Changeset 287756 in webkit

Timestamp:

Jan 7, 2022 10:04:56 AM (6 months ago)

Author:

Kate Cheney

Message:

Implement CSP strict-dynamic for module scripts
​https://bugs.webkit.org/show_bug.cgi?id=234934
<rdar://problem/83728374>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/security/contentSecurityPolicy/strict-dynamic-module-script.html

This also adds the contextLine value instead of using the default
OrdinalNumber::beforeFirst() value.

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::requestClassicScript):
(WebCore::ScriptElement::requestModuleScript):
(WebCore::ScriptElement::executeClassicScript):

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):

• page/csp/ContentSecurityPolicy.h:

LayoutTests:

• http/tests/security/contentSecurityPolicy/strict-dynamic-module-script-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/strict-dynamic-module-script.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic-module-script-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic-module-script.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ScriptElement.cpp (modified) (3 diffs)
• Source/WebCore/page/csp/ContentSecurityPolicy.cpp (modified) (2 diffs)
• Source/WebCore/page/csp/ContentSecurityPolicy.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2022-01-07  Kate Cheney  <katherine_cheney@apple.com>
+
+        Implement CSP strict-dynamic for module scripts
+        https://bugs.webkit.org/show_bug.cgi?id=234934
+        <rdar://problem/83728374>
+
+        Reviewed by Brent Fulgham.
+
+        * http/tests/security/contentSecurityPolicy/strict-dynamic-module-script-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/strict-dynamic-module-script.html: Added.
+
 2022-01-07  Aditya Keerthi  <akeerthi@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-01-07  Kate Cheney  <katherine_cheney@apple.com>
+
+        Implement CSP strict-dynamic for module scripts
+        https://bugs.webkit.org/show_bug.cgi?id=234934
+        <rdar://problem/83728374>
+
+        Reviewed by Brent Fulgham.
+
+        Test: http/tests/security/contentSecurityPolicy/strict-dynamic-module-script.html
+
+        This also adds the contextLine value instead of using the default
+        OrdinalNumber::beforeFirst() value.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::requestClassicScript):
+        (WebCore::ScriptElement::requestModuleScript):
+        (WebCore::ScriptElement::executeClassicScript):
+        * page/csp/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):
+        * page/csp/ContentSecurityPolicy.h:
+
 2022-01-07  Aditya Keerthi  <akeerthi@apple.com>
 

trunk/Source/WebCore/dom/ScriptElement.cpp

@@ -305 +305 @@
 
         const auto& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
-        if (!contentSecurityPolicy.allowNonParserInsertedScripts(scriptURL, m_element.nonce(), String(), m_parserInserted))
+        if (!contentSecurityPolicy.allowNonParserInsertedScripts(scriptURL, m_startLineNumber, m_element.nonce(), String(), m_parserInserted))
             return false;
 
@@ -377 +377 @@
     ASSERT(m_element.document().contentSecurityPolicy());
     const auto& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
+    if (!contentSecurityPolicy.allowNonParserInsertedScripts(m_element.document().url(), m_startLineNumber, m_element.nonce(), sourceCode.source(), m_parserInserted))
+        return false;
+
     bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(nonce, m_element.isInUserAgentShadowTree());
     if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
@@ -398 +401 @@
         ASSERT(m_element.document().contentSecurityPolicy());
         const ContentSecurityPolicy& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
-        if (!contentSecurityPolicy.allowNonParserInsertedScripts(m_element.document().url(), m_element.nonce(), sourceCode.source(), m_parserInserted))
+        if (!contentSecurityPolicy.allowNonParserInsertedScripts(m_element.document().url(), m_startLineNumber, m_element.nonce(), sourceCode.source(), m_parserInserted))
             return;
 

trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

@@ -460 +460 @@
 }
 
-bool ContentSecurityPolicy::allowNonParserInsertedScripts(const URL& url, const String& nonce, const StringView& scriptContent, ParserInserted parserInserted) const
+bool ContentSecurityPolicy::allowNonParserInsertedScripts(const URL& url, const OrdinalNumber& contextLine, const String& nonce, const StringView& scriptContent, ParserInserted parserInserted) const
 {
     if (!shouldPerformEarlyCSPCheck())
@@ -466 +466 @@
 
     auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
-        TextPosition sourcePosition(OrdinalNumber::beforeFirst(), OrdinalNumber());
+        TextPosition sourcePosition(contextLine, OrdinalNumber());
         String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, url, "Refused to load");
         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrcElem, violatedDirective, url.string(), consoleMessage, String(), scriptContent, sourcePosition);

trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

@@ -102 +102 @@
     bool allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& code, Element*, bool overrideContentSecurityPolicy = false) const;
     bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element&, bool overrideContentSecurityPolicy = false) const;
-    bool allowNonParserInsertedScripts(const URL&, const String&, const StringView&, ParserInserted) const;
+    bool allowNonParserInsertedScripts(const URL&, const OrdinalNumber&, const String&, const StringView&, ParserInserted) const;
     bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, Element&, bool overrideContentSecurityPolicy = false) const;