Changeset 289022 in webkit


Ignore:
Timestamp:
Feb 2, 2022 6:17:13 PM (6 months ago)
Author:
Patrick Griffis
Message:

CSP: Implement wasm-unsafe-eval
​https://bugs.webkit.org/show_bug.cgi?id=235408

Reviewed by Kate Cheney.

LayoutTests/imported/w3c:

Update expectations with new passes.

  • web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any-expected.txt:
  • web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.serviceworker-expected.txt:
  • web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.worker-expected.txt:
  • web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any-expected.txt:
  • web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.serviceworker-expected.txt:
  • web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.worker-expected.txt:

Source/WebCore:

This is similar to 'unsafe-eval' except limited in scope to WebAssembly.

  • page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::checkWasmEval):
(WebCore::ContentSecurityPolicyDirectiveList::create):

  • page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::parseSource):

  • page/csp/ContentSecurityPolicySourceList.h:

(WebCore::ContentSecurityPolicySourceList::allowWasmEval const):

  • page/csp/ContentSecurityPolicySourceListDirective.h:

(WebCore::ContentSecurityPolicySourceListDirective::allowWasmEval const):

LayoutTests:

Update expectations with new CSP message.

  • http/tests/security/contentSecurityPolicy/WebAssembly-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-about-blank-iframe-expected.txt:
  • http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-external-script-expected.txt:
  • http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-subframe-expected.txt:
Location:
trunk
Files:
17 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r289021 r289022  
     12022-02-02  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Implement wasm-unsafe-eval
     4        https://bugs.webkit.org/show_bug.cgi?id=235408
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update expectations with new CSP message.
     9
     10        * http/tests/security/contentSecurityPolicy/WebAssembly-blocked-expected.txt:
     11        * http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-about-blank-iframe-expected.txt:
     12        * http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-external-script-expected.txt:
     13        * http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-subframe-expected.txt:
     14
    1152022-02-02  Patrick Griffis  <pgriffis@igalia.com>
    216

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/WebAssembly-blocked-expected.txt

    r288992 r289022  
    1 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     1CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    22
    3 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     3CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    44
    5 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     5CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    66
    7 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     7CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    88
    9 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     9CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    1010
    11 CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     11CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    1212 (evaluating 'new WebAssembly.Instance(new WebAssembly.Module(empty))')
    1313

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-about-blank-iframe-expected.txt

    r288992 r289022  
    11ALERT: /PASS/
    2 CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     2CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    33 (evaluating 'new WebAssembly.Instance(new WebAssembly.Module(Uint8Array.of(0x0, 0x61, 0x73, 0x6d, 0x1, 0x00, 0x00, 0x00)))')
    44 WebAssembly should be blocked in the iframe, but inline script should be allowed.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-external-script-expected.txt

    r288992 r289022  
    1 CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".
     1CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".
    22 (evaluating 'new WebAssembly.Instance(new WebAssembly.Module(Uint8Array.of(0x0, 0x61, 0x73, 0x6d, 0x1, 0x00, 0x00, 0x00)))')
    33

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-subframe-expected.txt

    r288992 r289022  
    1 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     1CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    22
    3 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     3CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    44
    5 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     5CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    66
    7 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     7CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    88
    9 CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     9CONSOLE MESSAGE: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    1010
    11 CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
     11CONSOLE MESSAGE: CompileError: Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
    1212 (evaluating 'new WebAssembly.Instance(new WebAssembly.Module(empty))')
    1313Tests that WebAssembly is blocked in a subframe that disallows WebAssembly when the parent frame allows WebAssembly.

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r289021 r289022  
     12022-02-02  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Implement wasm-unsafe-eval
     4        https://bugs.webkit.org/show_bug.cgi?id=235408
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update expectations with new passes.
     9
     10        * web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any-expected.txt:
     11        * web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.serviceworker-expected.txt:
     12        * web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.worker-expected.txt:
     13        * web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any-expected.txt:
     14        * web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.serviceworker-expected.txt:
     15        * web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.worker-expected.txt:
     16
    1172022-02-02  Patrick Griffis  <pgriffis@igalia.com>
    218

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any-expected.txt

    r288992 r289022  
    11
    2 FAIL default-src-wasm-unsafe-eval-allows-wasm promise_test: Unhandled rejection with value: object "CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'".
    3 "
     2PASS default-src-wasm-unsafe-eval-allows-wasm
    43

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.serviceworker-expected.txt

    r288992 r289022  
    11
    2 FAIL default-src-wasm-unsafe-eval-allows-wasm promise_test: Unhandled rejection with value: object "CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'".
    3 "
     2PASS default-src-wasm-unsafe-eval-allows-wasm
    43

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.worker-expected.txt

    r288992 r289022  
    11
    2 FAIL default-src-wasm-unsafe-eval-allows-wasm promise_test: Unhandled rejection with value: object "CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'".
    3 "
     2PASS default-src-wasm-unsafe-eval-allows-wasm
    43

