Changeset 199605 in webkit


Ignore:
Timestamp:
Apr 15, 2016, 12:49:58 PM (9 years ago)
Author:
Brent Fulgham
Message:

Remove support for X-Frame-Options in <meta>
​https://bugs.webkit.org/show_bug.cgi?id=156625
<rdar://problem/25748714>

Reviewed by Darin Adler.

Source/WebCore:

Follow RFC7034 (Section 4), which recommends that 'X-Frame-Options' be ignored when delivered as part of
a '<meta http-equiv="...">' tag. This brings us in line with Firefox, Edge, and Blink.

Tests: http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html

http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html

  • dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Log error message instead of blocking the load.

LayoutTests:

Revise tests to match our desired behavior based on RFC 7034 (Section 4).

  • http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html:
  • http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html:
  • http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html:
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow-expected.txt: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html: Removed.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-expected.txt: Added.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body-expected.txt: Added.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow-expected.txt: Added.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny-expected.txt: Added.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html.
  • http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html.
  • http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-expected.txt: Removed.
  • http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored-expected.txt: Added.
  • http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html: Copied from LayoutTests/http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html.
  • http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html: Removed.
  • inspector/console/x-frame-options-message-expected.txt: Rebaselined.
  • platform/win/TestExpectations:
Location:
trunk
Files:
5 added
5 deleted
8 edited
5 moved

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r199604 r199605  
     12016-04-15  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Remove support for X-Frame-Options in `<meta>`
     4        https://bugs.webkit.org/show_bug.cgi?id=156625
     5        <rdar://problem/25748714>
     6
     7        Reviewed by Darin Adler.
     8
     9        Revise tests to match our desired behavior based on RFC 7034 (Section 4).
     10
     11        * http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html:
     12        * http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html:
     13        * http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html:
     14        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt: Removed.
     15        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt: Removed.
     16        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html: Removed.
     17        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow-expected.txt: Removed.
     18        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html: Removed.
     19        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt: Removed.
     20        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html: Removed.
     21        * http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html: Removed.
     22        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-expected.txt: Added.
     23        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body-expected.txt: Added.
     24        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html.
     25        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow-expected.txt: Added.
     26        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html.
     27        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny-expected.txt: Added.
     28        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html.
     29        * http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html.
     30        * http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-expected.txt: Removed.
     31        * http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored-expected.txt: Added.
     32        * http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html: Copied from LayoutTests/http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html.
     33        * http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html: Removed.
     34        * inspector/console/x-frame-options-message-expected.txt: Rebaselined.
     35        * platform/win/TestExpectations:
     36
    1372016-04-15  Jiewen Tan  <jiewen_tan@apple.com>
    238

  • trunk/LayoutTests/http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html

    r42333 r199605  
    33</head>
    44<body>
    5     <p>FAIL: This should show up and disappear immediately.</p>
     5    <p>PASS: This should be displayed.</p>
    66    <meta http-equiv="x-frame-options" content="deny" />
    7     <p>FAIL: This should never show up.</p>
     7    <p>PASS: This should also be displayed.</p>
    88</body>
    99</html>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html

    r42333 r199605  
    44</head>
    55<body>
    6     <p>FAIL: This should not show up as the parent is not in the same origin.</p>
     6    <p>PASS: This should show up even though the parent is not in the same origin because we should be ignoring the meta tag.</p>
    77</body>
    88</html>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html

    r42333 r199605  
    44</head>
    55<body>
    6     <p>FAIL: This should not show up.</p>
     6    <p>PASS: This should be displayed.</p>
    77</body>
    88</html>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html

    r199570 r199605  
    1111
    1212        if (!url)
    13             console.log("PASS: Could not read contentWindow.location.href");
     13            console.log("FAIL: Could not read contentWindow.location.href");
    1414        else
    15             console.log("FAIL: Could read contentWindow.location.href");
     15            console.log("PASS: Could read contentWindow.location.href");
    1616        testRunner.notifyDone();
    1717    }
    1818</script>
    1919
    20 <p>There should be no content in the iframe below</p>
     20<p>There should be content in the iframe below</p>
    2121<iframe style="width:500px; height:500px" src="http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html" onload="checkIfDone()"></iframe>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html

    r199570 r199605  
    1111
    1212        if (!url)
    13             console.log("PASS: Could not read contentWindow.location.href");
     13            console.log("FAIL: Could not read contentWindow.location.href");
    1414        else
    15             console.log("FAIL: Could read contentWindow.location.href");
     15            console.log("PASS: Could read contentWindow.location.href");
    1616        testRunner.notifyDone();
    1717    }
    1818</script>
    1919
    20 <p>There should be no content in the iframe below</p>
     20<p>There should be content in the iframe below</p>
    2121<iframe style="width:500px; height:500px" src="http://localhost:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html" onload="checkIfDone()"></iframe>

