Changeset 288132 in webkit


Ignore:
Timestamp:
Jan 18, 2022 11:33:30 AM (6 months ago)
Author:
Patrick Griffis
Message:

CSP: Improve handling of multiple policies
​https://bugs.webkit.org/show_bug.cgi?id=235199

Reviewed by Kate Cheney.

LayoutTests/imported/w3c:

Add new test expectations with more passes.

  • web-platform-tests/content-security-policy/script-src/script-src-multiple-policies-one-using-hashing-algorithms-expected.txt:
  • web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted-expected.txt:
  • web-platform-tests/content-security-policy/style-src/style-src-error-event-fires-expected.txt:
  • web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event-expected.txt:
  • web-platform-tests/content-security-policy/style-src/style-src-multiple-policies-multiple-hashing-algorithms-expected.txt: Added.

Source/WebCore:

This fixes many issues with multiple CSP policies.

To quote the spec for script-src:

Their behavior will be blocked unless every policy allows inline script, either implicitly by not

specifying a script-src (or default-src) directive, or explicitly, by specifying "unsafe-inline",
a nonce-source or a hash-source that matches the inline block.

The previous structure was many distinct calls to check if there was a nonce in any policy, then if there
was a hash in any policy, etc, rather than actually checking the policies as a whole to know if they
allow or block a behavior. This lead to various issues where polices were not properly respected and where
reports were inaccurate.

The allScriptPoliciesAllow() function did try to consider all policies but was not very flexible and had buggy
behavior like for each policy it would call findHashOfContentInPolicies() meaning hashes from other policies
incorrectly applied to the current policy, plus general inefficiency of hashing the same content many
times over.

The new behavior relies more on passing all required information in a single function call to verify all
policies in a single pass.

  • bindings/js/CachedScriptFetcher.cpp:

(WebCore::CachedScriptFetcher::requestScriptWithCache const):

  • dom/InlineStyleSheetOwner.cpp:

(WebCore::InlineStyleSheetOwner::createSheet):

  • dom/ScriptElement.cpp:

(WebCore::ScriptElement::requestModuleScript):
(WebCore::ScriptElement::executeClassicScript):

  • dom/StyledElement.cpp:

(WebCore::StyledElement::styleAttributeChanged):

  • html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::process):

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):

  • loader/ResourceLoaderOptions.h:
  • loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):

  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::parseSubResourceIntegrityIntoDigests):
(WebCore::generateHashesForContent):
(WebCore::ContentSecurityPolicy::allowJavaScriptURLs const):
(WebCore::ContentSecurityPolicy::allowInlineEventHandlers const):
(WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):
(WebCore::ContentSecurityPolicy::allowInlineScript const):
(WebCore::ContentSecurityPolicy::allowInlineStyle const):
(WebCore::ContentSecurityPolicy::allowScriptFromSource const):
(WebCore::ContentSecurityPolicy::allowStyleFromSource const):
(WebCore::ContentSecurityPolicy::allScriptPoliciesAllow const): Deleted.
(WebCore::ContentSecurityPolicy::findHashOfContentInPolicies const): Deleted.
(WebCore::ContentSecurityPolicy::checkHashAndReportViolation const): Deleted.

  • page/csp/ContentSecurityPolicy.h:
  • page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineJavascriptURL const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineEventHandlers const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForNonParserInsertedScripts const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScript const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle const):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript const): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashStyle const): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForParserInsertedScript const): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptAttribute const): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash const): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleHash const): Deleted.

  • page/csp/ContentSecurityPolicyDirectiveList.h:

LayoutTests:

Update test expectations, Some newly passing tests are no longer skipped and some have new reports.

  • TestExpectations:
  • http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-multiple-policies-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-in-enforced-policy-and-not-in-report-only-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-multiple-policies-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-multiple-policies-expected.txt:
  • http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt:
  • http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt:
  • http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/window-open-javascript-url-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/window-open-javascript-url-with-target-blocked-expected.txt:
  • platform/glib/TestExpectations:
  • platform/wk2/http/tests/security/contentSecurityPolicy/block-all-mixed-content/insecure-css-in-iframe-report-only-expected.txt:
Location:
trunk
Files:
1 added
41 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r288117 r288132  
     12022-01-18  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Improve handling of multiple policies
     4        https://bugs.webkit.org/show_bug.cgi?id=235199
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update test expectations, Some newly passing tests are no longer skipped and some have new reports.
     9
     10        * TestExpectations:
     11        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt:
     12        * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-multiple-policies-expected.txt:
     13        * http/tests/security/contentSecurityPolicy/1.1/scripthash-in-enforced-policy-and-not-in-report-only-expected.txt:
     14        * http/tests/security/contentSecurityPolicy/1.1/scripthash-multiple-policies-expected.txt:
     15        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt:
     16        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt:
     17        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
     18        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
     19        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
     20        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy2-expected.txt:
     21        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
     22        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
     23        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt:
     24        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-multiple-policies-expected.txt:
     25        * http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt:
     26        * http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt:
     27        * http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt:
     28        * http/tests/security/contentSecurityPolicy/window-open-javascript-url-blocked-expected.txt:
     29        * http/tests/security/contentSecurityPolicy/window-open-javascript-url-with-target-blocked-expected.txt:
     30        * platform/glib/TestExpectations:
     31        * platform/wk2/http/tests/security/contentSecurityPolicy/block-all-mixed-content/insecure-css-in-iframe-report-only-expected.txt:
     32
    1332022-01-18  Sepand Parhami  <sparhami@apple.com>
    234

  • trunk/LayoutTests/TestExpectations

    r288070 r288132  
    968968# FIXME: Skip Content Security Policy tests that are dumping the render tree instead of text:
    969969imported/w3c/web-platform-tests/content-security-policy/svg/scripted.svg [ Skip ]
    970 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-multiple-policies-one-using-hashing-algorithms.html [ Skip ]
    971970imported/w3c/web-platform-tests/content-security-policy/svg/including.sub.svg [ Skip ]
    972971
    … …  
    10121011imported/w3c/web-platform-tests/content-security-policy/reporting/multiple-report-policies.html [ Skip ]
    10131012imported/w3c/web-platform-tests/content-security-policy/reporting/report-cross-origin-no-cookies.sub.html [ Skip ]
    1014 imported/w3c/web-platform-tests/content-security-policy/style-src/style-src-multiple-policies-multiple-hashing-algorithms.html [ Skip ]
    10151013
    10161014# Content Security Policy: Embedded Enforcement is not supported
    10171015imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement
    1018 
    1019 # Skip some Content Security Policy script-dynamic tests as we do not fully support the feature
    1020 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted.html [ Skip ]
    10211016
    10221017# Skip Content Security Policy shared workers tests as we do not support shared workers

