Changeset 286150 in webkit


Ignore:
Timestamp:
Nov 24, 2021 8:20:55 AM (8 months ago)
Author:
Patrick Griffis
Message:

CSP: Implement submitting samples in violation reports
​https://bugs.webkit.org/show_bug.cgi?id=233398

Reviewed by Kate Cheney.

LayoutTests/imported/w3c:

Update expectations with more passes.

  • web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-expected.txt:
  • web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-no-opt-in-expected.txt:
  • web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt:

Source/WebCore:

This implements handling 'report-sample' directive and submits a sample
for style-src and script-src. It doesn't currently extract the source
from eval() yet.

  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowJavaScriptURLs const):
(WebCore::ContentSecurityPolicy::allowInlineEventHandlers const):
(WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):
(WebCore::ContentSecurityPolicy::allowInlineScript const):
(WebCore::ContentSecurityPolicy::allowInlineStyle const):
(WebCore::ContentSecurityPolicy::allowFrameAncestors const):
(WebCore::ContentSecurityPolicy::allowPluginType const):
(WebCore::ContentSecurityPolicy::allowObjectFromSource const):
(WebCore::ContentSecurityPolicy::allowChildFrameFromSource const):
(WebCore::ContentSecurityPolicy::allowResourceFromSource const):
(WebCore::ContentSecurityPolicy::allowConnectToSource const):
(WebCore::ContentSecurityPolicy::allowBaseURI const):
(WebCore::ContentSecurityPolicy::reportViolation const):

  • page/csp/ContentSecurityPolicy.h:
  • page/csp/ContentSecurityPolicyClient.h:
  • page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::shouldReportSample const):

  • page/csp/ContentSecurityPolicyDirectiveList.h:
  • page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::parseSource):

  • page/csp/ContentSecurityPolicySourceList.h:

(WebCore::ContentSecurityPolicySourceList::shouldReportSample const):

  • page/csp/ContentSecurityPolicySourceListDirective.h:

(WebCore::ContentSecurityPolicySourceListDirective::shouldReportSample const):

Location:
trunk
Files:
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r286146 r286150  
     12021-11-24  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Implement submitting samples in violation reports
     4        https://bugs.webkit.org/show_bug.cgi?id=233398
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update expectations with more passes.
     9
     10        * web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-expected.txt:
     11        * web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-no-opt-in-expected.txt:
     12        * web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt:
     13
    1142021-11-24  Manuel Rego Casasnovas  <rego@igalia.com>
    215

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-expected.txt

    r259900 r286150  
    1 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''report-sample''. It will be ignored.
    2 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: Refused to execute a script for an inline event handler because 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    4 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''report-sample''. It will be ignored.
    5 CONSOLE MESSAGE: The source list for Content Security Policy directive 'script-src' contains an invalid source: ''report-sample''. It will be ignored.
    6 CONSOLE MESSAGE: Refused to execute a script because 'unsafe-eval' does not appear in the script-src directive of the Content Security Policy.
    7 CONSOLE MESSAGE: Refused to execute a script because 'unsafe-eval' does not appear in the script-src directive of the Content Security Policy.
    8 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    91
    102
    113Harness Error (TIMEOUT), message = null
    124
    13 TIMEOUT Inline script should have a sample. Test timed out
    14 TIMEOUT Inline event handlers should have a sample. Test timed out
     5PASS Inline script should have a sample.
     6PASS Inline event handlers should have a sample.
    157TIMEOUT JavaScript URLs in iframes should have a sample. Test timed out
    168TIMEOUT eval() should have a sample. Test timed out

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-no-opt-in-expected.txt

    r259900 r286150  
    1 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to execute a script for an inline event handler because 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: Refused to execute a script because 'unsafe-eval' does not appear in the script-src directive of the Content Security Policy.
    4 CONSOLE MESSAGE: Refused to execute a script because 'unsafe-eval' does not appear in the script-src directive of the Content Security Policy.
    5 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    61
    72
    83Harness Error (TIMEOUT), message = null
    94
    10 TIMEOUT Inline script should not have a sample. Test timed out
    11 TIMEOUT Inline event handlers should not have a sample. Test timed out
     5PASS Inline script should not have a sample.
     6PASS Inline event handlers should not have a sample.
    127TIMEOUT JavaScript URLs in iframes should not have a sample. Test timed out
    13 TIMEOUT eval()-alikes should not have a sample. Test timed out
     8PASS eval()-alikes should not have a sample.
    149

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt

    r286136 r286150  
    11
    2 FAIL Inline style blocks should have a sample. assert_equals: expected "p { omg: yay !important; }" but got ""
    3 FAIL Inline style attributes should have a sample. assert_equals: expected "omg: yay !important;" but got ""
     2PASS Inline style blocks should have a sample.
     3PASS Inline style attributes should have a sample.
    44

