Changeset 285478 in webkit


Ignore:
Timestamp:
Nov 8, 2021, 6:26:15 PM (4 years ago)
Author:
Patrick Griffis
Message:

Implement nonce-hiding
​https://bugs.webkit.org/show_bug.cgi?id=179728

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

Update all nonce-hiding expectations as passing.
Update reflection-misc as script.nonce not being reflected, this matches Chromiums results.

  • web-platform-tests/content-security-policy/nonce-hiding/nonces-expected.txt:
  • web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-expected.txt:
  • web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub-expected.txt:
  • web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-expected.txt:
  • web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub-expected.txt:
  • web-platform-tests/html/dom/idlharness.https-expected.txt:
  • web-platform-tests/html/dom/reflection-misc-expected.txt:

Source/WebCore:

This is a hardening technique implemented by both Firefox and Chromium.

The behavior is documented here: ​https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes

  • dom/Element.cpp:

(WebCore::Element::nonce const):
(WebCore::Element::setNonce):
(WebCore::Element::hideNonce):
(WebCore::Element::attributeChanged):
(WebCore::Element::cloneAttributesFromElement):

  • dom/Element.h:
  • dom/ElementRareData.cpp:
  • dom/ElementRareData.h:

(WebCore::ElementRareData::nonce const):
(WebCore::ElementRareData::setNonce):
(WebCore::ElementRareData::useTypes const):

  • dom/InlineClassicScript.cpp:

(WebCore::InlineClassicScript::create):

  • dom/InlineStyleSheetOwner.cpp:

(WebCore::InlineStyleSheetOwner::createSheet):

  • dom/NodeRareData.h:
  • dom/ScriptElement.cpp:

(WebCore::ScriptElement::requestClassicScript):
(WebCore::ScriptElement::requestModuleScript):
(WebCore::ScriptElement::executeClassicScript):

  • html/HTMLElement.cpp:

(WebCore::HTMLElement::insertedIntoAncestor):

  • html/HTMLElement.h:
  • html/HTMLOrForeignElement.idl:
  • html/HTMLScriptElement.idl:
  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::didReceiveHeader):

  • page/csp/ContentSecurityPolicy.h:

(WebCore::ContentSecurityPolicy::isHeaderDelivered const):

  • svg/SVGElement.cpp:

(WebCore::SVGElement::insertedIntoAncestor):

LayoutTests:

Update expectations for nonce IDL as PASSing.

  • platform/gtk/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
  • platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
  • platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt:
  • platform/ipad/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
  • platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
  • platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt:
  • platform/wpe/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
Location:
trunk
Files:
33 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r285449 r285478  
     12021-11-08  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        Implement nonce-hiding
     4        https://bugs.webkit.org/show_bug.cgi?id=179728
     5
     6        Reviewed by Chris Dumez.
     7
     8        Update expectations for nonce IDL as PASSing.
     9
     10        * platform/gtk/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
     11        * platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
     12        * platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt:
     13        * platform/ipad/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
     14        * platform/mac-wk1/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
     15        * platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
     16        * platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt:
     17        * platform/wpe/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
     18
    1192021-11-08  Chris Dumez  <cdumez@apple.com>
    220

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r285428 r285478  
     12021-11-08  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        Implement nonce-hiding
     4        https://bugs.webkit.org/show_bug.cgi?id=179728
     5
     6        Reviewed by Chris Dumez.
     7
     8        Update all nonce-hiding expectations as passing.
     9        Update reflection-misc as script.nonce not being reflected, this matches Chromiums results.
     10
     11        * web-platform-tests/content-security-policy/nonce-hiding/nonces-expected.txt:
     12        * web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-expected.txt:
     13        * web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub-expected.txt:
     14        * web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-expected.txt:
     15        * web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub-expected.txt:
     16        * web-platform-tests/html/dom/idlharness.https-expected.txt:
     17        * web-platform-tests/html/dom/reflection-misc-expected.txt:
     18
    1192021-11-08  Chris Dumez  <cdumez@apple.com>
    220