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt

    r259900 r288132  
    22CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    33CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     4CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    45
    56

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-multiple-policies-expected.txt

    r259900 r288132  
    1 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    31CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    42CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-in-enforced-policy-and-not-in-report-only-expected.txt

    r259900 r288132  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'none'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    22CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     3CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    34CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    4 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    55
    66

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-multiple-policies-expected.txt

    r259900 r288132  
    1 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    31CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    42CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt

    r203434 r288132  
     1CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt

    r203434 r288132  
     1CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt

    r203434 r288132  
     1CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt

    r203434 r288132  
     1CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt

    r284254 r288132  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    2 CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    32CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    43CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy2-expected.txt

    r259900 r288132  
    11CONSOLE MESSAGE: The Content Security Policy 'script-src 'nonce-dummy' 'nonce-dump-as-text'' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.
    2 CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    32CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    43CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt

    r259829 r288132  
     1CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt

    r259829 r288132  
     1CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    12PASS did execute script.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt

    r259900 r288132  
    22CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    33CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     4CONSOLE MESSAGE: [Report Only] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    45
    56

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-multiple-policies-expected.txt

    r259900 r288132  
    1 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    31CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    42CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt

    r267644 r288132  
    22CONSOLE MESSAGE: The 'options' directive has been replaced with 'unsafe-inline' and 'unsafe-eval' source expressions for the 'script-src' and 'style-src' directives. Please use those directives instead, as 'options' has no effect.
    33CONSOLE MESSAGE: The 'options' directive has been replaced with 'unsafe-inline' and 'unsafe-eval' source expressions for the 'script-src' and 'style-src' directives. Please use those directives instead, as 'options' has no effect.
    4 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     4CONSOLE MESSAGE: Refused to execute a script because its hash or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    55This test passes if it doesn't alert fail.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt

    r259900 r288132  
    11CONSOLE MESSAGE: Refused to load javascript:alert('FAIL'); because it appears in neither the object-src directive nor the default-src directive of the Content Security Policy.
    22CONSOLE MESSAGE: Refused to load javascript:alert('FAIL'); because it appears in neither the object-src directive nor the default-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' appears in neither the script-src directive nor the default-src directive of the Content Security Policy.
     3CONSOLE MESSAGE: Refused to execute a script because its hash or 'unsafe-inline' appears in neither the script-src directive nor the default-src directive of the Content Security Policy.
    44

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt

    r285214 r288132  
    22CONSOLE MESSAGE: The 'allow' directive has been replaced with 'default-src'. Please use that directive instead, as 'allow' has no effect.
    33CONSOLE MESSAGE: The 'allow' directive has been replaced with 'default-src'. Please use that directive instead, as 'allow' has no effect.
    4 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     4CONSOLE MESSAGE: Refused to execute a script because its hash or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    55

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/window-open-javascript-url-blocked-expected.txt

    r259900 r288132  
    1 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to execute a script because its hash or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    22

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/window-open-javascript-url-with-target-blocked-expected.txt

    r259900 r288132  
    1 CONSOLE MESSAGE: Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
     1CONSOLE MESSAGE: Refused to execute a script because its hash or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.
    22

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r288113 r288132  
     12022-01-18  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Improve handling of multiple policies
     4        https://bugs.webkit.org/show_bug.cgi?id=235199
     5
     6        Reviewed by Kate Cheney.
     7
     8        Add new test expectations with more passes.
     9
     10        * web-platform-tests/content-security-policy/script-src/script-src-multiple-policies-one-using-hashing-algorithms-expected.txt:
     11        * web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted-expected.txt:
     12        * web-platform-tests/content-security-policy/style-src/style-src-error-event-fires-expected.txt:
     13        * web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event-expected.txt:
     14        * web-platform-tests/content-security-policy/style-src/style-src-multiple-policies-multiple-hashing-algorithms-expected.txt: Added.
     15
    1162022-01-17  Sergio Villar Senin  <svillar@igalia.com>
    217

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-multiple-policies-one-using-hashing-algorithms-expected.txt

    r246330 r288132  
    1 layer at (0,0) size 1280x960
    2   RenderView at (0,0) size 1280x960
    3 layer at (0,0) size 1280x8
    4   RenderBlock {HTML} at (0,0) size 1280x8
    5     RenderBody {BODY} at (8,8) size 1264x0
     1
     2PASS Test that script executes if allowed by proper hash values
     3

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted-expected.txt

    r283192 r288132  
    11Parser-inserted scripts without a correct nonce are not allowed with `strict-dynamic` in the script-src directive.
    22
    3 
    4 Harness Error (TIMEOUT), message = null
    53
    64PASS Parser-inserted script via `document.write` without a correct nonce is not allowed with `strict-dynamic`.
    … …  
    1210PASS Parser-inserted deferred async script via `document.write` without a correct nonce is not allowed with `strict-dynamic`.
    1311PASS Parser-inserted deferred async script via `document.writeln` without a correct nonce is not allowed with `strict-dynamic`.
    14 TIMEOUT Script injected via `innerHTML` is not allowed with `strict-dynamic`. Test timed out
    15 TIMEOUT Script injected via `insertAdjacentHTML` is not allowed with `strict-dynamic`. Test timed out
     12FAIL Script injected via `innerHTML` is not allowed with `strict-dynamic`. assert_equals: expected "script-src-attr" but got "script-src"
     13FAIL Script injected via `insertAdjacentHTML` is not allowed with `strict-dynamic`. assert_equals: expected "script-src-attr" but got "script-src"
    1614

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/style-src/style-src-error-event-fires-expected.txt

    r267651 r288132  
    55Harness Error (TIMEOUT), message = null
    66
    7 NOTRUN Test error event fires on stylesheet link
     7PASS Test error event fires on stylesheet link
    88NOTRUN Test error event fires on inline style
    99Lorem ipsum

