Changeset 286940 in webkit

Timestamp:

Dec 13, 2021, 1:18:27 AM (5 years ago)

Author:

youenn@apple.com

Message:

Implement step 17 of main fetch algorithm
​https://bugs.webkit.org/show_bug.cgi?id=234140

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

• web-platform-tests/service-workers/service-worker/fetch-csp.https.html:
• web-platform-tests/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers:

Source/WebCore:

The step was implemented for non DocumentThreadableLoader resources, we need to also do the same step within DocumentThreadableLoader.

Covered by existing updated tests.

• loader/DocumentThreadableLoader.cpp:
• loader/DocumentThreadableLoader.h:

Location:

trunk

Files:

• LayoutTests/imported/w3c/ChangeLog (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-csp.https.html (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/DocumentThreadableLoader.cpp (modified) (2 diffs)
• Source/WebCore/loader/DocumentThreadableLoader.h (modified) (1 diff)

trunk/LayoutTests/imported/w3c/ChangeLog

@@ +1 @@
+2021-12-13  Youenn Fablet  <youenn@apple.com>
+
+        Implement step 17 of main fetch algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=234140
+
+        Reviewed by Brent Fulgham.
+
+        * web-platform-tests/service-workers/service-worker/fetch-csp.https.html:
+        * web-platform-tests/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers:
+
 2021-12-11  Antoine Quint  <graouts@webkit.org>
 

trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-csp.https.html

@@ -109 +109 @@
         })
       .then(function() {
+          return assert_resolves(
+              frame.contentWindow.fetch(IMAGE_URL + "&fetch1", { mode: 'no-cors'}),
+              'Allowed scope fetch resource should be loaded.');
+        })
+      .then(function() {
+          return assert_resolves(
+              frame.contentWindow.fetch(
+                  // The request for IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(IMAGE_URL + '&fetch2'), { mode: 'no-cors'}),
+              'Allowed scope fetch resource which was fetched via SW should be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.fetch(REMOTE_IMAGE_URL + "&fetch3", { mode: 'no-cors'}),
+              'Disallowed scope fetch resource should not be loaded.');
+        })
+      .then(function() {
+          return assert_rejects(
+              frame.contentWindow.fetch(
+                  // The request for REMOTE_IMAGE_URL will be fetched in SW.
+                  './sample?url=' + encodeURIComponent(REMOTE_IMAGE_URL + '&fetch4'), { mode: 'no-cors'}),
+              'Disallowed scope fetch resource which was fetched via SW should not be loaded.');
+        })
+      .then(function() {
           frame.remove();
         });

trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-csp-iframe.html.sub.headers

@@ -1 @@
-Content-Security-Policy: img-src https://{{host}}:{{ports[https][0]}}
+Content-Security-Policy: img-src https://{{host}}:{{ports[https][0]}}; connect-src 'unsafe-inline' 'self'

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-13  Youenn Fablet  <youenn@apple.com>
+
+        Implement step 17 of main fetch algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=234140
+
+        Reviewed by Brent Fulgham.
+
+        The step was implemented for non DocumentThreadableLoader resources, we need to also do the same step within DocumentThreadableLoader.
+
+        Covered by existing updated tests.
+
+        * loader/DocumentThreadableLoader.cpp:
+        * loader/DocumentThreadableLoader.h:
+
 2021-12-13  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

@@ -405 +405 @@
     ASSERT(response.type() != ResourceResponse::Type::Error);
 
+#if ENABLE(SERVICE_WORKER)
+    // https://fetch.spec.whatwg.org/commit-snapshots/6257e220d70f560a037e46f1b4206325400db8dc/#main-fetch step 17.
+    if (response.source() == ResourceResponse::Source::ServiceWorker && response.url() != m_resource->url()) {
+        if (!isResponseAllowedByContentSecurityPolicy(response)) {
+            reportContentSecurityPolicyError(response.url());
+            return;
+        }
+    }
+#endif
+
     InspectorInstrumentation::didReceiveThreadableLoaderResponse(*this, identifier);
 
@@ -692 +702 @@
 }
 
+bool DocumentThreadableLoader::isResponseAllowedByContentSecurityPolicy(const ResourceResponse& response)
+{
+    return isAllowedByContentSecurityPolicy(response.url(), ContentSecurityPolicy::RedirectResponseReceived::Yes, { });
+}
+
 bool DocumentThreadableLoader::isAllowedRedirect(const URL& url)
 {

trunk/Source/WebCore/loader/DocumentThreadableLoader.h

@@ -106 +106 @@
         bool isAllowedRedirect(const URL&);
         bool isAllowedByContentSecurityPolicy(const URL&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL());
+        bool isResponseAllowedByContentSecurityPolicy(const ResourceResponse&);
 
         SecurityOrigin& securityOrigin() const;