Changeset 286860 in webkit

Timestamp:

Dec 10, 2021, 11:00:44 AM (5 years ago)

Author:

Patrick Griffis

Message:

LayoutTests/imported/w3c:
CSP: Implement protections against nonce-hijacking
​https://bugs.webkit.org/show_bug.cgi?id=233087

Reviewed by Brent Fulgham.

Update expectations.

• web-platform-tests/content-security-policy/script-src/nonce-enforce-blocked-expected.txt:

Source/WebCore:
CSP: Prevent nonce-hijacking
​https://bugs.webkit.org/show_bug.cgi?id=233087

Reviewed by Brent Fulgham.

Implement protections against nonce-hijacking as described in this spec:

​https://www.w3.org/TR/CSP3/#security-nonce-hijacking

• dom/Element.cpp:

(WebCore::Element::isNonceable const):
(WebCore::Element::nonce const):

• dom/Element.h:

(WebCore::Element::hasDuplicateAttribute const):
(WebCore::Element::setHasDuplicateAttribute):

• html/parser/AtomHTMLToken.h:

(WebCore::AtomHTMLToken::hasDuplicateAttribute const):
(WebCore::AtomHTMLToken::initializeAttributes):

• html/parser/HTMLConstructionSite.cpp:

(WebCore::setAttributes):
(WebCore::HTMLConstructionSite::insertCustomElement):

Location:

trunk

Files:

• LayoutTests/imported/w3c/ChangeLog (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-enforce-blocked-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Element.cpp (modified) (3 diffs)
• Source/WebCore/dom/Element.h (modified) (3 diffs)
• Source/WebCore/html/parser/AtomHTMLToken.h (modified) (4 diffs)
• Source/WebCore/html/parser/HTMLConstructionSite.cpp (modified) (2 diffs)

trunk/LayoutTests/imported/w3c/ChangeLog

@@ +1 @@
+2021-12-10  Patrick Griffis  <pgriffis@igalia.com>
+
+        CSP: Implement protections against nonce-hijacking
+        https://bugs.webkit.org/show_bug.cgi?id=233087
+
+        Reviewed by Brent Fulgham.
+
+        Update expectations.
+
+        * web-platform-tests/content-security-policy/script-src/nonce-enforce-blocked-expected.txt:
+
 2021-12-10  Chris Dumez  <cdumez@apple.com>
 

trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-enforce-blocked-expected.txt

@@ -1 +1 @@
 
-FAIL Unnonced scripts generate reports. assert_unreached: '<script' attribute, no execution. Reached unreachable code
+PASS Unnonced scripts generate reports.
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-10  Patrick Griffis  <pgriffis@igalia.com>
+
+        CSP: Prevent nonce-hijacking
+        https://bugs.webkit.org/show_bug.cgi?id=233087
+
+        Reviewed by Brent Fulgham.
+
+        Implement protections against nonce-hijacking as described in this spec:
+          https://www.w3.org/TR/CSP3/#security-nonce-hijacking
+
+        * dom/Element.cpp:
+        (WebCore::Element::isNonceable const):
+        (WebCore::Element::nonce const):
+        * dom/Element.h:
+        (WebCore::Element::hasDuplicateAttribute const):
+        (WebCore::Element::setHasDuplicateAttribute):
+        * html/parser/AtomHTMLToken.h:
+        (WebCore::AtomHTMLToken::hasDuplicateAttribute const):
+        (WebCore::AtomHTMLToken::initializeAttributes):
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::setAttributes):
+        (WebCore::HTMLConstructionSite::insertCustomElement):
+
 2021-12-09  Darin Adler  <darin@apple.com>
 

trunk/Source/WebCore/dom/Element.cpp

@@ -75 +75 @@
 #include "HTMLOptionElement.h"
 #include "HTMLParserIdioms.h"
+#include "HTMLScriptElement.h"
 #include "HTMLSelectElement.h"
 #include "HTMLTemplateElement.h"
@@ -110 +111 @@
 #include "SVGNames.h"
 #include "SVGSVGElement.h"
+#include "SVGScriptElement.h"
 #include "ScriptDisallowedScope.h"
 #include "ScrollIntoViewOptions.h"
@@ -319 +321 @@
 }
 