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event-expected.txt

    r267651 r288132  
    33Harness Error (TIMEOUT), message = null
    44
    5 FAIL Should fire a securitypolicyviolation event assert_equals: expected "style-src 'nonce-nonceynonce'" but got "style-src-elem"
     5PASS Should fire a securitypolicyviolation event
    66NOTRUN Test that paragraph remains unmodified and error events received.
    77Lorem ipsum

  • trunk/LayoutTests/platform/glib/TestExpectations

    r288096 r288132  
    14401440
    14411441# Failing since deferred async loading enabled until document is loaded enabled.
    1442 webkit.org/b/208104 imported/w3c/web-platform-tests/content-security-policy/script-src/scripthash-changed-2.html [ Failure ]
    1443 webkit.org/b/208104 imported/w3c/web-platform-tests/content-security-policy/script-src/scriptnonce-changed-2.html [ Failure ]
    14441442webkit.org/b/208104 imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/execution-timing/085.html [ Failure Pass ]
    14451443

  • trunk/LayoutTests/platform/wk2/http/tests/security/contentSecurityPolicy/block-all-mixed-content/insecure-css-in-iframe-report-only-expected.txt

    r275917 r288132  
    33frame "<!--frame1-->" - didCommitLoadForFrame
    44CONSOLE MESSAGE: [Report Only] Blocked mixed content http://127.0.0.1:8000/security/mixedContent/resources/style.css because 'block-all-mixed-content' appears in the Content Security Policy.
    5 CONSOLE MESSAGE: [blocked] The page at https://127.0.0.1:8443/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.php was not allowed to run insecure content from http://127.0.0.1:8000/security/mixedContent/resources/style.css.
     5CONSOLE MESSAGE: [blocked] The page at https://127.0.0.1:8443/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.py was not allowed to run insecure content from http://127.0.0.1:8000/security/mixedContent/resources/style.css.
    66
    7 frame "<!--frame1-->" - willPerformClientRedirectToURL: https://127.0.0.1:8443/security/contentSecurityPolicy/resources/echo-report.py?test=/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.php
     7frame "<!--frame1-->" - willPerformClientRedirectToURL: https://127.0.0.1:8443/security/contentSecurityPolicy/resources/echo-report.py?test=/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.py
    88frame "<!--frame1-->" - didFinishDocumentLoadForFrame
    99main frame - didHandleOnloadEventsForFrame
    10 frame "<!--frame1-->" - didFinishLoadForFrame
    1110frame "<!--frame1-->" - didStartProvisionalLoadForFrame
    1211frame "<!--frame1-->" - didCancelClientRedirectForFrame
    … …  
    2625CONTENT_TYPE: application/csp-report
    2726HTTP_HOST: 127.0.0.1:8443
    28 HTTP_REFERER: https://127.0.0.1:8443/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.php
     27HTTP_REFERER: https://127.0.0.1:8443/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.py
    2928REQUEST_METHOD: POST
    30 REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.php?test=/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.php
     29REQUEST_URI: /security/contentSecurityPolicy/resources/save-report.py?test=/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.py
    3130=== POST DATA ===
    32 {"csp-report":{"document-uri":"https://127.0.0.1:8443/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.php","referrer":"http://127.0.0.1:8000/security/contentSecurityPolicy/block-all-mixed-content/insecure-css-in-iframe-report-only.html","violated-directive":"block-all-mixed-content","effective-directive":"block-all-mixed-content","original-policy":"block-all-mixed-content; report-uri ../../resources/save-report.php?test=/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.php","blocked-uri":"http://127.0.0.1:8000","status-code":0}}
     31{"csp-report":{"document-uri":"https://127.0.0.1:8443/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.py","referrer":"http://127.0.0.1:8000/","violated-directive":"block-all-mixed-content","effective-directive":"block-all-mixed-content","original-policy":"block-all-mixed-content; report-uri ../../resources/save-report.py?test=/security/contentSecurityPolicy/block-all-mixed-content/resources/frame-with-insecure-css-report-only.py","blocked-uri":"http://127.0.0.1:8000","status-code":0}}

  • trunk/Source/WebCore/ChangeLog

    r288127 r288132  
     12022-01-18  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Improve handling of multiple policies
     4        https://bugs.webkit.org/show_bug.cgi?id=235199
     5
     6        Reviewed by Kate Cheney.
     7
     8        This fixes many issues with multiple CSP policies.
     9
     10        To quote the spec for script-src:
     11
     12        > Their behavior will be blocked unless every policy allows inline script, either implicitly by not
     13          specifying a script-src (or default-src) directive, or explicitly, by specifying "unsafe-inline",
     14          a nonce-source or a hash-source that matches the inline block.
     15
     16        The previous structure was many distinct calls to check if there was a nonce in any policy, then if there
     17        was a hash in any policy, etc, rather than actually checking the policies as a whole to know if they
     18        allow or block a behavior. This lead to various issues where polices were not properly respected and where
     19        reports were inaccurate.
     20
     21        The allScriptPoliciesAllow() function did try to consider all policies but was not very flexible and had buggy
     22        behavior like for each policy it would call findHashOfContentInPolicies() meaning hashes from other policies
     23        incorrectly applied to the current policy, plus general inefficiency of hashing the same content many
     24        times over.
     25
     26        The new behavior relies more on passing all required information in a single function call to verify all
     27        policies in a single pass.
     28
     29        * bindings/js/CachedScriptFetcher.cpp:
     30        (WebCore::CachedScriptFetcher::requestScriptWithCache const):
     31        * dom/InlineStyleSheetOwner.cpp:
     32        (WebCore::InlineStyleSheetOwner::createSheet):
     33        * dom/ScriptElement.cpp:
     34        (WebCore::ScriptElement::requestModuleScript):
     35        (WebCore::ScriptElement::executeClassicScript):
     36        * dom/StyledElement.cpp:
     37        (WebCore::StyledElement::styleAttributeChanged):
     38        * html/HTMLLinkElement.cpp:
     39        (WebCore::HTMLLinkElement::process):
     40        * loader/DocumentThreadableLoader.cpp:
     41        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy):
     42        * loader/ResourceLoaderOptions.h:
     43        * loader/cache/CachedResourceLoader.cpp:
     44        (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):
     45        * page/csp/ContentSecurityPolicy.cpp:
     46        (WebCore::parseSubResourceIntegrityIntoDigests):
     47        (WebCore::generateHashesForContent):
     48        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs const):
     49        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers const):
     50        (WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):
     51        (WebCore::ContentSecurityPolicy::allowInlineScript const):
     52        (WebCore::ContentSecurityPolicy::allowInlineStyle const):
     53        (WebCore::ContentSecurityPolicy::allowScriptFromSource const):
     54        (WebCore::ContentSecurityPolicy::allowStyleFromSource const):
     55        (WebCore::ContentSecurityPolicy::allScriptPoliciesAllow const): Deleted.
     56        (WebCore::ContentSecurityPolicy::findHashOfContentInPolicies const): Deleted.
     57        (WebCore::ContentSecurityPolicy::checkHashAndReportViolation const): Deleted.
     58        * page/csp/ContentSecurityPolicy.h:
     59        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
     60        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement const):
     61        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineJavascriptURL const):
     62        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineEventHandlers const):
     63        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForNonParserInsertedScripts const):
     64        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement const):
     65        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute const):
     66        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScript const):
     67        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle const):
     68        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript const): Deleted.
     69        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashStyle const): Deleted.
     70        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForParserInsertedScript const): Deleted.
     71        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptAttribute const): Deleted.
     72        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash const): Deleted.
     73        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleHash const): Deleted.
     74        * page/csp/ContentSecurityPolicyDirectiveList.h:
     75
    1762022-01-18  Simon Fraser  <simon.fraser@apple.com>
    277