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/nonces-expected.txt

    r267651 r285478  
    11
    2 FAIL Basic nonce tests for meh in HTML namespace assert_equals: Initial IDL attribute value expected (string) "" but got (undefined) undefined
    3 FAIL Ensure that removal of content attribute does not affect IDL attribute for meh in HTML namespace assert_equals: IDL attribute is modified after content attribute set expected (string) "x" but got (undefined) undefined
    4 FAIL Test empty nonces for meh in HTML namespace assert_equals: expected (string) "" but got (undefined) undefined
    5 FAIL Basic nonce tests for div in HTML namespace assert_equals: Initial IDL attribute value expected (string) "" but got (undefined) undefined
    6 FAIL Ensure that removal of content attribute does not affect IDL attribute for div in HTML namespace assert_equals: IDL attribute is modified after content attribute set expected (string) "x" but got (undefined) undefined
    7 FAIL Test empty nonces for div in HTML namespace assert_equals: expected (string) "" but got (undefined) undefined
    8 FAIL Basic nonce tests for script in HTML namespace assert_equals: Content attribute is changed after element insertion expected "" but got "x"
     2PASS Basic nonce tests for meh in HTML namespace
     3PASS Ensure that removal of content attribute does not affect IDL attribute for meh in HTML namespace
     4PASS Test empty nonces for meh in HTML namespace
     5PASS Basic nonce tests for div in HTML namespace
     6PASS Ensure that removal of content attribute does not affect IDL attribute for div in HTML namespace
     7PASS Test empty nonces for div in HTML namespace
     8PASS Basic nonce tests for script in HTML namespace
    99PASS Ensure that removal of content attribute does not affect IDL attribute for script in HTML namespace
    1010PASS Test empty nonces for script in HTML namespace
    11 FAIL Basic nonce tests for meh in SVG namespace assert_equals: Initial IDL attribute value expected (string) "" but got (undefined) undefined
    12 FAIL Ensure that removal of content attribute does not affect IDL attribute for meh in SVG namespace assert_equals: IDL attribute is modified after content attribute set expected (string) "x" but got (undefined) undefined
    13 FAIL Test empty nonces for meh in SVG namespace assert_equals: expected (string) "" but got (undefined) undefined
    14 FAIL Basic nonce tests for svg in SVG namespace assert_equals: Initial IDL attribute value expected (string) "" but got (undefined) undefined
    15 FAIL Ensure that removal of content attribute does not affect IDL attribute for svg in SVG namespace assert_equals: IDL attribute is modified after content attribute set expected (string) "x" but got (undefined) undefined
    16 FAIL Test empty nonces for svg in SVG namespace assert_equals: expected (string) "" but got (undefined) undefined
    17 FAIL Basic nonce tests for script in SVG namespace assert_equals: Initial IDL attribute value expected (string) "" but got (undefined) undefined
    18 FAIL Ensure that removal of content attribute does not affect IDL attribute for script in SVG namespace assert_equals: IDL attribute is modified after content attribute set expected (string) "x" but got (undefined) undefined
    19 FAIL Test empty nonces for script in SVG namespace assert_equals: expected (string) "" but got (undefined) undefined
     11PASS Basic nonce tests for meh in SVG namespace
     12PASS Ensure that removal of content attribute does not affect IDL attribute for meh in SVG namespace
     13PASS Test empty nonces for meh in SVG namespace
     14PASS Basic nonce tests for svg in SVG namespace
     15PASS Ensure that removal of content attribute does not affect IDL attribute for svg in SVG namespace
     16PASS Test empty nonces for svg in SVG namespace
     17PASS Basic nonce tests for script in SVG namespace
     18PASS Ensure that removal of content attribute does not affect IDL attribute for script in SVG namespace
     19PASS Test empty nonces for script in SVG namespace
    2020

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-expected.txt

    r267651 r285478  
    11
    2 FAIL Reading 'nonce' content attribute and IDL attribute. assert_equals: expected Element node <script nonce="abc" id="testScript" executed="yay">
    3   doc... but got null
    4 FAIL Cloned node retains nonce. assert_equals: expected "" but got "abc"
    5 FAIL Cloned node retains nonce when inserted. assert_equals: expected "" but got "abc"
     2PASS Reading 'nonce' content attribute and IDL attribute.
     3PASS Cloned node retains nonce.
     4PASS Cloned node retains nonce when inserted.
    65PASS Writing 'nonce' content attribute.
    7 FAIL Writing 'nonce' IDL attribute. assert_equals: expected "foo" but got "bar"
     6PASS Writing 'nonce' IDL attribute.
    87PASS Document-written script executes.
    9 FAIL Document-written script's nonce value. assert_equals: expected "" but got "abc"
    10 FAIL createElement.nonce. assert_equals: expected (object) null but got (string) "abc"
    11 FAIL setAttribute('nonce') overwrites '.nonce' upon insertion. assert_equals: expected "" but got "abc"
    12 FAIL createElement.setAttribute. assert_equals: Post-insertion content expected "" but got "abc"
    13 FAIL Custom elements expose the correct events. assert_object_equals: AttributeChanged 2 value is undefined, expected object
    14 FAIL Nonces don't leak via CSS side-channels. assert_equals: expected "none" but got "url(\"http://localhost:8800/security/resources/abe.png\")"
     8PASS Document-written script's nonce value.
     9PASS createElement.nonce.
     10PASS setAttribute('nonce') overwrites '.nonce' upon insertion.
     11PASS createElement.setAttribute.
     12PASS Custom elements expose the correct events.
     13PASS Nonces don't leak via CSS side-channels.
    1514

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub-expected.txt

    r267651 r285478  
    44PASS Cloned node retains nonce when inserted.
    55PASS Writing 'nonce' content attribute.
    6 FAIL Writing 'nonce' IDL attribute. assert_equals: expected "foo" but got "bar"
     6PASS Writing 'nonce' IDL attribute.
    77PASS Document-written script executes.
    88PASS Document-written script's nonce value.
    9 FAIL createElement.nonce. assert_equals: expected (object) null but got (string) "abc"
     9PASS createElement.nonce.
    1010PASS setAttribute('nonce') overwrites '.nonce' upon insertion.
    1111PASS createElement.setAttribute.