  • trunk/Source/WebCore/ChangeLog

    r286148 r286150  
     12021-11-24  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Implement submitting samples in violation reports
     4        https://bugs.webkit.org/show_bug.cgi?id=233398
     5
     6        Reviewed by Kate Cheney.
     7
     8        This implements handling 'report-sample' directive and submits a sample
     9        for style-src and script-src. It doesn't currently extract the source
     10        from eval() yet.
     11
     12        * page/csp/ContentSecurityPolicy.cpp:
     13        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs const):
     14        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers const):
     15        (WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):
     16        (WebCore::ContentSecurityPolicy::allowInlineScript const):
     17        (WebCore::ContentSecurityPolicy::allowInlineStyle const):
     18        (WebCore::ContentSecurityPolicy::allowFrameAncestors const):
     19        (WebCore::ContentSecurityPolicy::allowPluginType const):
     20        (WebCore::ContentSecurityPolicy::allowObjectFromSource const):
     21        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource const):
     22        (WebCore::ContentSecurityPolicy::allowResourceFromSource const):
     23        (WebCore::ContentSecurityPolicy::allowConnectToSource const):
     24        (WebCore::ContentSecurityPolicy::allowBaseURI const):
     25        (WebCore::ContentSecurityPolicy::reportViolation const):
     26        * page/csp/ContentSecurityPolicy.h:
     27        * page/csp/ContentSecurityPolicyClient.h:
     28        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
     29        (WebCore::ContentSecurityPolicyDirectiveList::shouldReportSample const):
     30        * page/csp/ContentSecurityPolicyDirectiveList.h:
     31        * page/csp/ContentSecurityPolicySourceList.cpp:
     32        (WebCore::ContentSecurityPolicySourceList::parseSource):
     33        * page/csp/ContentSecurityPolicySourceList.h:
     34        (WebCore::ContentSecurityPolicySourceList::shouldReportSample const):
     35        * page/csp/ContentSecurityPolicySourceListDirective.h:
     36        (WebCore::ContentSecurityPolicySourceListDirective::shouldReportSample const):
     37
    1382021-11-24  Ziran Sun  <zsun@igalia.com>
    239

