⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 287792 in webkit


Ignore:
Timestamp:
Jan 7, 2022, 3:45:52 PM (5 years ago)
Author:
Russell Epstein
Message:

Cherry-pick r286094. rdar://problem/87125111

Report the initiating url instead of the redirected one
​https://bugs.webkit.org/show_bug.cgi?id=233037

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-11-20
Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

  • web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:

Source/WebCore:

As per the spec, blockedURI should use the requested URL of original request instead of redirected location.

  • loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
  • loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::willSendRequestInternal):
  • loader/cache/CachedResourceLoader.cpp: (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const): (WebCore::CachedResourceLoader::canRequestAfterRedirection const): (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
  • loader/cache/CachedResourceLoader.h:
  • page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::allowChildContextFromSource const): (WebCore::ContentSecurityPolicy::allowScriptFromSource const): (WebCore::ContentSecurityPolicy::allowImageFromSource const): (WebCore::ContentSecurityPolicy::allowStyleFromSource const): (WebCore::ContentSecurityPolicy::allowFontFromSource const): (WebCore::ContentSecurityPolicy::allowManifestFromSource const): (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
  • page/csp/ContentSecurityPolicy.h:

Source/WebKit:

Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().

  • NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):

LayoutTests:

  • TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
  • http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-612.4.9.0-branch
Files:
26 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-612.4.9.0-branch/LayoutTests/ChangeLog

    r287748 r287792  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     72            * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     73            * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     74            * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     75            * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     76            * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     77            * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     78            * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     79            * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     80            * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     81            * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     82            * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     83            * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     84            * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     85
    1862022-01-07  Russell Epstein  <repstein@apple.com>
    287

  • branches/safari-612.4.9.0-branch/LayoutTests/TestExpectations

    r285446 r287792  
    505505imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [ Skip ]
    506506imported/w3c/web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub.html [ Skip ]
    507 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub.html [ Skip ]
    508507imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html [ Skip ]
    509508imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme.html [ Skip ]

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt

    r274244 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the child-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33CONSOLE MESSAGE: Cannot load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js due to access control checks.

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt

    r198643 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/balls-of-the-orient.aif because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/Ahem.woff because it does not appear in the font-src directive of the Content Security Policy.
    22Tests that a cross-origin CSS font loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/resources/abe.png because it does not appear in the img-src directive of the Content Security Policy.
    22Tests that a cross-origin image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/alert-fail.js because it does not appear in the script-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/blue.css because it does not appear in the style-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/ABCFont.svg because it does not appear in the font-src directive of the Content Security Policy.
    22Tests that a SVG font-face element is blocked from loading a cross-origin external SVG font via a redirect by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/red-square.svg because it does not appear in the img-src directive of the Content Security Policy.
    22Tests that a cross-origin SVG image loaded via a redirect is blocked by the Content Security Policy. This test PASSED if there is a console warning message.
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt

    r198643 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/resources/test.mp4 because it does not appear in the media-src directive of the Content Security Policy.
    22ALERT: PASS
    33

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r281012 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33This tests that the Content Security Policy of the parent origin (this page) blocks a Web Worker from importing a script from a different origin, not listed in script-src, through a redirect.

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r281012 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.py?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js because it does not appear in the script-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Blocked by Content Security Policy.
    33This tests a Web Worker with Content Security Policy "script-src 'self'" blocks the import of a script from a different origin through a redirect.

  • branches/safari-612.4.9.0-branch/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt

    r198591 r287792  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to load http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/alert-fail.xsl because it does not appear in the script-src directive of the Content Security Policy.
    22

  • branches/safari-612.4.9.0-branch/LayoutTests/imported/w3c/ChangeLog

    r287627 r287792  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     72
    1732022-01-05  Russell Epstein  <repstein@apple.com>
    274

  • branches/safari-612.4.9.0-branch/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt

    r279838 r287792  
    22
    33Harness Error (TIMEOUT), message = null
     4PASS The blocked URI in the security policy violation event should be the original URI before redirects.
    45
    5 TIMEOUT The blocked URI in the security policy violation event should be the original URI before redirects. Test timed out
    6 

  • branches/safari-612.4.9.0-branch/Source/WebCore/ChangeLog

    r287748 r287792  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     72
     73            * loader/DocumentThreadableLoader.cpp:
     74            (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     75            * loader/SubresourceLoader.cpp:
     76            (WebCore::SubresourceLoader::willSendRequestInternal):
     77            * loader/cache/CachedResourceLoader.cpp:
     78            (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     79            (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     80            (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     81            * loader/cache/CachedResourceLoader.h:
     82            * page/csp/ContentSecurityPolicy.cpp:
     83            (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     84            (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     85            (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     86            (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     87            (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     88            (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     89            (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     90            * page/csp/ContentSecurityPolicy.h:
     91
    1922022-01-07  Russell Epstein  <repstein@apple.com>
    293