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-expected.txt

    r267651 r285478  
    11
    22
    3 FAIL Reading 'nonce' content attribute and IDL attribute. assert_equals: expected Element node <script nonce="abc" id="testScript" executed="yay">
    4     d... but got null
    5 FAIL Cloned node retains nonce. assert_equals: IDL attribute expected (string) "abc" but got (undefined) undefined
    6 FAIL Cloned node retains nonce when inserted. assert_equals: expected (string) "abc" but got (undefined) undefined
    7 FAIL Writing 'nonce' content attribute. assert_equals: expected (string) "foo" but got (undefined) undefined
     3PASS Reading 'nonce' content attribute and IDL attribute.
     4PASS Cloned node retains nonce.
     5PASS Cloned node retains nonce when inserted.
     6PASS Writing 'nonce' content attribute.
    87PASS Writing 'nonce' IDL attribute.
    98PASS Document-written script executes.
    10 FAIL Document-written script's nonce value. assert_equals: expected "" but got "abc"
    11 FAIL createElement.nonce. assert_equals: expected (object) null but got (string) "abc"
    12 FAIL createElement.setAttribute. assert_equals: Post-insertion content expected "" but got "abc"
     9PASS Document-written script's nonce value.
     10PASS createElement.nonce.
     11PASS createElement.setAttribute.
    1312

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub-expected.txt

    r267651 r285478  
    11 undefined
    22
    3 FAIL Reading 'nonce' content attribute and IDL attribute. assert_equals: expected (string) "abc" but got (undefined) undefined
    4 FAIL Cloned node retains nonce. assert_equals: IDL attribute expected (string) "abc" but got (undefined) undefined
    5 FAIL Cloned node retains nonce when inserted. assert_equals: expected (string) "abc" but got (undefined) undefined
    6 FAIL Writing 'nonce' content attribute. assert_equals: expected (string) "foo" but got (undefined) undefined
     3PASS Reading 'nonce' content attribute and IDL attribute.
     4PASS Cloned node retains nonce.
     5PASS Cloned node retains nonce when inserted.
     6PASS Writing 'nonce' content attribute.
    77PASS Writing 'nonce' IDL attribute.
    88PASS Document-written script executes.
    9 FAIL Document-written script's nonce value. assert_equals: expected (string) "abc" but got (undefined) undefined
     9PASS Document-written script's nonce value.
    1010PASS createElement.nonce.
    1111PASS createElement.setAttribute.

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r281569 r285478  
    197197PASS HTMLElement interface: attribute inputMode
    198198PASS HTMLElement interface: attribute dataset
    199 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     199PASS HTMLElement interface: attribute nonce
    200200FAIL HTMLElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    201201PASS HTMLElement interface: attribute tabIndex
    … …  
    287287PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    288288PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    289 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     289PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    290290FAIL HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type assert_inherits: property "autofocus" not found in prototype chain
    291291PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    50975097PASS SVGElement interface: attribute onpaste
    50985098PASS SVGElement interface: attribute dataset
    5099 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5099PASS SVGElement interface: attribute nonce
    51005100FAIL SVGElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    51015101PASS SVGElement interface: attribute tabIndex

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt

    r284960 r285478  
    968968PASS script.nonce: setAttribute() to object "test-toString"
    969969PASS script.nonce: setAttribute() to object "test-valueOf"
    970 PASS script.nonce: IDL set to ""
    971 PASS script.nonce: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo "
    972 PASS script.nonce: IDL set to undefined
    973 PASS script.nonce: IDL set to 7
    974 PASS script.nonce: IDL set to 1.5
    975 PASS script.nonce: IDL set to "5%"
    976 PASS script.nonce: IDL set to "+100"
    977 PASS script.nonce: IDL set to ".5"
    978 PASS script.nonce: IDL set to true
    979 PASS script.nonce: IDL set to false
    980 PASS script.nonce: IDL set to object "[object Object]"
    981 PASS script.nonce: IDL set to NaN
    982 PASS script.nonce: IDL set to Infinity
    983 PASS script.nonce: IDL set to -Infinity
    984 PASS script.nonce: IDL set to "\0"
    985 PASS script.nonce: IDL set to null
    986 PASS script.nonce: IDL set to object "test-toString"
     970FAIL script.nonce: IDL set to "" assert_equals: getAttribute() expected "" but got "test-valueOf"
     971FAIL script.nonce: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " assert_equals: getAttribute() expected " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " but got "test-valueOf"
     972FAIL script.nonce: IDL set to undefined assert_equals: getAttribute() expected "undefined" but got "test-valueOf"
     973FAIL script.nonce: IDL set to 7 assert_equals: getAttribute() expected "7" but got "test-valueOf"
     974FAIL script.nonce: IDL set to 1.5 assert_equals: getAttribute() expected "1.5" but got "test-valueOf"
     975FAIL script.nonce: IDL set to "5%" assert_equals: getAttribute() expected "5%" but got "test-valueOf"
     976FAIL script.nonce: IDL set to "+100" assert_equals: getAttribute() expected "+100" but got "test-valueOf"
     977FAIL script.nonce: IDL set to ".5" assert_equals: getAttribute() expected ".5" but got "test-valueOf"
     978FAIL script.nonce: IDL set to true assert_equals: getAttribute() expected "true" but got "test-valueOf"
     979FAIL script.nonce: IDL set to false assert_equals: getAttribute() expected "false" but got "test-valueOf"
     980FAIL script.nonce: IDL set to object "[object Object]" assert_equals: getAttribute() expected "[object Object]" but got "test-valueOf"
     981FAIL script.nonce: IDL set to NaN assert_equals: getAttribute() expected "NaN" but got "test-valueOf"
     982FAIL script.nonce: IDL set to Infinity assert_equals: getAttribute() expected "Infinity" but got "test-valueOf"
     983FAIL script.nonce: IDL set to -Infinity assert_equals: getAttribute() expected "-Infinity" but got "test-valueOf"
     984FAIL script.nonce: IDL set to "\0" assert_equals: getAttribute() expected "\0" but got "test-valueOf"
     985FAIL script.nonce: IDL set to null assert_equals: getAttribute() expected "null" but got "test-valueOf"
     986FAIL script.nonce: IDL set to object "test-toString" assert_equals: getAttribute() expected "test-toString" but got "test-valueOf"
    987987PASS script.nonce: IDL set to object "test-valueOf"
    988988PASS script.integrity: typeof IDL attribute