  • trunk/Source/WebCore/bindings/js/CachedScriptFetcher.cpp

    r278253 r288132  
    5959    options.integrity = WTFMove(integrity);
    6060    options.referrerPolicy = m_referrerPolicy;
     61    options.nonce = m_nonce;
    6162
    6263    auto request = createPotentialAccessControlRequest(sourceURL, WTFMove(options), document, crossOriginMode);

  • trunk/Source/WebCore/dom/InlineStyleSheetOwner.cpp

    r286599 r288132  
    171171    ASSERT(document.contentSecurityPolicy());
    172172    const ContentSecurityPolicy& contentSecurityPolicy = *document.contentSecurityPolicy();
    173     bool hasKnownNonce = contentSecurityPolicy.allowStyleWithNonce(element.nonce(), element.isInUserAgentShadowTree());
    174     if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, element, hasKnownNonce))
     173    if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, element, element.nonce(), element.isInUserAgentShadowTree()))
    175174        return;
    176175

  • trunk/Source/WebCore/dom/ScriptElement.cpp

    r288004 r288132  
    384384        return false;
    385385
    386     bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(nonce, m_element.isInUserAgentShadowTree());
    387     if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
     386    if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, nonce, m_element.isInUserAgentShadowTree()))
    388387        return false;
    389388
    … …  
    408407            return;
    409408
    410         bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(m_element.nonce(), m_element.isInUserAgentShadowTree());
    411         if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
     409        if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, m_element.nonce(), m_element.isInUserAgentShadowTree()))
    412410            return;
    413411    }

  • trunk/Source/WebCore/dom/StyledElement.cpp

    r286136 r288132  
    207207        startLineNumber = document().scriptableDocumentParser()->textPosition().m_line;
    208208
    209     if (reason == ModifiedByCloning || document().contentSecurityPolicy()->allowInlineStyle(document().url().string(), startLineNumber, newStyleString.string(), CheckUnsafeHashes::Yes, *this, isInUserAgentShadowTree()))
     209    if (reason == ModifiedByCloning || document().contentSecurityPolicy()->allowInlineStyle(document().url().string(), startLineNumber, newStyleString.string(), CheckUnsafeHashes::Yes, *this, nonce(), isInUserAgentShadowTree()))
    210210        setInlineStyleFromString(newStyleString);
    211211

  • trunk/Source/WebCore/html/HTMLLinkElement.cpp

    r286772 r288132  
    322322
    323323        ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
     324        options.nonce = attributeWithoutSynchronization(HTMLNames::nonceAttr);
    324325        options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
    325         if (document().contentSecurityPolicy()->allowStyleWithNonce(attributeWithoutSynchronization(HTMLNames::nonceAttr)))
     326        if (document().contentSecurityPolicy()->allowStyleWithNonce(options.nonce))
    326327            options.contentSecurityPolicyImposition = ContentSecurityPolicyImposition::SkipPolicyCheck;
    327328        options.integrity = m_integrityMetadataForPendingSheetRequest;

  • trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r288088 r288132  
    687687        return contentSecurityPolicy().allowConnectToSource(url, redirectResponseReceived, preRedirectURL);
    688688    case ContentSecurityPolicyEnforcement::EnforceScriptSrcDirective:
    689         return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived, preRedirectURL, m_options.integrity);
     689        return contentSecurityPolicy().allowScriptFromSource(url, redirectResponseReceived, preRedirectURL, m_options.integrity, m_options.nonce);
    690690    }
    691691    ASSERT_NOT_REACHED();

  • trunk/Source/WebCore/loader/ResourceLoaderOptions.h

    r286361 r288132  
    207207    uint8_t maxRedirectCount { 20 };
    208208    FetchIdentifier navigationPreloadIdentifier;
     209    String nonce;
    209210
    210211    SendCallbackPolicy sendLoadCallbacks : bitWidthOfSendCallbackPolicy;

