⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 287791 in webkit


Ignore:
Timestamp:
Jan 7, 2022, 3:22:30 PM (5 years ago)
Author:
Russell Epstein
Message:

Cherry-pick r286094. rdar://problem/87125111

Report the initiating url instead of the redirected one
​https://bugs.webkit.org/show_bug.cgi?id=233037

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-11-20
Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

  • web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:

Source/WebCore:

As per the spec, blockedURI should use the requested URL of original request instead of redirected location.

  • loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
  • loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::willSendRequestInternal):
  • loader/cache/CachedResourceLoader.cpp: (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const): (WebCore::CachedResourceLoader::canRequestAfterRedirection const): (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
  • loader/cache/CachedResourceLoader.h:
  • page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::allowChildContextFromSource const): (WebCore::ContentSecurityPolicy::allowScriptFromSource const): (WebCore::ContentSecurityPolicy::allowImageFromSource const): (WebCore::ContentSecurityPolicy::allowStyleFromSource const): (WebCore::ContentSecurityPolicy::allowFontFromSource const): (WebCore::ContentSecurityPolicy::allowManifestFromSource const): (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
  • page/csp/ContentSecurityPolicy.h:

Source/WebKit:

Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().

  • NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):

LayoutTests:

  • TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
  • http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-612.4.9.1-branch
Files:
26 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-612.4.9.1-branch/LayoutTests/ChangeLog

    r287746 r287791  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     72            * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     73            * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     74            * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     75            * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     76            * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     77            * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     78            * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     79            * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     80            * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     81            * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     82            * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     83            * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     84            * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     85
    1862022-01-07  Russell Epstein  <repstein@apple.com>
    287

  • branches/safari-612.4.9.1-branch/LayoutTests/TestExpectations

    r285446 r287791  
    505505imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [ Skip ]
    506506imported/w3c/web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub.html [ Skip ]
    507 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub.html [ Skip ]
    508507imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html [ Skip ]
    509508imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme.html [ Skip ]

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt

    r274244 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33CONSOLE MESSAGE: Cannot load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js due to access control checks.

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt

    r198643 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
    22Tests that a cross-origin CSS font loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
    22Tests that a cross-origin image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
    22Tests that a SVG font-face element is blocked from loading a cross-origin external SVG font via a redirect by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
    22Tests that a cross-origin SVG image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt

    r198643 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r281012 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33This tests that the Content Security Policy of the parent origin (this page) blocks a Web Worker from importing a script from a different origin, not listed in script-src, through a redirect.

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r281012 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33This tests a Web Worker with Content Security Policy "script-src 'self'" blocks the import of a script from a different origin through a redirect.

  • branches/safari-612.4.9.1-branch/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt

    r198591 r287791  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
    22

  • branches/safari-612.4.9.1-branch/LayoutTests/imported/w3c/ChangeLog

    r287627 r287791  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     72
    1732022-01-05  Russell Epstein  <repstein@apple.com>
    274

  • branches/safari-612.4.9.1-branch/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt

    r279838 r287791  
    33Harness Error (TIMEOUT), message = null
    44
    5 TIMEOUT The blocked URI in the security policy violation event should be the original URI before redirects. Test timed out
     5PASS The blocked URI in the security policy violation event should be the original URI before redirects.
    66

  • branches/safari-612.4.9.1-branch/Source/WebCore/ChangeLog

    r287746 r287791  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     72
     73            * loader/DocumentThreadableLoader.cpp:
     74            (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     75            * loader/SubresourceLoader.cpp:
     76            (WebCore::SubresourceLoader::willSendRequestInternal):
     77            * loader/cache/CachedResourceLoader.cpp:
     78            (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     79            (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     80            (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     81            * loader/cache/CachedResourceLoader.h:
     82            * page/csp/ContentSecurityPolicy.cpp:
     83            (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     84            (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     85            (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     86            (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     87            (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     88            (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     89            (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     90            * page/csp/ContentSecurityPolicy.h:
     91
    1922022-01-07  Russell Epstein  <repstein@apple.com>
    293

  • branches/safari-612.4.9.1-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r287627 r287791  
    692692        return true;
    693693    case ContentSecurityPolicyEnforcement::EnforceChildSrcDirective:
    694         return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived);
     694        return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived, preRedirectURL);
    695695    case ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective:
    696696        return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
    697697    case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
    698         return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived);
     698        return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived, preRedirectURL);
    699699    }
    700700    ASSERT_NOT_REACHED();

  • branches/safari-612.4.9.1-branch/Source/WebCore/loader/SubresourceLoader.cpp

    r281125 r287791  
    278278        }
    279279
    280         if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options())) {
     280        if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options(), redirectResponse.url())) {
    281281            SUBRESOURCELOADER_RELEASE_LOG("willSendRequestInternal: resource load canceled because CachedResourceLoader::updateRequestAfterRedirection (really CachedResourceLoader::canRequestAfterRedirection) said no");
    282282            cancel();