  • trunk/LayoutTests/platform/gtk/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r285011 r285478  
    335335PASS HTMLElement interface: attribute inputMode
    336336PASS HTMLElement interface: attribute dataset
    337 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     337PASS HTMLElement interface: attribute nonce
    338338PASS HTMLElement interface: attribute autofocus
    339339PASS HTMLElement interface: attribute tabIndex
    … …  
    430430PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    431431PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    432 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     432PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    433433PASS HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type
    434434PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    53365336PASS SVGElement interface: attribute onpaste
    53375337PASS SVGElement interface: attribute dataset
    5338 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5338PASS SVGElement interface: attribute nonce
    53395339PASS SVGElement interface: attribute autofocus
    53405340PASS SVGElement interface: attribute tabIndex

  • trunk/LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r282619 r285478  
    335335PASS HTMLElement interface: attribute inputMode
    336336PASS HTMLElement interface: attribute dataset
    337 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     337PASS HTMLElement interface: attribute nonce
    338338FAIL HTMLElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    339339PASS HTMLElement interface: attribute tabIndex
    … …  
    430430PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    431431PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    432 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     432PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    433433FAIL HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type assert_inherits: property "autofocus" not found in prototype chain
    434434PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    53265326PASS SVGElement interface: attribute onpaste
    53275327PASS SVGElement interface: attribute dataset
    5328 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5328PASS SVGElement interface: attribute nonce
    53295329FAIL SVGElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    53305330PASS SVGElement interface: attribute tabIndex

  • trunk/LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt

    r284960 r285478  
    968968PASS script.nonce: setAttribute() to object "test-toString"
    969969PASS script.nonce: setAttribute() to object "test-valueOf"
    970 PASS script.nonce: IDL set to ""
    971 PASS script.nonce: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo "
    972 PASS script.nonce: IDL set to undefined
    973 PASS script.nonce: IDL set to 7
    974 PASS script.nonce: IDL set to 1.5
    975 PASS script.nonce: IDL set to "5%"
    976 PASS script.nonce: IDL set to "+100"
    977 PASS script.nonce: IDL set to ".5"
    978 PASS script.nonce: IDL set to true
    979 PASS script.nonce: IDL set to false
    980 PASS script.nonce: IDL set to object "[object Object]"
    981 PASS script.nonce: IDL set to NaN
    982 PASS script.nonce: IDL set to Infinity
    983 PASS script.nonce: IDL set to -Infinity
    984 PASS script.nonce: IDL set to "\0"
    985 PASS script.nonce: IDL set to null
    986 PASS script.nonce: IDL set to object "test-toString"
     970FAIL script.nonce: IDL set to "" assert_equals: getAttribute() expected "" but got "test-valueOf"
     971FAIL script.nonce: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " assert_equals: getAttribute() expected " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " but got "test-valueOf"
     972FAIL script.nonce: IDL set to undefined assert_equals: getAttribute() expected "undefined" but got "test-valueOf"
     973FAIL script.nonce: IDL set to 7 assert_equals: getAttribute() expected "7" but got "test-valueOf"
     974FAIL script.nonce: IDL set to 1.5 assert_equals: getAttribute() expected "1.5" but got "test-valueOf"
     975FAIL script.nonce: IDL set to "5%" assert_equals: getAttribute() expected "5%" but got "test-valueOf"
     976FAIL script.nonce: IDL set to "+100" assert_equals: getAttribute() expected "+100" but got "test-valueOf"
     977FAIL script.nonce: IDL set to ".5" assert_equals: getAttribute() expected ".5" but got "test-valueOf"
     978FAIL script.nonce: IDL set to true assert_equals: getAttribute() expected "true" but got "test-valueOf"
     979FAIL script.nonce: IDL set to false assert_equals: getAttribute() expected "false" but got "test-valueOf"
     980FAIL script.nonce: IDL set to object "[object Object]" assert_equals: getAttribute() expected "[object Object]" but got "test-valueOf"
     981FAIL script.nonce: IDL set to NaN assert_equals: getAttribute() expected "NaN" but got "test-valueOf"
     982FAIL script.nonce: IDL set to Infinity assert_equals: getAttribute() expected "Infinity" but got "test-valueOf"
     983FAIL script.nonce: IDL set to -Infinity assert_equals: getAttribute() expected "-Infinity" but got "test-valueOf"
     984FAIL script.nonce: IDL set to "\0" assert_equals: getAttribute() expected "\0" but got "test-valueOf"
     985FAIL script.nonce: IDL set to null assert_equals: getAttribute() expected "null" but got "test-valueOf"
     986FAIL script.nonce: IDL set to object "test-toString" assert_equals: getAttribute() expected "test-toString" but got "test-valueOf"
    987987PASS script.nonce: IDL set to object "test-valueOf"
    988988PASS script.integrity: typeof IDL attribute