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r287731 r288132  
    502502#endif
    503503    case CachedResource::Type::Script:
    504         if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived, preRedirectURL, options.integrity))
     504        if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived, preRedirectURL, options.integrity, options.nonce))
    505505            return false;
    506506        break;
    507507    case CachedResource::Type::CSSStyleSheet:
    508         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived, preRedirectURL))
     508        if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived, preRedirectURL, options.nonce))
    509509            return false;
    510510        break;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r287783 r288132  
    335335}
    336336
    337 bool ContentSecurityPolicy::allScriptPoliciesAllow(ViolatedDirectiveCallback&& callback, const URL& url, const String& nonce, const StringView& scriptContent, ParserInserted parserInserted) const
    338 {
    339     bool isAllowed = true;
    340     for (auto& policy : m_policies) {
    341         auto violatedDirectiveForNonParserInsertedScript = policy.get()->violatedDirectiveForParserInsertedScript(parserInserted);
    342         auto violatedDirectiveForScriptNonce = policy.get()->violatedDirectiveForScriptNonce(nonce);
    343         auto violatedDirectiveForScriptSrc = policy.get()->violatedDirectiveForScript(url, false, { });
    344         auto [foundHashInEnforcedPolicies, foundHashInReportOnlyPolicies] = findHashOfContentInPolicies(&ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash, scriptContent, m_hashAlgorithmsForInlineScripts);
    345 
    346         if (violatedDirectiveForNonParserInsertedScript && violatedDirectiveForScriptNonce && violatedDirectiveForScriptSrc && !foundHashInEnforcedPolicies) {
    347             if (!violatedDirectiveForNonParserInsertedScript->directiveList().isReportOnly()
    348                 || !violatedDirectiveForScriptNonce->directiveList().isReportOnly()
    349                 || !violatedDirectiveForScriptSrc->directiveList().isReportOnly()
    350                 || foundHashInReportOnlyPolicies)
    351                 isAllowed = false;
    352 
    353             callback(*violatedDirectiveForScriptSrc);
     337static Vector<ResourceCryptographicDigest> parseSubResourceIntegrityIntoDigests(const String& subResourceIntegrity)
     338{
     339    auto encodedDigests = parseIntegrityMetadata(subResourceIntegrity);
     340    Vector<ResourceCryptographicDigest> decodedDigests;
     341
     342    if (!encodedDigests.has_value())
     343        return { };
     344
     345    for (const auto& encodedDigest : encodedDigests.value()) {
     346        auto decodedDigest = decodeEncodedResourceCryptographicDigest(encodedDigest);
     347        if (decodedDigest.has_value())
     348            decodedDigests.append(decodedDigest.value());
    354349        }
    355     }
    356     return isAllowed;
    357 }
    358 
    359 template<typename Predicate>
    360 ContentSecurityPolicy::HashInEnforcedAndReportOnlyPoliciesPair ContentSecurityPolicy::findHashOfContentInPolicies(const Predicate& predicate, StringView content, OptionSet<ContentSecurityPolicyHashAlgorithm> algorithms) const
    361 {
    362     if (algorithms.isEmpty() || content.isEmpty())
    363         return { false, false };
    364 
     350
     351    return decodedDigests;
     352}
     353
     354static Vector<ContentSecurityPolicyHash> generateHashesForContent(const StringView content, OptionSet<ContentSecurityPolicyHashAlgorithm> algorithms)
     355{
    365356    CString utf8Content = content.utf8(StrictConversionReplacingUnpairedSurrogatesWithFFFD);
    366     bool foundHashInEnforcedPolicies = false;
    367     bool foundHashInReportOnlyPolicies = false;
    368357    Vector<ContentSecurityPolicyHash> hashes;
    369358    for (auto algorithm : algorithms) {
    … …  
    371360        hashes.append(hash);
    372361    }
    373     if (!foundHashInEnforcedPolicies && allPoliciesWithDispositionAllow(ContentSecurityPolicy::Disposition::Enforce, predicate, hashes))
    374         foundHashInEnforcedPolicies = true;
    375     if (!foundHashInReportOnlyPolicies && allPoliciesWithDispositionAllow(ContentSecurityPolicy::Disposition::ReportOnly, predicate, hashes))
    376         foundHashInReportOnlyPolicies = true;
    377 
    378     return { foundHashInEnforcedPolicies, foundHashInReportOnlyPolicies };
    379 }
    380 
    381 template<typename ViolatedDirective, typename HashSearchPolicy>
    382 bool ContentSecurityPolicy::checkHashAndReportViolation(const String& source, const ViolatedDirective& violatedDirective, const HashSearchPolicy& searchPolicy, OptionSet<ContentSecurityPolicyHashAlgorithm> hashAlgorithms, ContentSecurityPolicy::ViolatedDirectiveCallback&& callback) const
    383 {
    384     auto [foundHashInEnforcedPolicies, foundHashInReportOnlyPolicies] = findHashOfContentInPolicies(searchPolicy, source, hashAlgorithms);
    385     if (foundHashInEnforcedPolicies && foundHashInReportOnlyPolicies)
    386         return true;
    387 
    388     if (!foundHashInReportOnlyPolicies)
    389         allPoliciesWithDispositionAllow(ContentSecurityPolicy::Disposition::ReportOnly, std::forward<ViolatedDirectiveCallback>(callback), violatedDirective);
    390 
    391     return foundHashInEnforcedPolicies || allPoliciesWithDispositionAllow(ContentSecurityPolicy::Disposition::Enforce, WTFMove(callback), violatedDirective);
     362
     363    return hashes;
    392364}
    393365
    … …  
    398370    bool didNotifyInspector = false;
    399371    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    400         String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script", "its hash, its nonce, or 'unsafe-inline'");
     372        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script", "its hash or 'unsafe-inline'");
    401373        // FIXME (rdar://83332874) implement scriptSrcElem properly.
    402374        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrcElem, violatedDirective, "inline"_s, consoleMessage, contextURL, source, TextPosition(contextLine, OrdinalNumber()));
    … …  
    407379    };
    408380
    409     return checkHashAndReportViolation(source, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript, m_hashAlgorithmsForInlineScripts, handleViolatedDirective);
     381    auto contentHashes = generateHashesForContent(source, m_hashAlgorithmsForInlineScripts);
     382    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineJavascriptURL, contentHashes);
    410383}
    411384
    … …  
    424397    };
    425398
    426     return checkHashAndReportViolation(source, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptAttribute, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript, m_hashAlgorithmsForInlineScripts, handleViolatedDirective);
     399    auto contentHashes = generateHashesForContent(source, m_hashAlgorithmsForInlineScripts);
     400    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineEventHandlers, contentHashes);
    427401}
    428402
    … …  
    472446    };
    473447
    474     return allScriptPoliciesAllow(handleViolatedDirective, sourceURL, nonce, scriptContent, parserInserted);
    475 }
    476 
    477 bool ContentSecurityPolicy::allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element& element, bool overrideContentSecurityPolicy) const
     448    auto contentHashes = generateHashesForContent(scriptContent, m_hashAlgorithmsForInlineScripts);
     449    String strippedNonce = stripLeadingAndTrailingHTMLSpaces(nonce);
     450    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForNonParserInsertedScripts, strippedNonce, contentHashes, sourceURL, parserInserted);
     451}
     452
     453bool ContentSecurityPolicy::allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element& element, const String& nonce, bool overrideContentSecurityPolicy) const
    478454{
    479455    if (overrideContentSecurityPolicy || shouldPerformEarlyCSPCheck())
    … …  
    488464        }
    489465    };
    490     // FIXME: We should not report that the inline script violated a policy when its hash matched a source
    491     // expression in the policy and the page has more than one policy. See <https://bugs.webkit.org/show_bug.cgi?id=159832>.
    492     return checkHashAndReportViolation(scriptContent.toString(), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement, &ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash, m_hashAlgorithmsForInlineScripts, handleViolatedDirective);
    493 }
    494 
    495 bool ContentSecurityPolicy::allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes shouldCheckUnsafeHashes, Element& element, bool overrideContentSecurityPolicy) const
     466
     467    auto contentHashes = generateHashesForContent(scriptContent, m_hashAlgorithmsForInlineScripts);
     468    String strippedNonce = stripLeadingAndTrailingHTMLSpaces(nonce);
     469    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement, strippedNonce, contentHashes);
     470}
     471
     472bool ContentSecurityPolicy::allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes shouldCheckUnsafeHashes, Element& element, const String& nonce, bool overrideContentSecurityPolicy) const
    496473{
    497474    if (overrideContentSecurityPolicy)
    … …  
    505482    };
    506483
     484    auto contentHashes = generateHashesForContent(styleContent, m_hashAlgorithmsForInlineStylesheets);
     485    String strippedNonce = stripLeadingAndTrailingHTMLSpaces(nonce);
     486
    507487    if (shouldCheckUnsafeHashes == CheckUnsafeHashes::Yes)
    508         return checkHashAndReportViolation(styleContent.toString(), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute, &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashStyle, m_hashAlgorithmsForInlineStylesheets, handleViolatedDirective);
    509 
    510     // FIXME: We should not report that the inline stylesheet violated a policy when its hash matched a source
    511     // expression in the policy and the page has more than one policy. See <https://bugs.webkit.org/show_bug.cgi?id=159832>.
    512     return checkHashAndReportViolation(styleContent.toString(), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleHash, m_hashAlgorithmsForInlineStylesheets, handleViolatedDirective);
     488        return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute, strippedNonce, contentHashes);
     489
     490    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement, strippedNonce, contentHashes);
    513491}
    514492
    … …  
    635613}
    636614
    637 static Vector<ResourceCryptographicDigest> parseSubResourceIntegrityIntoDigests(const String& subResourceIntegrity)
    638 {
    639     auto encodedDigests = parseIntegrityMetadata(subResourceIntegrity);
    640     Vector<ResourceCryptographicDigest> decodedDigests;
    641 
    642     if (!encodedDigests.has_value())
    643         return { };
    644 
    645     for (const auto& encodedDigest : encodedDigests.value()) {
    646         auto decodedDigest = decodeEncodedResourceCryptographicDigest(encodedDigest);
    647         if (decodedDigest.has_value())
    648             decodedDigests.append(decodedDigest.value());
    649     }
    650 
    651     return decodedDigests;
    652 }
    653 
    654 bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL, const String& subResourceIntegrity) const
     615bool ContentSecurityPolicy::allowScriptFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL, const String& subResourceIntegrity, const String& nonce) const
    655616{
    656617    if (shouldPerformEarlyCSPCheck())
    … …  
    668629
    669630    auto subResourceIntegrityDigests = parseSubResourceIntegrityIntoDigests(subResourceIntegrity);
    670     return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript, url, redirectResponseReceived == RedirectResponseReceived::Yes, subResourceIntegrityDigests);
     631    String strippedNonce = stripLeadingAndTrailingHTMLSpaces(nonce);
     632    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForScript, url, redirectResponseReceived == RedirectResponseReceived::Yes, subResourceIntegrityDigests, strippedNonce);
    671633}
    672634
    … …  
    676638}
    677639
    678 bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL) const
    679 {
    680     return allowResourceFromSource(url, redirectResponseReceived, ContentSecurityPolicyDirectiveNames::styleSrc, &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle, preRedirectURL);
     640bool ContentSecurityPolicy::allowStyleFromSource(const URL& url, RedirectResponseReceived redirectResponseReceived, const URL& preRedirectURL, const String& nonce) const
     641{
     642    if (LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy(url.protocol().toStringWithoutCopying()))
     643        return true;
     644    String sourceURL;
     645    const auto& blockedURL = !preRedirectURL.isNull() ? preRedirectURL : url;
     646    TextPosition sourcePosition(OrdinalNumber::beforeFirst(), OrdinalNumber());
     647    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
     648        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::styleSrc, violatedDirective, blockedURL, "Refused to load");
     649        reportViolation(ContentSecurityPolicyDirectiveNames::styleSrc, violatedDirective, blockedURL.string(), consoleMessage, sourceURL, StringView(), sourcePosition);
     650    };
     651
     652    String strippedNonce = stripLeadingAndTrailingHTMLSpaces(nonce);
     653    return allPoliciesAllow(WTFMove(handleViolatedDirective), &ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle, url, redirectResponseReceived == RedirectResponseReceived::Yes, strippedNonce);
    681654}
    682655