  • trunk/LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html

    r199570 r199605  
    1111
    1212        if (!url)
    13             console.log("PASS: Could not read contentWindow.location.href");
     13            console.log("FAIL: Could not read contentWindow.location.href");
    1414        else
    15             console.log("FAIL: Could read contentWindow.location.href");
     15            console.log("PASS: Could read contentWindow.location.href");
    1616        testRunner.notifyDone();
    1717    }
    1818</script>
    1919
    20 <p>There should be no content in the iframe below</p>
     20<p>There should be content in the iframe below</p>
    2121<iframe style="width:500px; height:500px" src="http://127.0.0.1:8000/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html" onload="checkIfDone()"></iframe>

  • trunk/LayoutTests/inspector/console/x-frame-options-message-expected.txt

    r188598 r199605  
    1 CONSOLE MESSAGE: line 41: Refused to display 'x-frame-options-message.html' in a frame because it set 'X-Frame-Options' to 'deny'.
     1CONSOLE MESSAGE: line 41: X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.
    22
    33

  • trunk/LayoutTests/platform/win/TestExpectations

    r199585 r199605  
    21852185webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-deny.html [ Failure ]
    21862186webkit.org/b/140703 [ Debug ] http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html [ Crash ]
    2187 webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html [ Failure ]
    2188 webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html [ Crash Failure ]
    2189 webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html [ Crash Failure ]
    2190 webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html [ Crash Failure ]
     2187webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html [ Failure ]
     2188webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html [ Crash Failure ]
     2189webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html [ Crash Failure ]
     2190webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html [ Crash Failure ]
    21912191webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-invalid.html [ Failure ]
    21922192webkit.org/b/140703 http/tests/security/XFrameOptions/x-frame-options-multiple-headers-conflict.html [ Failure ]

  • trunk/Source/WebCore/ChangeLog

    r199603 r199605  
     12016-04-15  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Remove support for X-Frame-Options in `<meta>`
     4        https://bugs.webkit.org/show_bug.cgi?id=156625
     5        <rdar://problem/25748714>
     6
     7        Reviewed by Darin Adler.
     8
     9        Follow RFC7034 (Section 4), which recommends that 'X-Frame-Options' be ignored when delivered as part of
     10        a '<meta http-equiv="...">' tag. This brings us in line with Firefox, Edge, and Blink.
     11
     12        Tests: http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html
     13               http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html
     14               http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html
     15               http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html
     16               http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html
     17
     18        * dom/Document.cpp:
     19        (WebCore::Document::processHttpEquiv): Log error message instead of blocking the load.
     20
    1212016-04-15  Jer Noble  <jer.noble@apple.com>
    222

  • trunk/Source/WebCore/dom/Document.cpp

    r199538 r199605  
    33053305            if (frameLoader.activeDocumentLoader() && frameLoader.activeDocumentLoader()->mainResourceLoader())
    33063306                requestIdentifier = frameLoader.activeDocumentLoader()->mainResourceLoader()->identifier();
    3307             if (frameLoader.shouldInterruptLoadForXFrameOptions(content, url(), requestIdentifier)) {
    3308                 String message = "Refused to display '" + url().stringCenterEllipsizedToLength() + "' in a frame because it set 'X-Frame-Options' to '" + content + "'.";
    3309                 frameLoader.stopAllLoaders();
    3310                 // Stopping the loader isn't enough, as we're already parsing the document; to honor the header's
    3311                 // intent, we must navigate away from the possibly partially-rendered document to a location that
    3312                 // doesn't inherit the parent's SecurityOrigin.
    3313                 frame->navigationScheduler().scheduleLocationChange(this, securityOrigin(), SecurityOrigin::urlWithUniqueSecurityOrigin(), String());
    3314                 addConsoleMessage(MessageSource::Security, MessageLevel::Error, message, requestIdentifier);
    3315             }
     3307
     3308            addConsoleMessage(MessageSource::Security, MessageLevel::Error, "X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.", requestIdentifier);
    33163309        }
    33173310        break;
Note: See TracChangeset for help on using the changeset viewer.