  • trunk/LayoutTests/platform/ipad/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r281569 r285478  
    335335PASS HTMLElement interface: attribute inputMode
    336336PASS HTMLElement interface: attribute dataset
    337 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     337PASS HTMLElement interface: attribute nonce
    338338FAIL HTMLElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    339339PASS HTMLElement interface: attribute tabIndex
    … …  
    430430PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    431431PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    432 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     432PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    433433FAIL HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type assert_inherits: property "autofocus" not found in prototype chain
    434434PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    53365336PASS SVGElement interface: attribute onpaste
    53375337PASS SVGElement interface: attribute dataset
    5338 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5338PASS SVGElement interface: attribute nonce
    53395339FAIL SVGElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    53405340PASS SVGElement interface: attribute tabIndex

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r285346 r285478  
    337337PASS HTMLElement interface: attribute inputMode
    338338PASS HTMLElement interface: attribute dataset
    339 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     339PASS HTMLElement interface: attribute nonce
    340340PASS HTMLElement interface: attribute autofocus
    341341PASS HTMLElement interface: attribute tabIndex
    … …  
    434434PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    435435PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    436 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     436PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    437437PASS HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type
    438438PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    53735373PASS SVGElement interface: attribute onpaste
    53745374PASS SVGElement interface: attribute dataset
    5375 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5375PASS SVGElement interface: attribute nonce
    53765376PASS SVGElement interface: attribute autofocus
    53775377PASS SVGElement interface: attribute tabIndex

  • trunk/LayoutTests/platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r284960 r285478  
    335335PASS HTMLElement interface: attribute inputMode
    336336PASS HTMLElement interface: attribute dataset
    337 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     337PASS HTMLElement interface: attribute nonce
    338338PASS HTMLElement interface: attribute autofocus
    339339PASS HTMLElement interface: attribute tabIndex
    … …  
    430430PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    431431PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    432 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     432PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    433433PASS HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type
    434434PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    53365336PASS SVGElement interface: attribute onpaste
    53375337PASS SVGElement interface: attribute dataset
    5338 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5338PASS SVGElement interface: attribute nonce
    53395339PASS SVGElement interface: attribute autofocus
    53405340PASS SVGElement interface: attribute tabIndex

  • trunk/LayoutTests/platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/reflection-misc-expected.txt