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r287783 r288132  
    101101    bool allowJavaScriptURLs(const String& contextURL, const OrdinalNumber& contextLine, const String& code, bool overrideContentSecurityPolicy = false) const;
    102102    bool allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& code, Element*, bool overrideContentSecurityPolicy = false) const;
    103     bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element&, bool overrideContentSecurityPolicy = false) const;
    104     bool allowNonParserInsertedScripts(const URL& sourceURL, const URL& contextURL, const OrdinalNumber&, const String&, const StringView&, ParserInserted) const;
    105     bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, Element&, bool overrideContentSecurityPolicy = false) const;
     103    bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element&, const String& nonce, bool overrideContentSecurityPolicy = false) const;
     104    bool allowNonParserInsertedScripts(const URL& sourceURL, const URL& contextURL, const OrdinalNumber&, const String& nonce, const StringView&, ParserInserted) const;
     105    bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, Element&, const String&, bool overrideContentSecurityPolicy = false) const;
    106106
    107107    bool allowEval(JSC::JSGlobalObject*, LogToConsole, StringView codeContent, bool overrideContentSecurityPolicy = false) const;
    … …  
    114114
    115115    enum class RedirectResponseReceived { No, Yes };
    116     WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL(), const String& = nullString()) const;
     116    WEBCORE_EXPORT bool allowScriptFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL(), const String& = nullString(), const String& nonce = nullString()) const;
    117117    bool allowImageFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    118     bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
     118    bool allowStyleFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL(), const String& nonce = nullString()) const;
    119119    bool allowFontFromSource(const URL&, RedirectResponseReceived = RedirectResponseReceived::No, const URL& preRedirectURL = URL()) const;
    120120#if ENABLE(APPLICATION_MANIFEST)
    … …  
    215215    template<typename Predicate, typename... Args>
    216216    bool allPoliciesAllow(ViolatedDirectiveCallback&&, Predicate&&, Args&&...) const WARN_UNUSED_RETURN;
    217     bool allScriptPoliciesAllow(ViolatedDirectiveCallback&&, const URL&, const String&, const StringView&, ParserInserted) const;
    218217    bool shouldPerformEarlyCSPCheck() const;
    219218   
    220219    using ResourcePredicate = const ContentSecurityPolicyDirective *(ContentSecurityPolicyDirectiveList::*)(const URL &, bool) const;
    221220    bool allowResourceFromSource(const URL&, RedirectResponseReceived, const char*, ResourcePredicate, const URL& preRedirectURL = URL()) const;
    222 
    223     using HashInEnforcedAndReportOnlyPoliciesPair = std::pair<bool, bool>;
    224     template<typename Predicate> HashInEnforcedAndReportOnlyPoliciesPair findHashOfContentInPolicies(const Predicate&, StringView content, OptionSet<ContentSecurityPolicyHashAlgorithm>) const WARN_UNUSED_RETURN;
    225221
    226222    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject*, StringView sourceContent) const;
    … …  
    229225    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const StringView& sourceContent, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL(), Element* = nullptr) const;
    230226    void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
    231 
    232     template<typename ViolatedDirective, typename HashSearchPolicy> bool checkHashAndReportViolation(const String&, const ViolatedDirective&, const HashSearchPolicy&, OptionSet<ContentSecurityPolicyHashAlgorithm>, ContentSecurityPolicy::ViolatedDirectiveCallback&&) const;
    233227
    234228    // We can never have both a script execution context and a ContentSecurityPolicyClient.

