Changeset 287270 in webkit


Ignore:
Timestamp:
Dec 20, 2021 12:12:52 PM (7 months ago)
Author:
Patrick Griffis
Message:

CSP: Always use UTF-8 encoded content when checking hashes
​https://bugs.webkit.org/show_bug.cgi?id=234159

Reviewed by Kate Cheney.

LayoutTests/imported/w3c:

Update expectations as passing.

  • web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate-expected.txt:
  • web-platform-tests/content-security-policy/script-src/scripthash-unicode-normalization.sub-expected.txt:

Source/WebCore:

As per the spec: ​https://www.w3.org/TR/CSP3/#match-element-to-source-list

Regardless of the encoding of the document, source will be converted to UTF-8

before applying any hashing algorithms.

StrictConversionReplacingUnpairedSurrogatesWithFFFD matches Chromiums behavior.

  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::findHashOfContentInPolicies const):

LayoutTests:

Remove normalization tests that are counter to WPT's CSP normalization tests.

  • http/tests/security/contentSecurityPolicy/1.1/scripthash-tests-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization-expected.txt: Removed.
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html: Removed.
Location:
trunk
Files:
2 deleted
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r287266 r287270  
     12021-12-20  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Always use UTF-8 encoded content when checking hashes
     4        https://bugs.webkit.org/show_bug.cgi?id=234159
     5
     6        Reviewed by Kate Cheney.
     7
     8        Remove normalization tests that are counter to WPT's CSP normalization tests.
     9
     10        * http/tests/security/contentSecurityPolicy/1.1/scripthash-tests-expected.txt:
     11        * http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html:
     12        * http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization-expected.txt: Removed.
     13        * http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html: Removed.
     14
    1152021-12-20  Tim Nguyen  <ntim@apple.com>
    216

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-tests-expected.txt

    r286853 r287270  
     1CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    23CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    … …  
    4243PASS "Script that contains Unicode code point U+00C5" did run inline script.
    4344PASS "Unicode code point U+00C5 is not equivalent to U+212B" did not run inline script.
    44 PASS "Unicode code point U+212B is equivalent to U+00C5" did run inline script.
    45 PASS "Big-5 page with Big-5 hash" did run inline script.
     45PASS "Big-5 page with Big-5 hash" did not run inline script.
    4646PASS "Big-5 page with UTF-8 hash" did not run inline script.
    4747PASS "Hash source with invalid prefix" did not run inline script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html

    r286853 r287270  
    8383    expectedResult: DoNotRunInlineScript,
    8484},
    85 {
    86     name: "Unicode code point U+212B is equivalent to U+00C5",
    87     charset: "UTF8",
    88     script: "didRunInlineScript+%3D+true%3B+//+%E2%84%AB", // %E2%84%AB is the URL encoded UTF-8 byte sequence for U+212B.
    89     hashSource: "'sha256-K3oo3dJj28X47TIh/UinhDWS3C5DfcQVCRzw4JM7SWE='", // Intentionally not 'sha256-rrdh0QCl46qqHxfnnk08ydh/rkhVi2JvD6DLuUP30MI='
    90     expectedResult: RunInlineScript,
    91 },
    9285// Big-5 encoding test cases
    9386{
    … …  
    9689    script: "didRunInlineScript+%3D+true%3B+//+%A4%F4",
    9790    hashSource: "'sha256-CAEkHFV/oUoz+L2Oa6gIFelb73og89vCbxrz4u/jAY4='",
    98     expectedResult: RunInlineScript,
     91    expectedResult: DoNotRunInlineScript,
    9992},
    10093{

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r287266 r287270  
     12021-12-20  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Always use UTF-8 encoded content when checking hashes
     4        https://bugs.webkit.org/show_bug.cgi?id=234159
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update expectations as passing.
     9
     10        * web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate-expected.txt:
     11        * web-platform-tests/content-security-policy/script-src/scripthash-unicode-normalization.sub-expected.txt:
     12
    1132021-12-20  Tim Nguyen  <ntim@apple.com>
    214

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate-expected.txt

    r283111 r287270  
    11
    2 FAIL Should convert the script contents to UTF-8 before hashing assert_unreached: Should not have fired a spv Reached unreachable code
     2PASS Should convert the script contents to UTF-8 before hashing
    33

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/scripthash-unicode-normalization.sub-expected.txt

    r267651 r287270  
    22
    33
    4 Harness Error (TIMEOUT), message = null
     4PASS Should fire securitypolicyviolation
     5PASS Only matching content runs even with NFC normalization.
    56
    6 NOTRUN Should fire securitypolicyviolation
    7 FAIL Only matching content runs even with NFC normalization. assert_unreached: nonMatchingContent script ran Reached unreachable code
    8 

  • trunk/Source/WebCore/ChangeLog

    r287268 r287270  
     12021-12-20  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Always use UTF-8 encoded content when checking hashes
     4        https://bugs.webkit.org/show_bug.cgi?id=234159
     5
     6        Reviewed by Kate Cheney.
     7
     8        As per the spec: https://www.w3.org/TR/CSP3/#match-element-to-source-list
     9        > Regardless of the encoding of the document, source will be converted to UTF-8
     10          before applying any hashing algorithms.
     11
     12        StrictConversionReplacingUnpairedSurrogatesWithFFFD matches Chromiums behavior.
     13
     14        * page/csp/ContentSecurityPolicy.cpp:
     15        (WebCore::ContentSecurityPolicy::findHashOfContentInPolicies const):
     16
    1172021-12-20  Fujii Hironori  <Hironori.Fujii@sony.com>
    218

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r286853 r287270  
    363363        return { false, false };
    364364
    365     // FIXME: We should compute the document encoding once and cache it instead of computing it on each invocation.
    366     PAL::TextEncoding documentEncoding;
    367     if (is<Document>(m_scriptExecutionContext))
    368         documentEncoding = downcast<Document>(*m_scriptExecutionContext).textEncoding();
    369     const PAL::TextEncoding& encodingToUse = documentEncoding.isValid() ? documentEncoding : PAL::UTF8Encoding();
    370 
    371     // FIXME: Compute the digest with respect to the raw bytes received from the page.
    372     // See <https://bugs.webkit.org/show_bug.cgi?id=155184>.
    373     auto encodedContent = encodingToUse.encode(content, PAL::UnencodableHandling::Entities);
     365    CString utf8Content = content.utf8(StrictConversionReplacingUnpairedSurrogatesWithFFFD);
    374366    bool foundHashInEnforcedPolicies = false;
    375367    bool foundHashInReportOnlyPolicies = false;
    376368    Vector<ContentSecurityPolicyHash> hashes;
    377369    for (auto algorithm : algorithms) {
    378         auto hash = cryptographicDigestForBytes(algorithm, encodedContent.data(), encodedContent.size());
     370        auto hash = cryptographicDigestForBytes(algorithm, utf8Content.data(), utf8Content.length());
    379371        hashes.append(hash);
    380372    }
Note: See TracChangeset for help on using the changeset viewer.