    r284960 r285478  
    968968PASS script.nonce: setAttribute() to object "test-toString"
    969969PASS script.nonce: setAttribute() to object "test-valueOf"
    970 PASS script.nonce: IDL set to ""
    971 PASS script.nonce: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo "
    972 PASS script.nonce: IDL set to undefined
    973 PASS script.nonce: IDL set to 7
    974 PASS script.nonce: IDL set to 1.5
    975 PASS script.nonce: IDL set to "5%"
    976 PASS script.nonce: IDL set to "+100"
    977 PASS script.nonce: IDL set to ".5"
    978 PASS script.nonce: IDL set to true
    979 PASS script.nonce: IDL set to false
    980 PASS script.nonce: IDL set to object "[object Object]"
    981 PASS script.nonce: IDL set to NaN
    982 PASS script.nonce: IDL set to Infinity
    983 PASS script.nonce: IDL set to -Infinity
    984 PASS script.nonce: IDL set to "\0"
    985 PASS script.nonce: IDL set to null
    986 PASS script.nonce: IDL set to object "test-toString"
     970FAIL script.nonce: IDL set to "" assert_equals: getAttribute() expected "" but got "test-valueOf"
     971FAIL script.nonce: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " assert_equals: getAttribute() expected " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " but got "test-valueOf"
     972FAIL script.nonce: IDL set to undefined assert_equals: getAttribute() expected "undefined" but got "test-valueOf"
     973FAIL script.nonce: IDL set to 7 assert_equals: getAttribute() expected "7" but got "test-valueOf"
     974FAIL script.nonce: IDL set to 1.5 assert_equals: getAttribute() expected "1.5" but got "test-valueOf"
     975FAIL script.nonce: IDL set to "5%" assert_equals: getAttribute() expected "5%" but got "test-valueOf"
     976FAIL script.nonce: IDL set to "+100" assert_equals: getAttribute() expected "+100" but got "test-valueOf"
     977FAIL script.nonce: IDL set to ".5" assert_equals: getAttribute() expected ".5" but got "test-valueOf"
     978FAIL script.nonce: IDL set to true assert_equals: getAttribute() expected "true" but got "test-valueOf"
     979FAIL script.nonce: IDL set to false assert_equals: getAttribute() expected "false" but got "test-valueOf"
     980FAIL script.nonce: IDL set to object "[object Object]" assert_equals: getAttribute() expected "[object Object]" but got "test-valueOf"
     981FAIL script.nonce: IDL set to NaN assert_equals: getAttribute() expected "NaN" but got "test-valueOf"
     982FAIL script.nonce: IDL set to Infinity assert_equals: getAttribute() expected "Infinity" but got "test-valueOf"
     983FAIL script.nonce: IDL set to -Infinity assert_equals: getAttribute() expected "-Infinity" but got "test-valueOf"
     984FAIL script.nonce: IDL set to "\0" assert_equals: getAttribute() expected "\0" but got "test-valueOf"
     985FAIL script.nonce: IDL set to null assert_equals: getAttribute() expected "null" but got "test-valueOf"
     986FAIL script.nonce: IDL set to object "test-toString" assert_equals: getAttribute() expected "test-toString" but got "test-valueOf"
    987987PASS script.nonce: IDL set to object "test-valueOf"
    988988PASS script.integrity: typeof IDL attribute

  • trunk/LayoutTests/platform/wpe/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt

    r284839 r285478  
    335335PASS HTMLElement interface: attribute inputMode
    336336PASS HTMLElement interface: attribute dataset
    337 FAIL HTMLElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     337PASS HTMLElement interface: attribute nonce
    338338FAIL HTMLElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    339339PASS HTMLElement interface: attribute tabIndex
    … …  
    430430PASS HTMLElement interface: document.createElement("noscript") must inherit property "inputMode" with the proper type
    431431PASS HTMLElement interface: document.createElement("noscript") must inherit property "dataset" with the proper type
    432 FAIL HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type assert_inherits: property "nonce" not found in prototype chain
     432PASS HTMLElement interface: document.createElement("noscript") must inherit property "nonce" with the proper type
    433433FAIL HTMLElement interface: document.createElement("noscript") must inherit property "autofocus" with the proper type assert_inherits: property "autofocus" not found in prototype chain
    434434PASS HTMLElement interface: document.createElement("noscript") must inherit property "tabIndex" with the proper type
    … …  
    53365336PASS SVGElement interface: attribute onpaste
    53375337PASS SVGElement interface: attribute dataset
    5338 FAIL SVGElement interface: attribute nonce assert_true: The prototype object must have a property "nonce" expected true got false
     5338PASS SVGElement interface: attribute nonce
    53395339FAIL SVGElement interface: attribute autofocus assert_true: The prototype object must have a property "autofocus" expected true got false
    53405340PASS SVGElement interface: attribute tabIndex

  • trunk/Source/WebCore/ChangeLog

    r285475 r285478  
     12021-11-08  Patrick Griffis  <pgriffis@igalia.com>
     2
     3        Implement nonce-hiding
     4        https://bugs.webkit.org/show_bug.cgi?id=179728
     5
     6        Reviewed by Chris Dumez.
     7
     8        This is a hardening technique implemented by both Firefox and Chromium.
     9
     10        The behavior is documented here: https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes
     11
     12        * dom/Element.cpp:
     13        (WebCore::Element::nonce const):
     14        (WebCore::Element::setNonce):
     15        (WebCore::Element::hideNonce):
     16        (WebCore::Element::attributeChanged):
     17        (WebCore::Element::cloneAttributesFromElement):
     18        * dom/Element.h:
     19        * dom/ElementRareData.cpp:
     20        * dom/ElementRareData.h:
     21        (WebCore::ElementRareData::nonce const):
     22        (WebCore::ElementRareData::setNonce):
     23        (WebCore::ElementRareData::useTypes const):
     24        * dom/InlineClassicScript.cpp:
     25        (WebCore::InlineClassicScript::create):
     26        * dom/InlineStyleSheetOwner.cpp:
     27        (WebCore::InlineStyleSheetOwner::createSheet):
     28        * dom/NodeRareData.h:
     29        * dom/ScriptElement.cpp:
     30        (WebCore::ScriptElement::requestClassicScript):
     31        (WebCore::ScriptElement::requestModuleScript):
     32        (WebCore::ScriptElement::executeClassicScript):
     33        * html/HTMLElement.cpp:
     34        (WebCore::HTMLElement::insertedIntoAncestor):
     35        * html/HTMLElement.h:
     36        * html/HTMLOrForeignElement.idl:
     37        * html/HTMLScriptElement.idl:
     38        * page/csp/ContentSecurityPolicy.cpp:
     39        (WebCore::ContentSecurityPolicy::didReceiveHeader):
     40        * page/csp/ContentSecurityPolicy.h:
     41        (WebCore::ContentSecurityPolicy::isHeaderDelivered const):
     42        * svg/SVGElement.cpp:
     43        (WebCore::SVGElement::insertedIntoAncestor):
     44
    1452021-11-08  J Pascoe  <j_pascoe@apple.com>
    246

