⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 286094 in webkit


Ignore:
Timestamp:
Nov 20, 2021, 12:15:52 AM (5 years ago)
Author:
commit-queue@webkit.org
Message:

Report the initiating url instead of the redirected one
​https://bugs.webkit.org/show_bug.cgi?id=233037

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-11-20
Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

  • web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:

Source/WebCore:

As per the spec, blockedURI should use the requested URL of original request instead of redirected location.

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):

  • loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal):

  • loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
(WebCore::CachedResourceLoader::canRequestAfterRedirection const):
(WebCore::CachedResourceLoader::updateRequestAfterRedirection):

  • loader/cache/CachedResourceLoader.h:
  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
(WebCore::ContentSecurityPolicy::allowScriptFromSource const):
(WebCore::ContentSecurityPolicy::allowImageFromSource const):
(WebCore::ContentSecurityPolicy::allowStyleFromSource const):
(WebCore::ContentSecurityPolicy::allowFontFromSource const):
(WebCore::ContentSecurityPolicy::allowManifestFromSource const):
(WebCore::ContentSecurityPolicy::allowMediaFromSource const):

  • page/csp/ContentSecurityPolicy.h:

Source/WebKit:

Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().

  • NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):

LayoutTests:

  • TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
  • http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
Location:
trunk
Files:
26 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r286089 r286094  
     12021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Report the initiating url instead of the redirected one
     4        https://bugs.webkit.org/show_bug.cgi?id=233037
     5
     6        Reviewed by Brent Fulgham.
     7
     8        * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     9        * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     10        * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     11        * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     12        * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     13        * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     14        * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     15        * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     16        * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     17        * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     18        * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     19        * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     20        * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     21        * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     22
    1232021-11-19  Arcady Goldmints-Orlov  <agoldmints@igalia.com>
    224

  • trunk/LayoutTests/TestExpectations

    r286085 r286094  
    526526imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [ Skip ]
    527527imported/w3c/web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub.html [ Skip ]
    528 imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html [ Skip ]
    529528imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme.html [ Skip ]
    530529imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme.html [ Skip ]

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt

    r274244 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33CONSOLE MESSAGE: Cannot load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js due to access control checks.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt

    r198643 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
    22Tests that a cross-origin CSS font loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
    22Tests that a cross-origin image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
    22Tests that a SVG font-face element is blocked from loading a cross-origin external SVG font via a redirect by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
    22Tests that a cross-origin SVG image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt

    r198643 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r281012 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33This tests that the Content Security Policy of the parent origin (this page) blocks a Web Worker from importing a script from a different origin, not listed in script-src, through a redirect.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r281012 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33This tests a Web Worker with Content Security Policy "script-src 'self'" blocks the import of a script from a different origin through a redirect.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt

    r198591 r286094  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
    22

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r286089 r286094  
     12021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Report the initiating url instead of the redirected one
     4        https://bugs.webkit.org/show_bug.cgi?id=233037
     5
     6        Reviewed by Brent Fulgham.
     7
     8        * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     9
    1102021-11-19  Arcady Goldmints-Orlov  <agoldmints@igalia.com>
    211

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt

    r283111 r286094  
    1  
    21
    3 FAIL The blocked URI in the security policy violation event should be the original URI before redirects. assert_equals: expected "http://localhost:8800/common/redirect.py?location=http%3A%2F%2F127.0.0.1%3A8800%2Fcontent-security-policy%2Fsupport%2Ffail.png" but got "http://127.0.0.1:8800"
    42
     3PASS The blocked URI in the security policy violation event should be the original URI before redirects.
     4

  • trunk/Source/WebCore/ChangeLog

    r286093 r286094  
     12021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Report the initiating url instead of the redirected one
     4        https://bugs.webkit.org/show_bug.cgi?id=233037
     5
     6        Reviewed by Brent Fulgham.
     7
     8        As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     9
     10        * loader/DocumentThreadableLoader.cpp:
     11        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     12        * loader/SubresourceLoader.cpp:
     13        (WebCore::SubresourceLoader::willSendRequestInternal):
     14        * loader/cache/CachedResourceLoader.cpp:
     15        (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     16        (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     17        (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     18        * loader/cache/CachedResourceLoader.h:
     19        * page/csp/ContentSecurityPolicy.cpp:
     20        (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     21        (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     22        (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     23        (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     24        (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     25        (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     26        (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     27        * page/csp/ContentSecurityPolicy.h:
     28
    1292021-11-19  Carlos Garcia Campos  <cgarcia@igalia.com>
    230

  • trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r284009 r286094  
    682682        return true;
    683683    case ContentSecurityPolicyEnforcement::EnforceChildSrcDirective:
    684         return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived);
     684        return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived, preRedirectURL);
    685685    case ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective:
    686686        return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
    687687    case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
    688         return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived);
     688        return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived, preRedirectURL);
    689689    }
    690690    ASSERT_NOT_REACHED();

  • trunk/Source/WebCore/loader/SubresourceLoader.cpp

    r282853 r286094  
    278278        }
    279279
    280         if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options())) {
     280        if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options(), redirectResponse.url())) {
    281281            SUBRESOURCELOADER_RELEASE_LOG("willSendRequestInternal: resource load canceled because CachedResourceLoader::updateRequestAfterRedirection (really CachedResourceLoader::canRequestAfterRedirection) said no");
    282282            cancel();