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp

    r287011 r288132  
    191191}
    192192
    193 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript(const Vector<ContentSecurityPolicyHash>& hashes) const
    194 {
    195     auto* operativeDirective = this->operativeDirective(m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc);
    196     if (checkUnsafeHashes(operativeDirective, hashes))
    197         return nullptr;
    198     return operativeDirective;
    199 }
    200 
    201 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashStyle(const Vector<ContentSecurityPolicyHash>& hashes) const
    202 {
    203     auto* operativeDirective = this->operativeDirective(m_styleSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc);
    204     if (checkUnsafeHashes(operativeDirective, hashes))
    205         return nullptr;
    206     return operativeDirective;
    207 }
    208 
    209 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForParserInsertedScript(ParserInserted parserInserted) const
     193const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement(const String& nonce, const Vector<ContentSecurityPolicyHash>& hashes) const
     194{
     195    auto* operativeDirective = this->operativeDirectiveScript(m_scriptSrcElem.get(), ContentSecurityPolicyDirectiveNames::scriptSrcElem);
     196    if (checkHashes(operativeDirective, hashes)
     197        || checkNonce(operativeDirective, nonce)
     198        || checkInline(operativeDirective))
     199        return nullptr;
     200    return operativeDirective;
     201}
     202
     203const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineJavascriptURL(const Vector<ContentSecurityPolicyHash>& hashes) const
     204{
     205    auto* operativeDirective = this->operativeDirectiveScript(m_scriptSrcElem.get(), ContentSecurityPolicyDirectiveNames::scriptSrcElem);
     206    if (checkUnsafeHashes(operativeDirective, hashes)
     207        || checkInline(operativeDirective))
     208        return nullptr;
     209    return operativeDirective;
     210}
     211
     212const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineEventHandlers(const Vector<ContentSecurityPolicyHash>& hashes) const
     213{
     214    auto* operativeDirective = this->operativeDirectiveScript(m_scriptSrcAttr.get(), ContentSecurityPolicyDirectiveNames::scriptSrcAttr);
     215    if (checkUnsafeHashes(operativeDirective, hashes)
     216        || checkInline(operativeDirective))
     217        return nullptr;
     218    return operativeDirective;
     219}
     220
     221const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForNonParserInsertedScripts(const String& nonce, const Vector<ContentSecurityPolicyHash>& hashes, const URL& url, ParserInserted parserInserted) const
    210222{
    211223    auto* operativeDirective = this->operativeDirectiveScript(m_scriptSrcElem.get(), ContentSecurityPolicyDirectiveNames::scriptSrc);
    212     if (checkNonParserInsertedScripts(operativeDirective, parserInserted))
    213         return nullptr;
    214 
    215     return operativeDirective;
    216 }
    217 
    218 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement() const
    219 {
    220     auto* operativeDirective = this->operativeDirectiveScript(m_scriptSrcElem.get(), ContentSecurityPolicyDirectiveNames::scriptSrcElem);
    221     if (checkInline(operativeDirective))
    222         return nullptr;
    223     return operativeDirective;
    224 }
    225 
    226 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptAttribute() const
    227 {
    228     auto* operativeDirective = this->operativeDirectiveScript(m_scriptSrcAttr.get(), ContentSecurityPolicyDirectiveNames::scriptSrcAttr);
    229     if (checkInline(operativeDirective))
    230         return nullptr;
    231     return operativeDirective;
    232 }
    233 
    234 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement() const
     224    if (checkHashes(operativeDirective, hashes)
     225        || checkNonParserInsertedScripts(operativeDirective, parserInserted)
     226        || checkNonce(operativeDirective, nonce)
     227        || checkSource(operativeDirective, url))
     228        return nullptr;
     229    return operativeDirective;
     230}
     231
     232const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement(const String& nonce, const Vector<ContentSecurityPolicyHash>& hashes) const
    235233{
    236234    auto* operativeDirective = this->operativeDirectiveStyle(m_styleSrcElem.get(), ContentSecurityPolicyDirectiveNames::styleSrcElem);
    237     if (checkInline(operativeDirective))
    238         return nullptr;
    239     return operativeDirective;
    240 }
    241 
    242 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute() const
     235    if (checkHashes(operativeDirective, hashes)
     236        || checkNonce(operativeDirective, nonce)
     237        || checkInline(operativeDirective))
     238        return nullptr;
     239    return operativeDirective;
     240}
     241
     242const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute(const String& nonce, const Vector<ContentSecurityPolicyHash>& hashes) const
    243243{
    244244    auto* operativeDirective = this->operativeDirectiveStyle(m_styleSrcAttr.get(), ContentSecurityPolicyDirectiveNames::styleSrcAttr);
    245     if (checkInline(operativeDirective))
    246         return nullptr;
    247     return operativeDirective;
    248 }
    249 
    250 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash(const Vector<ContentSecurityPolicyHash>& hashes) const
    251 {
    252     auto* operativeDirective = this->operativeDirective(m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc);
    253     if (checkHashes(operativeDirective, hashes))
    254         return nullptr;
    255     return operativeDirective;
    256 }
    257 
    258 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleHash(const Vector<ContentSecurityPolicyHash>& hashes) const
    259 {
    260     auto* operativeDirective = this->operativeDirective(m_styleSrc.get(), ContentSecurityPolicyDirectiveNames::styleSrc);
    261     if (checkHashes(operativeDirective, hashes))
     245    if (checkUnsafeHashes(operativeDirective, hashes)
     246        || checkNonce(operativeDirective, nonce)
     247        || checkInline(operativeDirective))
    262248        return nullptr;
    263249    return operativeDirective;
    … …  
    388374}
    389375
    390 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForScript(const URL& url, bool didReceiveRedirectResponse, const Vector<ResourceCryptographicDigest>& subResourceIntegrityDigests) const
     376const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForScript(const URL& url, bool didReceiveRedirectResponse, const Vector<ResourceCryptographicDigest>& subResourceIntegrityDigests, const String& nonce) const
    391377{
    392378    auto* operativeDirective = this->operativeDirective(m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrcElem);
    393379
    394     if (!operativeDirective || operativeDirective->containsAllHashes(subResourceIntegrityDigests))
    395         return nullptr;
    396 
    397     if (checkSource(operativeDirective, url, didReceiveRedirectResponse))
    398         return nullptr;
    399     return operativeDirective;
    400 }
    401 
    402 const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle(const URL& url, bool didReceiveRedirectResponse) const
     380    if (!operativeDirective
     381        || operativeDirective->containsAllHashes(subResourceIntegrityDigests)
     382        || checkNonce(operativeDirective, nonce)
     383        || checkSource(operativeDirective, url, didReceiveRedirectResponse))
     384        return nullptr;
     385
     386    return operativeDirective;
     387}
     388
     389const ContentSecurityPolicyDirective* ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle(const URL& url, bool didReceiveRedirectResponse, const String& nonce) const
    403390{
    404391    auto* operativeDirective = this->operativeDirective(m_styleSrc.get(), ContentSecurityPolicyDirectiveNames::styleSrcElem);
    405     if (checkSource(operativeDirective, url, didReceiveRedirectResponse))
     392    if (checkNonce(operativeDirective, nonce)
     393        || checkSource(operativeDirective, url, didReceiveRedirectResponse))
    406394        return nullptr;
    407395    return operativeDirective;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.h