  • trunk/Source/WebCore/dom/Element.cpp

    r284960 r285478  
    315315}
    316316
     317const AtomString& Element::nonce() const
     318{
     319    return hasRareData() ? elementRareData()->nonce() : emptyAtom();
     320}
     321
     322void Element::setNonce(const AtomString& newValue)
     323{
     324    if (newValue == emptyAtom() && !hasRareData())
     325        return;
     326
     327    ensureElementRareData().setNonce(newValue);
     328}
     329
     330void Element::hideNonce()
     331{
     332    // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes
     333    if (!isConnected())
     334        return;
     335
     336    const auto& csp = document().contentSecurityPolicy();
     337    if (!csp->isHeaderDelivered())
     338        return;
     339
     340    // Retain previous IDL nonce.
     341    AtomString currentNonce = nonce();
     342
     343    if (!getAttribute(nonceAttr).isEmpty())
     344        setAttribute(nonceAttr, emptyAtom());
     345
     346    setNonce(currentNonce);
     347}
     348
    317349bool Element::supportsFocus() const
    318350{
    … …  
    18611893        } else if (name == HTMLNames::nameAttr)
    18621894            elementData()->setHasNameAttribute(!newValue.isNull());
    1863         else if (name == HTMLNames::pseudoAttr) {
     1895        else if (name == HTMLNames::nonceAttr) {
     1896            if (is<HTMLElement>(*this) || is<SVGElement>(*this))
     1897                setNonce(newValue.isNull() ? emptyAtom() : newValue);
     1898        } else if (name == HTMLNames::pseudoAttr) {
    18641899            if (needsStyleInvalidation() && isInShadowTree())
    18651900                invalidateStyleForSubtree();
    … …  
    44844519    for (const Attribute& attribute : attributesIterator())
    44854520        attributeChanged(attribute.name(), nullAtom(), attribute.value(), ModifiedByCloning);
     4521
     4522    setNonce(other.nonce());
    44864523}
    44874524

  • trunk/Source/WebCore/dom/Element.h

    r284693 r285478  
    360360    virtual RefPtr<Element> focusDelegate();
    361361
     362    // Used by the HTMLElement and SVGElement IDLs.
     363    WEBCORE_EXPORT const AtomString& nonce() const;
     364    WEBCORE_EXPORT void setNonce(const AtomString&);
     365    void hideNonce();
     366
    362367    ExceptionOr<void> insertAdjacentHTML(const String& where, const String& html, NodeVector* addedNodes);
    363368

  • trunk/Source/WebCore/dom/ElementRareData.cpp

    r282628 r285478  
    3838    IntPoint savedLayerScrollPosition;
    3939    Vector<std::unique_ptr<ElementAnimationRareData>> animationRareData;
    40     void* pointers[10];
     40    void* pointers[11];
    4141    void* intersectionObserverData;
    4242#if ENABLE(CSS_TYPED_OM)

  • trunk/Source/WebCore/dom/ElementRareData.h

    r282628 r285478  
    103103    ResizeObserverData* resizeObserverData() { return m_resizeObserverData.get(); }
    104104    void setResizeObserverData(std::unique_ptr<ResizeObserverData>&& data) { m_resizeObserverData = WTFMove(data); }
     105
     106    const AtomString& nonce() const { return m_nonce; }
     107    void setNonce(const AtomString& value) { m_nonce = value; }
    105108
    106109#if ENABLE(CSS_TYPED_OM)
    … …  
    147150        if (!m_partNames.isEmpty())
    148151            result.add(UseType::PartNames);
     152        if (m_nonce)
     153            result.add(UseType::Nonce);
    149154        return result;
    150155    }
    … …  
    178183    SpaceSplitString m_partNames;
    179184
     185    AtomString m_nonce;
     186
    180187    void releasePseudoElement(PseudoElement*);
    181188};

  • trunk/Source/WebCore/dom/InlineClassicScript.cpp

    r283851 r285478  
    3737    auto& element = scriptElement.element();
    3838    return adoptRef(*new InlineClassicScript(
    39         element.attributeWithoutSynchronization(HTMLNames::nonceAttr),
     39        element.nonce(),
    4040        element.attributeWithoutSynchronization(HTMLNames::crossoriginAttr),
    4141        scriptElement.scriptCharset(),