  • branches/safari-612.4.9.0-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r287627 r287792  
    692692        return true;
    693693    case ContentSecurityPolicyEnforcement::EnforceChildSrcDirective:
    694         return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived);
     694        return contentSecurityPolicy().allowChildContextFromSource(url, redirectResponseReceived, preRedirectURL);
    695695    case ContentSecurityPolicyEnforcement::EnforceConnectSrcDirective:
    696696        return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
    697697    case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
    698         return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived);
     698        return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived, preRedirectURL);
    699699    }
    700700    ASSERT_NOT_REACHED();

  • branches/safari-612.4.9.0-branch/Source/WebCore/loader/SubresourceLoader.cpp

    r281125 r287792  
    278278        }
    279279
    280         if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options())) {
     280        if (!m_documentLoader->cachedResourceLoader().updateRequestAfterRedirection(m_resource->type(), newRequest, options(), redirectResponse.url())) {
    281281            SUBRESOURCELOADER_RELEASE_LOG("willSendRequestInternal: resource load canceled because CachedResourceLoader::updateRequestAfterRedirection (really CachedResourceLoader::canRequestAfterRedirection) said no");
    282282            cancel();

  • branches/safari-612.4.9.0-branch/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r286244 r287792  
    488488}
    489489
    490 bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived) const
     490bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
    491491{
    492492    if (options.contentSecurityPolicyImposition == ContentSecurityPolicyImposition::SkipPolicyCheck)
    … …  
    501501#endif
    502502    case CachedResource::Type::Script:
    503         if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived))
     503        if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived, preRedirectURL))
    504504            return false;
    505505        break;
    506506    case CachedResource::Type::CSSStyleSheet:
    507         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived))
     507        if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived, preRedirectURL))
    508508            return false;
    509509        break;
    … …  
    511511    case CachedResource::Type::Icon:
    512512    case CachedResource::Type::ImageResource:
    513         if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived))
     513        if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived, preRedirectURL))
    514514            return false;
    515515        break;
    516516    case CachedResource::Type::SVGFontResource:
    517517    case CachedResource::Type::FontResource:
    518         if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived))
     518        if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived, preRedirectURL))
    519519            return false;
    520520        break;
    … …  
    523523    case CachedResource::Type::TextTrackResource:
    524524#endif
    525         if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived))
     525        if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived, preRedirectURL))
    526526            return false;
    527527        break;
    … …  
    535535#if ENABLE(APPLICATION_MANIFEST)
    536536    case CachedResource::Type::ApplicationManifest:
    537         if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived))
     537        if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived, preRedirectURL))
    538538            return false;
    539539        break;
    … …  
    593593
    594594// FIXME: Should we find a way to know whether the redirection is for a preload request like we do for CachedResourceLoader::canRequest?
    595 bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options) const
     595bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, const URL& preRedirectURL) const
    596596{
    597597    if (document() && !document()->securityOrigin().canDisplay(url)) {
    … …  
    611611    }
    612612
    613     if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes)) {
     613    if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes, preRedirectURL)) {
    614614        CACHEDRESOURCELOADER_RELEASE_LOG("canRequestAfterRedirection: URL was not allowed by content policy");
    615615        return false;
    … …  
    626626}
    627627
    628 bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options)
     628bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options, const URL& preRedirectURL)
    629629{
    630630    ASSERT(m_documentLoader);
    … …  
    634634    // FIXME: We might want to align the checks done here with the ones done in CachedResourceLoader::requestResource, content extensions blocking in particular.
    635635
    636     return canRequestAfterRedirection(type, request.url(), options);
     636    return canRequestAfterRedirection(type, request.url(), options, preRedirectURL);
    637637}
    638638

  • branches/safari-612.4.9.0-branch/Source/WebCore/loader/cache/CachedResourceLoader.h

    r278849 r287792  
    156156    void stopUnusedPreloadsTimer();
    157157
    158     bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&);
    159     bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived) const;
     158    bool updateRequestAfterRedirection(CachedResource::Type, ResourceRequest&, const ResourceLoaderOptions&, const URL& preRedirectURL);
     159    bool allowedByContentSecurityPolicy(CachedResource::Type, const URL&, const ResourceLoaderOptions&, ContentSecurityPolicy::RedirectResponseReceived, const URL& preRedirectURL = URL()) const;
    160160
    161161    static const ResourceLoaderOptions& defaultCachedResourceOptions();
    … …  
    197197    void reloadImagesIfNotDeferred();
    198198
    199     bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&) const;
     199    bool canRequestAfterRedirection(CachedResource::Type, const URL&, const ResourceLoaderOptions&, const URL& preRedirectURL) const;
    200200    bool canRequestInContentDispositionAttachmentSandbox(CachedResource::Type, const URL&) const;
    201201