    r286853 r288132  
    4747
    4848    const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeEval() const;
    49     const ContentSecurityPolicyDirective* violatedDirectiveForParserInsertedScript(ParserInserted) const;
    50     const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineScriptElement() const;
    51     const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineScriptAttribute() const;
    52     const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineStyleElement() const;
    53     const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineStyleAttribute() const;
    54 
    55     const ContentSecurityPolicyDirective* violatedDirectiveForScriptHash(const Vector<ContentSecurityPolicyHash>&) const;
    56     const ContentSecurityPolicyDirective* violatedDirectiveForStyleHash(const Vector<ContentSecurityPolicyHash>&) const;
    57     const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeHashScript(const Vector<ContentSecurityPolicyHash>&) const;
    58     const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeHashStyle(const Vector<ContentSecurityPolicyHash>&) const;
     49    const ContentSecurityPolicyDirective* violatedDirectiveForInlineJavascriptURL(const Vector<ContentSecurityPolicyHash>&) const;
     50    const ContentSecurityPolicyDirective* violatedDirectiveForInlineEventHandlers(const Vector<ContentSecurityPolicyHash>&) const;
     51    const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineScriptElement(const String&, const Vector<ContentSecurityPolicyHash>&) const;
     52    const ContentSecurityPolicyDirective* violatedDirectiveForNonParserInsertedScripts(const String&, const Vector<ContentSecurityPolicyHash>&, const URL&, ParserInserted) const;
     53    const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineStyleElement(const String&, const Vector<ContentSecurityPolicyHash>&) const;
     54    const ContentSecurityPolicyDirective* violatedDirectiveForUnsafeInlineStyleAttribute(const String&, const Vector<ContentSecurityPolicyHash>&) const;
    5955
    6056    const ContentSecurityPolicyDirective* violatedDirectiveForScriptNonce(const String&) const;
    … …  
    7672    const ContentSecurityPolicyDirective* violatedDirectiveForObjectSource(const URL&, bool didReceiveRedirectResponse, ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone) const;
    7773    const ContentSecurityPolicyDirective* violatedDirectiveForPluginType(const String& type, const String& typeAttribute) const;
    78     const ContentSecurityPolicyDirective* violatedDirectiveForScript(const URL&, bool didReceiveRedirectResponse, const Vector<ResourceCryptographicDigest>&) const;
    79     const ContentSecurityPolicyDirective* violatedDirectiveForStyle(const URL&, bool didReceiveRedirectResponse) const;
     74    const ContentSecurityPolicyDirective* violatedDirectiveForScript(const URL&, bool didReceiveRedirectResponse, const Vector<ResourceCryptographicDigest>&, const String&) const;
     75    const ContentSecurityPolicyDirective* violatedDirectiveForStyle(const URL&, bool didReceiveRedirectResponse, const String&) const;
    8076
    8177    const ContentSecurityPolicyDirective* defaultSrc() const { return m_defaultSrc.get(); }
Note: See TracChangeset for help on using the changeset viewer.