719
    720     String blockedURI = deprecatedURLForReporting(blockedURL);
     720    String blockedURI;
     721    if (preRedirectURL.isNull())
     722        blockedURI = deprecatedURLForReporting(blockedURL);
     723    else
     724        blockedURI = deprecatedURLForReporting(preRedirectURL);
     725
    721726    // FIXME: Is it policy to not use the status code for HTTPS, or is that a bug?
    722727    unsigned short httpStatusCode = m_selfSourceProtocol == "http" ? m_httpStatusCode : 0;

  • branches/safari-611.4.2.0-branch/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r283414 r283466  
    115115    bool allowChildFrameFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    116116    WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    117     WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     117    WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    118118    bool allowFormAction(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    119119
    … …  
    211211    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, JSC::JSGlobalObject*) const;
    212212    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList&, const URL& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* = nullptr) const;
    213     void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* = nullptr) const;
    214     void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*) const;
     213    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr) const;
     214    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const URL& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL()) const;
    215215    void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
    216216

  • branches/safari-611.4.2.0-branch/Source/WebKit/ChangeLog

    r283414 r283466  
     12021-10-01  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r281431. rdar://problem/81175635
     4
     5    Report correct blocked URI in CSP violation report
     6    https://bugs.webkit.org/show_bug.cgi?id=226316
     7    <rdar://problem/78552912>
     8   
     9    Reviewed by Alex Christensen.
     10   
     11    Source/WebCore:
     12   
     13    Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html
     14           http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html
     15   
     16    Currently for a blocked redirection we report the blocked URI as the
     17    target URL. This is not up to spec and we should actually report the
     18    requested URL.
     19   
     20    * loader/DocumentThreadableLoader.cpp:
     21    (WebCore::DocumentThreadableLoader::redirectReceived):
     22    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     23    * loader/DocumentThreadableLoader.h:
     24    * page/csp/ContentSecurityPolicy.cpp:
     25    (WebCore::ContentSecurityPolicy::allowConnectToSource const):
     26    (WebCore::ContentSecurityPolicy::reportViolation const):
     27    * page/csp/ContentSecurityPolicy.h:
     28   
     29    Source/WebKit:
     30   
     31    Currently for a blocked redirection we report the blocked URI as the
     32    target URL. This is not up to spec and we should actually report the
     33    requested URL.
     34   
     35    * NetworkProcess/NetworkLoadChecker.cpp:
     36    (WebKit::NetworkLoadChecker::check):
     37    (WebKit::NetworkLoadChecker::checkRedirection):
     38    (WebKit::NetworkLoadChecker::checkRequest):
     39    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     40    * NetworkProcess/NetworkLoadChecker.h:
     41   
     42    LayoutTests:
     43   
     44    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     45    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect.html: Added.
     46    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     47    * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects.html: Added.
     48    * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     49    * platform/mac-wk1/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     50    * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-blocked-redirect-expected.txt: Added.
     51    * platform/win/http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: Added.
     52    WebKitLegacy and Win have different console logging.
     53   
     54    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     55
     56    2021-08-22  Kate Cheney  <katherine_cheney@apple.com>
     57
     58            Report correct blocked URI in CSP violation report
     59            https://bugs.webkit.org/show_bug.cgi?id=226316
     60            <rdar://problem/78552912>
     61
     62            Reviewed by Alex Christensen.
     63
     64            Currently for a blocked redirection we report the blocked URI as the
     65            target URL. This is not up to spec and we should actually report the
     66            requested URL.
     67
     68            * NetworkProcess/NetworkLoadChecker.cpp:
     69            (WebKit::NetworkLoadChecker::check):
     70            (WebKit::NetworkLoadChecker::checkRedirection):
     71            (WebKit::NetworkLoadChecker::checkRequest):
     72            (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     73            * NetworkProcess/NetworkLoadChecker.h:
     74
    1752021-08-10  Russell Epstein  <repstein@apple.com>
    276

  • branches/safari-611.4.2.0-branch/Source/WebKit/NetworkProcess/NetworkLoadChecker.h

    r283414 r283466  
    104104    bool isRedirected() const { return m_redirectCount; }
    105105
    106     void checkRequest(WebCore::ResourceRequest&&, WebCore::ContentSecurityPolicyClient*, ValidationHandler&&);
     106    void checkRequest(WebCore::ResourceRequest&&, WebCore::ContentSecurityPolicyClient*, const URL&, ValidationHandler&&);
    107107
    108     bool isAllowedByContentSecurityPolicy(const WebCore::ResourceRequest&, WebCore::ContentSecurityPolicyClient*);
     108    bool isAllowedByContentSecurityPolicy(const WebCore::ResourceRequest&, WebCore::ContentSecurityPolicyClient*, const URL& preRedirectURL = URL());
    109109
    110110    void continueCheckingRequest(WebCore::ResourceRequest&&, ValidationHandler&&);
Note: See TracChangeset for help on using the changeset viewer.