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r286136 r286150  
    407407        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script", "its hash, its nonce, or 'unsafe-inline'");
    408408        // FIXME (rdar://83332874) implement scriptSrcElem properly.
    409         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrcElem, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
     409        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrcElem, violatedDirective, "inline"_s, consoleMessage, contextURL, source, TextPosition(contextLine, OrdinalNumber()));
    410410        if (!didNotifyInspector && violatedDirective.directiveList().isReportOnly()) {
    411411            reportBlockedScriptExecutionToInspector(violatedDirective.text());
    … …  
    424424    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    425425        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script for an inline event handler", "'unsafe-inline'");
    426         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, element);
     426        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, source, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, element);
    427427        if (!didNotifyInspector && !violatedDirective.directiveList().isReportOnly()) {
    428428            reportBlockedScriptExecutionToInspector(violatedDirective.text());
    … …  
    475475        TextPosition sourcePosition(OrdinalNumber::beforeFirst(), OrdinalNumber());
    476476        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, url, "Refused to load");
    477         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrcElem, violatedDirective, url.string(), consoleMessage, String(), sourcePosition);
     477        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrcElem, violatedDirective, url.string(), consoleMessage, String(), scriptContent, sourcePosition);
    478478    };
    479479
    … …  
    488488    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    489489        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script", "its hash, its nonce, or 'unsafe-inline'");
    490         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
     490        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, scriptContent, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
    491491        if (!didNotifyInspector && !violatedDirective.directiveList().isReportOnly()) {
    492492            reportBlockedScriptExecutionToInspector(violatedDirective.text());
    … …  
    508508        auto name = shouldCheckUnsafeHashes == CheckUnsafeHashes::Yes ? ContentSecurityPolicyDirectiveNames::styleSrcAttr : ContentSecurityPolicyDirectiveNames::styleSrcElem;
    509509        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::styleSrc, violatedDirective, URL(), "Refused to apply a stylesheet", "its hash, its nonce, or 'unsafe-inline'");
    510         reportViolation(name, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
     510        reportViolation(name, violatedDirective, "inline"_s, consoleMessage, contextURL, styleContent, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
    511511    };
    512512
    … …  
    546546    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    547547        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::frameAncestors, violatedDirective, url, "Refused to load");
    548         reportViolation(ContentSecurityPolicyDirectiveNames::frameAncestors, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition);
     548        reportViolation(ContentSecurityPolicyDirectiveNames::frameAncestors, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    549549    };
    550550    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForFrameAncestor, frame);
    … …  
    574574    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    575575        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::frameAncestors, violatedDirective, url, "Refused to load");
    576         reportViolation(ContentSecurityPolicyDirectiveNames::frameAncestors, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition);
     576        reportViolation(ContentSecurityPolicyDirectiveNames::frameAncestors, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    577577    };
    578578    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForFrameAncestorOrigins, ancestorOrigins);
    … …  
    587587    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    588588        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::pluginTypes, violatedDirective, url, "Refused to load", "its MIME type");
    589         reportViolation(ContentSecurityPolicyDirectiveNames::pluginTypes, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition);
     589        reportViolation(ContentSecurityPolicyDirectiveNames::pluginTypes, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    590590    };
    591591    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForPluginType, type, typeAttribute);
    … …  
    603603    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    604604        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::objectSrc, violatedDirective, url, "Refused to load");
    605         reportViolation(ContentSecurityPolicyDirectiveNames::objectSrc, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition);
     605        reportViolation(ContentSecurityPolicyDirectiveNames::objectSrc, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    606606    };
    607607    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource, url, redirectResponseReceived == RedirectResponseReceived::Yes, ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::Yes);
    … …  
    617617        const char* effectiveViolatedDirective = violatedDirective.name() == ContentSecurityPolicyDirectiveNames::frameSrc ? ContentSecurityPolicyDirectiveNames::frameSrc : ContentSecurityPolicyDirectiveNames::childSrc;
    618618        String consoleMessage = consoleMessageForViolation(effectiveViolatedDirective, violatedDirective, url, "Refused to load");
    619         reportViolation(effectiveViolatedDirective, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition);
     619        reportViolation(effectiveViolatedDirective, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    620620    };
    621621    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForFrame, url, redirectResponseReceived == RedirectResponseReceived::Yes);
    … …  
    631631    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    632632        String consoleMessage = consoleMessageForViolation(name, violatedDirective, blockedURL, "Refused to load");
    633         reportViolation(name, violatedDirective, blockedURL.string(), consoleMessage, sourceURL, sourcePosition);
     633        reportViolation(name, violatedDirective, blockedURL.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    634634    };
    635635    return allPoliciesAllow(WTFMove(handleViolatedDirective), resourcePredicate, url, redirectResponseReceived == RedirectResponseReceived::Yes);
    … …  
    684684    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    685685        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url, "Refused to connect to");
    686         reportViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition, preRedirectURL);
     686        reportViolation(ContentSecurityPolicyDirectiveNames::connectSrc, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition, preRedirectURL);
    687687    };
    688688    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForConnectSource, url, redirectResponseReceived == RedirectResponseReceived::Yes);
    … …  
    704704    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    705705        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::baseURI, violatedDirective, url, "Refused to change the document base URL to");
    706         reportViolation(ContentSecurityPolicyDirectiveNames::baseURI, violatedDirective, url.string(), consoleMessage, sourceURL, sourcePosition);
     706        reportViolation(ContentSecurityPolicyDirectiveNames::baseURI, violatedDirective, url.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
    707707    };
    708708    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForBaseURI, url);
    … …  
    725725void ContentSecurityPolicy::reportViolation(const String& violatedDirective, const ContentSecurityPolicyDirective& effectiveViolatedDirective, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* state) const
    726726{
    727     // FIXME: Extract source file and source position from JSC::ExecState.
    728     return reportViolation(violatedDirective, effectiveViolatedDirective.nameForReporting().convertToASCIILowercase(), effectiveViolatedDirective.directiveList(), blockedURL, consoleMessage, String(), TextPosition(OrdinalNumber::beforeFirst(), OrdinalNumber::beforeFirst()), state);
     727    // FIXME: Extract source file, content, and position from JSC::ExecState.
     728    return reportViolation(violatedDirective, effectiveViolatedDirective.nameForReporting().convertToASCIILowercase(), effectiveViolatedDirective.directiveList(), blockedURL, consoleMessage, String(), StringView(), TextPosition(OrdinalNumber::beforeFirst(), OrdinalNumber::beforeFirst()), state);
    729729}
    730730
    731731void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* state) const
    732732{
    733     // FIXME: Extract source file and source position from JSC::ExecState.
    734     return reportViolation(effectiveViolatedDirective, violatedDirective, violatedDirectiveList, blockedURL, consoleMessage, String(), TextPosition(OrdinalNumber::beforeFirst(), OrdinalNumber::beforeFirst()), state);
    735 }
    736 
    737 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state, Element* element) const
    738 {
    739     return reportViolation(effectiveViolatedDirective, violatedDirective.nameForReporting().convertToASCIILowercase(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL, element);
    740 }
    741 
    742 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURLString, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL, Element* element) const
     733    // FIXME: Extract source file, content, and position from JSC::ExecState.
     734    return reportViolation(effectiveViolatedDirective, violatedDirective, violatedDirectiveList, blockedURL, consoleMessage, String(), StringView(), TextPosition(OrdinalNumber::beforeFirst(), OrdinalNumber::beforeFirst()), state);
     735}
     736
     737void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const StringView& sourceContent, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state, Element* element) const
     738{
     739    return reportViolation(effectiveViolatedDirective, violatedDirective.nameForReporting().convertToASCIILowercase(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourceContent, sourcePosition, state, preRedirectURL, element);
     740}
     741
     742void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURLString, const String& consoleMessage, const String& sourceURL, const StringView& sourceContent, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL, Element* element) const
    743743{
    744744    logToConsole(consoleMessage, sourceURL, sourcePosition.m_line, sourcePosition.m_column, state);
    … …  
    754754    info.lineNumber = sourcePosition.m_line.oneBasedInt();
    755755    info.columnNumber = sourcePosition.m_column.oneBasedInt();
     756    info.sample = violatedDirectiveList.shouldReportSample(violatedDirective) ? sourceContent.left(40).toString() : emptyString();
    756757
    757758    if (m_client)
    … …  
    802803    violationEventInit.lineNumber =  info.lineNumber;
    803804    violationEventInit.columnNumber = info.columnNumber;
     805    violationEventInit.sample = info.sample;
    804806    violationEventInit.bubbles = true;
    805807    if (m_client)