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any-expected.txt

    r288992 r289022  
    11
    2 FAIL script-src-wasm-unsafe-eval-allows-wasm promise_test: Unhandled rejection with value: object "CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'".
    3 "
     2PASS script-src-wasm-unsafe-eval-allows-wasm
    43

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.serviceworker-expected.txt

    r288992 r289022  
    11
    2 FAIL script-src-wasm-unsafe-eval-allows-wasm promise_test: Unhandled rejection with value: object "CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'".
    3 "
     2PASS script-src-wasm-unsafe-eval-allows-wasm
    43

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.worker-expected.txt

    r288992 r289022  
    11
    2 FAIL script-src-wasm-unsafe-eval-allows-wasm promise_test: Unhandled rejection with value: object "CompileError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'".
    3 "
     2PASS script-src-wasm-unsafe-eval-allows-wasm
    43

  • trunk/Source/WebCore/ChangeLog

    r289021 r289022  
     12022-02-02  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        CSP: Implement wasm-unsafe-eval
     4        https://bugs.webkit.org/show_bug.cgi?id=235408
     5
     6        Reviewed by Kate Cheney.
     7
     8        This is similar to 'unsafe-eval' except limited in scope to WebAssembly.
     9
     10        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
     11        (WebCore::checkWasmEval):
     12        (WebCore::ContentSecurityPolicyDirectiveList::create):
     13        * page/csp/ContentSecurityPolicySourceList.cpp:
     14        (WebCore::ContentSecurityPolicySourceList::parseSource):
     15        * page/csp/ContentSecurityPolicySourceList.h:
     16        (WebCore::ContentSecurityPolicySourceList::allowWasmEval const):
     17        * page/csp/ContentSecurityPolicySourceListDirective.h:
     18        (WebCore::ContentSecurityPolicySourceListDirective::allowWasmEval const):
     19
    1202022-02-02  Patrick Griffis  <pgriffis@igalia.com>
    221

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp

    r288701 r289022  
    5252}
    5353
     54static inline bool checkWasmEval(ContentSecurityPolicySourceListDirective* directive)
     55{
     56    return !directive || directive->allowWasmEval();
     57}
     58
    5459static inline bool checkInline(ContentSecurityPolicySourceListDirective* directive)
    5560{
    … …  
    141146    directives->parse(header, from);
    142147
    143     if (!checkEval(directives->operativeDirective(directives->m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc))) {
     148    if (!checkEval(directives->operativeDirective(directives->m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc)))
    144149        directives->setEvalDisabledErrorMessage(makeString("Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"", directives->operativeDirective(directives->m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc)->text(), "\".\n"));
    145         directives->setWebAssemblyDisabledErrorMessage(makeString("Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"", directives->operativeDirective(directives->m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc)->text(), "\".\n"));
    146     }
     150
     151    if (!checkWasmEval(directives->operativeDirective(directives->m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc)))
     152        directives->setWebAssemblyDisabledErrorMessage(makeString("Refused to create a WebAssembly object because 'unsafe-eval' or 'wasm-unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"", directives->operativeDirective(directives->m_scriptSrc.get(), ContentSecurityPolicyDirectiveNames::scriptSrc)->text(), "\".\n"));
    147153
    148154    if (directives->isReportOnly() && directives->reportURIs().isEmpty())

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp

    r287783 r289022  
    254254    if (skipExactlyIgnoringASCIICase(buffer, "'unsafe-eval'")) {
    255255        m_allowEval = true;
    256         return source;
    257     }
    258    
     256        m_allowWasmEval = true;
     257        return source;
     258    }
     259
     260    if (skipExactlyIgnoringASCIICase(buffer, "'wasm-unsafe-eval'")) {
     261        m_allowWasmEval = true;
     262        return source;
     263    }
     264
    259265    if (skipExactlyIgnoringASCIICase(buffer, "'unsafe-hashes'")) {
    260266        m_allowUnsafeHashes = true;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceList.h

    r286853 r289022  
    5353    bool allowInline() const { return m_allowInline && m_hashes.isEmpty() && m_nonces.isEmpty(); }
    5454    bool allowEval() const { return m_allowEval; }
     55    bool allowWasmEval() const { return m_allowWasmEval; }
    5556    bool allowSelf() const { return m_allowSelf; }
    5657    bool isNone() const { return m_isNone; }
    … …  
    9697    bool m_allowInline { false };
    9798    bool m_allowEval { false };
     99    bool m_allowWasmEval { false };
    98100    bool m_isNone { false };
    99101    bool m_allowNonParserInsertedScripts { false };

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicySourceListDirective.h

    r286853 r289022  
    4646    bool allowInline() const { return m_sourceList.allowInline(); }
    4747    bool allowEval() const { return m_sourceList.allowEval(); }
     48    bool allowWasmEval() const { return m_sourceList.allowWasmEval(); }
    4849    bool allowNonParserInsertedScripts() const { return m_sourceList.allowNonParserInsertedScripts(); }
    4950    bool shouldReportSample() const { return m_sourceList.shouldReportSample(); }
Note: See TracChangeset for help on using the changeset viewer.