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r285823 r286094  
    489489}
    490490
    491 bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived) const
     491bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
    492492{
    493493    if (options.contentSecurityPolicyImposition == ContentSecurityPolicyImposition::SkipPolicyCheck)
    … …  
    502502#endif
    503503    case CachedResource::Type::Script:
    504         if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived))
     504        if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived, preRedirectURL))
    505505            return false;
    506506        break;
    507507    case CachedResource::Type::CSSStyleSheet:
    508         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived))
     508        if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived, preRedirectURL))
    509509            return false;
    510510        break;
    … …  
    512512    case CachedResource::Type::Icon:
    513513    case CachedResource::Type::ImageResource:
    514         if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived))
     514        if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived, preRedirectURL))
    515515            return false;
    516516        break;
    517517    case CachedResource::Type::SVGFontResource:
    518518    case CachedResource::Type::FontResource:
    519         if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived))
     519        if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived, preRedirectURL))
    520520            return false;
    521521        break;
    … …  
    524524    case CachedResource::Type::TextTrackResource:
    525525#endif
    526         if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived))
     526        if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived, preRedirectURL))
    527527            return false;
    528528        break;
    … …  
    536536#if ENABLE(APPLICATION_MANIFEST)
    537537    case CachedResource::Type::ApplicationManifest:
    538         if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived))
     538        if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived, preRedirectURL))
    539539            return false;
    540540        break;
    … …  
    594594
    595595// FIXME: Should we find a way to know whether the redirection is for a preload request like we do for CachedResourceLoader::canRequest?
    596 bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options) const
     596bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, const URL& preRedirectURL) const
    597597{
    598598    if (document() && !document()->securityOrigin().canDisplay(url)) {
    … …  
    612612    }
    613613
    614     if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
     614    if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes, preRedirectURL)) {
    615615        CACHEDRESOURCELOADER_RELEASE_LOG("canRequestAfterRedirection: URL was not allowed by content policy");
    616616        return false;
    … …  
    627627}
    628628
    629 bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options)
     629bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options, const URL& preRedirectURL)
    630630{
    631631    ASSERT(m_documentLoader);
    … …  
    635635    // FIXME: We might want to align the checks done here with the ones done in CachedResourceLoader::requestResource, content extensions blocking in particular.
    636636
    637     return canRequestAfterRedirection(type, request.url(), options);
     637    return canRequestAfterRedirection(type, request.url(), options, preRedirectURL);
    638638}
    639639

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.h

    r284093 r286094  
    157157    void stopUnusedPreloadsTimer();
    158158
    159     bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&);
    160     bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived) const;
     159    bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&, const URL& preRedirectURL);
     160    bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL()) const;
    161161
    162162    static const ResourceLoaderOptions& defaultCachedResourceOptions();
    … …  
    198198    void reloadImagesIfNotDeferred();
    199199
    200     bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&) const;
     200    bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&, const URL& preRedirectURL) const;
    201201    bool canRequestInContentDispositionAttachmentSandbox(CachedResource::Type, const URL&) const;
    202202

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r285800 r286094  
    636636}
    637637
    638 bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    639 {
    640     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext);
    641 }
    642 
    643 bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
     638bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     639{
     640    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext, preRedirectURL);
     641}
     642
     643bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
    644644{
    645645    if (shouldPerformEarlyCSPCheck())
    646646        return true;
    647647
    648     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript);
    649 }
    650 
    651 bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    652 {
    653     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage);
    654 }
    655 
    656 bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    657 {
    658     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle);
    659 }
    660 
    661 bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    662 {
    663     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont);
     648    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript, preRedirectURL);
     649}
     650
     651bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     652{
     653    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage, preRedirectURL);
     654}
     655
     656bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     657{
     658    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle, preRedirectURL);
     659}
     660
     661bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     662{
     663    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont, preRedirectURL);
    664664}
    665665
    666666#if ENABLE(APPLICATION_MANIFEST)
    667 bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    668 {
    669     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest);
     667bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     668{
     669    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest, preRedirectURL);
    670670}
    671671#endif // ENABLE(APPLICATION_MANIFEST)
    672672
    673 bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    674 {
    675     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia);
     673bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     674{
     675    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia, preRedirectURL);
    676676}
    677677

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r285478 r286094  
    110110
    111111    enum class RedirectResponseReceived { No, Yes };
    112     WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    113     bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    114     bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    115     bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     112    WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     113    bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     114    bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     115    bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    116116#if ENABLE(APPLICATION_MANIFEST)
    117     bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     117    bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    118118#endif
    119     bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     119    bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    120120
    121121    bool allowChildFrameFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    122     WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     122    WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    123123    WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    124124    bool allowFormAction(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;

  • trunk/Source/WebKit/ChangeLog

    r286087 r286094  
     12021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Report the initiating url instead of the redirected one
     4        https://bugs.webkit.org/show_bug.cgi?id=233037
     5
     6        Reviewed by Brent Fulgham.
     7
     8        Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     9
     10        * NetworkProcess/NetworkLoadChecker.cpp:
     11        (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     12
    1132021-11-19  Myles C. Maxfield  <mmaxfield@apple.com>
    214

  • trunk/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp

    r284142 r286094  
    291291    case FetchOptions::Destination::Serviceworker:
    292292    case FetchOptions::Destination::Sharedworker:
    293         return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived);
     293        return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived, preRedirectURL);
    294294    case FetchOptions::Destination::Script:
    295         if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived))
     295        if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived, preRedirectURL))
    296296            return false;
    297297        // FIXME: Check CSP for non-importScripts() initiated loads.
Note: See TracChangeset for help on using the changeset viewer.