  • branches/safari-612.4.9.1-branch/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r286244 r287791  
    488488}
    489489
    490 bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived) const
     490bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
    491491{
    492492    if (options.contentSecurityPolicyImposition == ContentSecurityPolicyImposition::SkipPolicyCheck)
    … …  
    501501#endif
    502502    case CachedResource::Type::Script:
    503         if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived))
     503        if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived, preRedirectURL))
    504504            return false;
    505505        break;
    506506    case CachedResource::Type::CSSStyleSheet:
    507         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived))
     507        if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived, preRedirectURL))
    508508            return false;
    509509        break;
    … …  
    511511    case CachedResource::Type::Icon:
    512512    case CachedResource::Type::ImageResource:
    513         if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived))
     513        if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived, preRedirectURL))
    514514            return false;
    515515        break;
    516516    case CachedResource::Type::SVGFontResource:
    517517    case CachedResource::Type::FontResource:
    518         if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived))
     518        if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived, preRedirectURL))
    519519            return false;
    520520        break;
    … …  
    523523    case CachedResource::Type::TextTrackResource:
    524524#endif
    525         if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived))
     525        if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived, preRedirectURL))
    526526            return false;
    527527        break;
    … …  
    535535#if ENABLE(APPLICATION_MANIFEST)
    536536    case CachedResource::Type::ApplicationManifest:
    537         if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived))
     537        if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived, preRedirectURL))
    538538            return false;
    539539        break;
    … …  
    593593
    594594// FIXME: Should we find a way to know whether the redirection is for a preload request like we do for CachedResourceLoader::canRequest?
    595 bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options) const
     595bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, const URL& preRedirectURL) const
    596596{
    597597    if (document() && !document()->securityOrigin().canDisplay(url)) {
    … …  
    611611    }
    612612
    613     if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
     613    if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes, preRedirectURL)) {
    614614        CACHEDRESOURCELOADER_RELEASE_LOG("canRequestAfterRedirection: URL was not allowed by content policy");
    615615        return false;
    … …  
    626626}
    627627
    628 bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options)
     628bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options, const URL& preRedirectURL)
    629629{
    630630    ASSERT(m_documentLoader);
    … …  
    634634    // FIXME: We might want to align the checks done here with the ones done in CachedResourceLoader::requestResource, content extensions blocking in particular.
    635635
    636     return canRequestAfterRedirection(type, request.url(), options);
     636    return canRequestAfterRedirection(type, request.url(), options, preRedirectURL);
    637637}
    638638

  • branches/safari-612.4.9.1-branch/Source/WebCore/loader/cache/CachedResourceLoader.h

    r278849 r287791  
    156156    void stopUnusedPreloadsTimer();
    157157
    158     bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&);
    159     bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived) const;
     158    bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&, const URL& preRedirectURL);
     159    bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL()) const;
    160160
    161161    static const ResourceLoaderOptions& defaultCachedResourceOptions();
    … …  
    197197    void reloadImagesIfNotDeferred();
    198198
    199     bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&) const;
     199    bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&, const URL& preRedirectURL) const;
    200200    bool canRequestInContentDispositionAttachmentSandbox(CachedResource::Type, const URL&) const;
    201201

  • branches/safari-612.4.9.1-branch/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r286463 r287791  
    576576}
    577577
    578 bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    579 {
    580     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext);
    581 }
    582 
    583 bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    584 {
    585     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript);
    586 }
    587 
    588 bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    589 {
    590     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage);
    591 }
    592 
    593 bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    594 {
    595     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle);
    596 }
    597 
    598 bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    599 {
    600     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont);
     578bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     579{
     580    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext, preRedirectURL);
     581}
     582
     583bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     584{
     585    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript, preRedirectURL);
     586}
     587
     588bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     589{
     590    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage, preRedirectURL);
     591}
     592
     593bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     594{
     595    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle, preRedirectURL);
     596}
     597
     598bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     599{
     600    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont, preRedirectURL);
    601601}
    602602
    603603#if ENABLE(APPLICATION_MANIFEST)
    604 bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    605 {
    606     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest);
     604bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     605{
     606    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest, preRedirectURL);
    607607}
    608608#endif // ENABLE(APPLICATION_MANIFEST)
    609609
    610 bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    611 {
    612     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia);
     610bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     611{
     612    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia, preRedirectURL);
    613613}
    614614

  • branches/safari-612.4.9.1-branch/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r286401 r287791  
    105105
    106106    enum class RedirectResponseReceived { No, Yes };
    107     WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    108     bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    109     bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    110     bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     107    WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     108    bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     109    bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     110    bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    111111#if ENABLE(APPLICATION_MANIFEST)
    112     bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     112    bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    113113#endif
    114     bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     114    bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    115115
    116116    bool allowChildFrameFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    117     WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     117    WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    118118    WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    119119    bool allowFormAction(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;

  • branches/safari-612.4.9.1-branch/Source/WebKit/ChangeLog

    r287734 r287791  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     72
     73            * NetworkProcess/NetworkLoadChecker.cpp:
     74            (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     75
    1762022-01-06  Russell Epstein  <repstein@apple.com>
    277

  • branches/safari-612.4.9.1-branch/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp

    r283922 r287791  
    291291    case FetchOptions::Destination::Serviceworker:
    292292    case FetchOptions::Destination::Sharedworker:
    293         return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived);
     293        return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived, preRedirectURL);
    294294    case FetchOptions::Destination::Script:
    295         if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived))
     295        if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived, preRedirectURL))
    296296            return false;
    297297        // FIXME: Check CSP for non-importScripts() initiated loads.
Note: See TracChangeset for help on using the changeset viewer.