+bool Element::isNonceable() const
+{
+    // https://www.w3.org/TR/CSP3/#is-element-nonceable
+    if (elementRareData()->nonce().isNull())
+        return false;
+
+    if (hasDuplicateAttribute())
+        return false;
+
+    if (hasAttributes()
+        && (is<HTMLScriptElement>(*this) || is<SVGScriptElement>(*this))) {
+        static const char scriptString[] = "<script";
+        static const char styleString[] = "<style";
+
+        for (const auto& attribute : attributesIterator()) {
+            auto name = attribute.localName().convertToASCIILowercase();
+            auto value = attribute.value().convertToASCIILowercase();
+            if (name.contains(scriptString)
+                || name.contains(styleString)
+                || value.contains(scriptString)
+                || value.contains(styleString))
+                return false;
+        }
+    }
+
+    return true;
+}
+
 const AtomString& Element::nonce() const
 {
-    return hasRareData() ? elementRareData()->nonce() : emptyAtom();
+    if (hasRareData() && isNonceable())
+        return elementRareData()->nonce();
+
+    return emptyAtom();
 }
 

trunk/Source/WebCore/dom/Element.h

@@ -653 +653 @@
     String debugDescription() const override;
 
+    bool hasDuplicateAttribute() const { return m_hasDuplicateAttribute; };
+    void setHasDuplicateAttribute(bool hasDuplicateAttribute) { m_hasDuplicateAttribute = hasDuplicateAttribute; };
+
 protected:
     Element(const QualifiedName&, Document&, ConstructionType);
@@ -688 +691 @@
     bool isUserActionElementHasFocusVisible() const;
     bool isUserActionElementHasFocusWithin() const;
+
+    bool isNonceable() const;
 
     virtual void didAddUserAgentShadowRoot(ShadowRoot&) { }
@@ -766 +771 @@
     QualifiedName m_tagName;
     RefPtr<ElementData> m_elementData;
+
+    bool m_hasDuplicateAttribute { false };
 };
 

trunk/Source/WebCore/html/parser/AtomHTMLToken.h

@@ -32 +32 @@
 namespace WebCore {
 
+enum class HasDuplicateAttribute : bool { No, Yes };
+
 class AtomHTMLToken {
 public:
@@ -70 +72 @@
 
     const String& comment() const;
+
+    HasDuplicateAttribute hasDuplicateAttribute() const { return m_hasDuplicateAttribute; };
 
 private:
@@ -91 +95 @@
     bool m_selfClosing; // StartTag, EndTag.
     Vector<Attribute> m_attributes; // StartTag, EndTag.
+
+    HasDuplicateAttribute m_hasDuplicateAttribute { HasDuplicateAttribute::No };
 };
 
@@ -209 +215 @@
         if (!hasAttribute(m_attributes, localName))
             m_attributes.uncheckedAppend(Attribute(QualifiedName(nullAtom(), localName, nullAtom()), HTMLAtomStringCache::makeAttributeValue(attribute.value)));
+        else
+            m_hasDuplicateAttribute = HasDuplicateAttribute::Yes;
     }
 }

trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp

@@ -56 +56 @@
 using namespace HTMLNames;
 
-static inline void setAttributes(Element& element, Vector<Attribute>& attributes, ParserContentPolicy parserContentPolicy)
+static inline void setAttributes(Element& element, Vector<Attribute>& attributes, HasDuplicateAttribute hasDuplicateAttribute, ParserContentPolicy parserContentPolicy)
 {
     if (!scriptingContentIsAllowed(parserContentPolicy))
         element.stripScriptingAttributes(attributes);
     element.parserSetAttributes(attributes);
+    element.setHasDuplicateAttribute(hasDuplicateAttribute == HasDuplicateAttribute::Yes);
 }
 
 static inline void setAttributes(Element& element, AtomHTMLToken& token, ParserContentPolicy parserContentPolicy)
 {
-    setAttributes(element, token.attributes(), parserContentPolicy);
+    setAttributes(element, token.attributes(), token.hasDuplicateAttribute(), parserContentPolicy);
 }
 
@@ -517 +518 @@
 void HTMLConstructionSite::insertCustomElement(Ref<Element>&& element, const AtomString& localName, Vector<Attribute>&& attributes)
 {
-    setAttributes(element, attributes, m_parserContentPolicy);
+    setAttributes(element, attributes, HasDuplicateAttribute::No, m_parserContentPolicy);
     attachLater(currentNode(), element.copyRef());
     m_openElements.push(HTMLStackItem::create(WTFMove(element), localName, WTFMove(attributes)));