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r286136 r286150  
    224224    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject*) const;
    225225    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList&, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* = nullptr) const;
    226     void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr, Element* = nullptr) const;
    227     void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL(), Element* = nullptr) const;
     226    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const StringView& sourceContent, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr, Element* = nullptr) const;
     227    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const StringView& sourceContent, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL(), Element* = nullptr) const;
    228228    void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
    229229

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyClient.h

    r284080 r286150  
    3737    String documentURI;
    3838    String sourceFile;
     39    String sample;
    3940    int lineNumber { 0 };
    4041    int columnNumber { 0 };

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp

    r284959 r286150  
    643643}
    644644
     645bool ContentSecurityPolicyDirectiveList::shouldReportSample(const String& violatedDirective) const
     646{
     647    ContentSecurityPolicySourceListDirective* directive = nullptr;
     648    if (violatedDirective.startsWith(ContentSecurityPolicyDirectiveNames::styleSrc))
     649        directive = m_styleSrc.get();
     650    else if (violatedDirective.startsWith(ContentSecurityPolicyDirectiveNames::scriptSrc))
     651        directive = m_scriptSrc.get();
     652
     653    return directive && directive->shouldReportSample();
     654}
     655
    645656} // namespace WebCore

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h

    r284959 r286150  
    8787    const String& webAssemblyDisabledErrorMessage() const { return m_webAssemblyDisabledErrorMessage; }
    8888    bool isReportOnly() const { return m_reportOnly; }
     89    bool shouldReportSample(const String&) const;
    8990    const Vector<String>& reportURIs() const { return m_reportURIs; }
    9091

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp

    r284959 r286150  
    249249    }
    250250
     251    if (skipExactlyIgnoringASCIICase(buffer, "'report-sample'")) {
     252        m_reportSample = true;
     253        return source;
     254    }
     255
    251256    auto begin = buffer.position();
    252257    auto beginHost = begin;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.h

    r284959 r286150  
    5656    bool allowNonParserInsertedScripts() const { return m_allowNonParserInsertedScripts; }
    5757    bool allowUnsafeHashes() const { return m_allowUnsafeHashes; }
     58    bool shouldReportSample() const { return m_reportSample; }
    5859
    5960private:
    … …  
    9798    bool m_allowNonParserInsertedScripts { false };
    9899    bool m_allowUnsafeHashes { false };
     100    bool m_reportSample { false };
    99101};
    100102

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.h

    r284959 r286150  
    4646    bool allowEval() const { return m_sourceList.allowEval(); }
    4747    bool allowNonParserInsertedScripts() const { return m_sourceList.allowNonParserInsertedScripts(); }
     48    bool shouldReportSample() const { return m_sourceList.shouldReportSample(); }
    4849
    4950    OptionSet<ContentSecurityPolicyHashAlgorithm> hashAlgorithmsUsed() const { return m_sourceList.hashAlgorithmsUsed(); }
Note: See TracChangeset for help on using the changeset viewer.