  • branches/safari-612.4.9.0-branch/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r286463 r287792  
    576576}
    577577
    578 bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    579 {
    580     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext);
    581 }
    582 
    583 bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    584 {
    585     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript);
    586 }
    587 
    588 bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    589 {
    590     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage);
    591 }
    592 
    593 bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    594 {
    595     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle);
    596 }
    597 
    598 bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    599 {
    600     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont);
     578bool ContentSecurityPolicy::allowChildContextFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     579{
     580    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::childSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext, preRedirectURL);
     581}
     582
     583bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     584{
     585    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::scriptSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript, preRedirectURL);
     586}
     587
     588bool ContentSecurityPolicy::allowImageFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     589{
     590    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::imgSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForImage, preRedirectURL);
     591}
     592
     593bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     594{
     595    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle, preRedirectURL);
     596}
     597
     598bool ContentSecurityPolicy::allowFontFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     599{
     600    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::fontSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForFont, preRedirectURL);
    601601}
    602602
    603603#if ENABLE(APPLICATION_MANIFEST)
    604 bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    605 {
    606     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest);
     604bool ContentSecurityPolicy::allowManifestFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     605{
     606    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::manifestSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForManifest, preRedirectURL);
    607607}
    608608#endif // ENABLE(APPLICATION_MANIFEST)
    609609
    610 bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived) const
    611 {
    612     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia);
     610bool ContentSecurityPolicy::allowMediaFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
     611{
     612    return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::mediaSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia, preRedirectURL);
    613613}
    614614

  • branches/safari-612.4.9.0-branch/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r286401 r287792  
    105105
    106106    enum class RedirectResponseReceived { No, Yes };
    107     WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    108     bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    109     bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    110     bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     107    WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     108    bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     109    bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     110    bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    111111#if ENABLE(APPLICATION_MANIFEST)
    112     bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     112    bool allowManifestFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    113113#endif
    114     bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     114    bool allowMediaFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    115115
    116116    bool allowChildFrameFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
    117     WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No) const;
     117    WEBCORE_EXPORT bool allowChildContextFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    118118    WEBCORE_EXPORT bool allowConnectToSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& requestedURL = URL()) const;
    119119    bool allowFormAction(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;

  • branches/safari-612.4.9.0-branch/Source/WebKit/ChangeLog

    r287635 r287792  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r286094. rdar://problem/87125111
     4
     5    Report the initiating url instead of the redirected one
     6    https://bugs.webkit.org/show_bug.cgi?id=233037
     7   
     8    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-11-20
     9    Reviewed by Brent Fulgham.
     10   
     11    LayoutTests/imported/w3c:
     12   
     13    * web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
     14   
     15    Source/WebCore:
     16   
     17    As per the spec, blockedURI should use the requested URL of original request instead of redirected location.
     18   
     19    * loader/DocumentThreadableLoader.cpp:
     20    (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     21    * loader/SubresourceLoader.cpp:
     22    (WebCore::SubresourceLoader::willSendRequestInternal):
     23    * loader/cache/CachedResourceLoader.cpp:
     24    (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     25    (WebCore::CachedResourceLoader::canRequestAfterRedirection const):
     26    (WebCore::CachedResourceLoader::updateRequestAfterRedirection):
     27    * loader/cache/CachedResourceLoader.h:
     28    * page/csp/ContentSecurityPolicy.cpp:
     29    (WebCore::ContentSecurityPolicy::allowChildContextFromSource const):
     30    (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     31    (WebCore::ContentSecurityPolicy::allowImageFromSource const):
     32    (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     33    (WebCore::ContentSecurityPolicy::allowFontFromSource const):
     34    (WebCore::ContentSecurityPolicy::allowManifestFromSource const):
     35    (WebCore::ContentSecurityPolicy::allowMediaFromSource const):
     36    * page/csp/ContentSecurityPolicy.h:
     37   
     38    Source/WebKit:
     39   
     40    Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     41   
     42    * NetworkProcess/NetworkLoadChecker.cpp:
     43    (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     44   
     45    LayoutTests:
     46   
     47    * TestExpectations: Unskip imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub.html
     48    * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt:
     49    * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt:
     50    * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt:
     51    * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt:
     52    * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt:
     53    * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt:
     54    * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt:
     55    * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt:
     56    * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     57    * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt:
     58    * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     59    * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     60    * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
     61   
     62    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     63
     64    2021-11-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     65
     66            Report the initiating url instead of the redirected one
     67            https://bugs.webkit.org/show_bug.cgi?id=233037
     68
     69            Reviewed by Brent Fulgham.
     70
     71            Pass pre-redirect URL to allowChildContextFromSource() and allowScriptFromSource().
     72
     73            * NetworkProcess/NetworkLoadChecker.cpp:
     74            (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):
     75
    1762022-01-05  Russell Epstein  <repstein@apple.com>
    277

  • branches/safari-612.4.9.0-branch/Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp

    r283922 r287792  
    291291    case FetchOptions::Destination::Serviceworker:
    292292    case FetchOptions::Destination::Sharedworker:
    293         return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived);
     293        return contentSecurityPolicy->allowChildContextFromSource(request.url(), redirectResponseReceived, preRedirectURL);
    294294    case FetchOptions::Destination::Script:
    295         if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived))
     295        if (request.requester() == ResourceRequest::Requester::ImportScripts && !contentSecurityPolicy->allowScriptFromSource(request.url(), redirectResponseReceived, preRedirectURL))
    296296            return false;
    297297        // FIXME: Check CSP for non-importScripts() initiated loads.
Note: See TracChangeset for help on using the changeset viewer.