  • trunk/Source/WebCore/dom/InlineStyleSheetOwner.cpp

    r284067 r285478  
    169169    ASSERT(document.contentSecurityPolicy());
    170170    const ContentSecurityPolicy& contentSecurityPolicy = *document.contentSecurityPolicy();
    171     bool hasKnownNonce = contentSecurityPolicy.allowStyleWithNonce(element.attributeWithoutSynchronization(HTMLNames::nonceAttr), element.isInUserAgentShadowTree());
     171    bool hasKnownNonce = contentSecurityPolicy.allowStyleWithNonce(element.nonce(), element.isInUserAgentShadowTree());
    172172    if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, hasKnownNonce))
    173173        return;

  • trunk/Source/WebCore/dom/NodeRareData.h

    r268695 r285478  
    264264        PartList = 1 << 16,
    265265        PartNames = 1 << 17,
     266        Nonce = 1 << 18,
    266267    };
    267268#endif

  • trunk/Source/WebCore/dom/ScriptElement.cpp

    r284857 r285478  
    292292    if (!stripLeadingAndTrailingHTMLSpaces(sourceURL).isEmpty()) {
    293293        auto script = LoadableClassicScript::create(
    294             m_element.attributeWithoutSynchronization(HTMLNames::nonceAttr),
     294            m_element.nonce(),
    295295            m_element.document().settings().subresourceIntegrityEnabled() ? m_element.attributeWithoutSynchronization(HTMLNames::integrityAttr).string() : emptyString(),
    296296            referrerPolicy(),
    … …  
    305305
    306306        const auto& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
    307         if (!contentSecurityPolicy.allowNonParserInsertedScripts(scriptURL, m_element.attributeWithoutSynchronization(HTMLNames::nonceAttr), String(), m_parserInserted))
     307        if (!contentSecurityPolicy.allowNonParserInsertedScripts(scriptURL, m_element.nonce(), String(), m_parserInserted))
    308308            return false;
    309309
    … …  
    327327    // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#cors-settings-attributes
    328328    // Module is always CORS request. If attribute is not given, it should be same-origin credential.
    329     String nonce = m_element.attributeWithoutSynchronization(HTMLNames::nonceAttr);
     329    String nonce = m_element.nonce();
    330330    String crossOriginMode = m_element.attributeWithoutSynchronization(HTMLNames::crossoriginAttr);
    331331    if (crossOriginMode.isNull())
    … …  
    398398        ASSERT(m_element.document().contentSecurityPolicy());
    399399        const ContentSecurityPolicy& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
    400         if (!contentSecurityPolicy.allowNonParserInsertedScripts(m_element.document().url(), m_element.attributeWithoutSynchronization(HTMLNames::nonceAttr), sourceCode.source(), m_parserInserted))
     400        if (!contentSecurityPolicy.allowNonParserInsertedScripts(m_element.document().url(), m_element.nonce(), sourceCode.source(), m_parserInserted))
    401401            return;
    402402
    403         bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(m_element.attributeWithoutSynchronization(HTMLNames::nonceAttr), m_element.isInUserAgentShadowTree());
     403        bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(m_element.nonce(), m_element.isInUserAgentShadowTree());
    404404        if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), hasKnownNonce))
    405405            return;

  • trunk/Source/WebCore/html/HTMLElement.cpp

    r285425 r285478  
    500500}
    501501
     502Node::InsertedIntoAncestorResult HTMLElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& containerNode)
     503{
     504    auto result = Element::insertedIntoAncestor(insertionType, containerNode);
     505    hideNonce();
     506    return result;
     507}
     508
    502509static Ref<DocumentFragment> textToFragment(Document& document, const String& text)
    503510{

  • trunk/Source/WebCore/html/HTMLElement.h

    r285425 r285478  
    167167    bool matchesReadWritePseudoClass() const override;
    168168    void parseAttribute(const QualifiedName&, const AtomString&) override;
     169    Node::InsertedIntoAncestorResult insertedIntoAncestor(InsertionType , ContainerNode& parentOfInsertedTree) override;
    169170    bool hasPresentationalHintsForAttribute(const QualifiedName&) const override;
    170171    void collectPresentationalHintsForAttribute(const QualifiedName&, const AtomString&, MutableStyleProperties&) override;

  • trunk/Source/WebCore/html/HTMLOrForeignElement.idl

    r284960 r285478  
    2929interface mixin HTMLOrForeignElement {
    3030    [SameObject] readonly attribute DOMStringMap dataset;
    31     // FIXME: Implement 'nonce'.
    32     // attribute DOMString nonce; // intentionally no [CEReactions]
     31    attribute DOMString nonce; // intentionally no [CEReactions]
    3332
    3433    [CEReactions=NotNeeded, Reflect] attribute boolean autofocus;

  • trunk/Source/WebCore/html/HTMLScriptElement.idl

    r283463 r285478  
    3131    [CEReactions=NotNeeded, Reflect] attribute DOMString type;
    3232    [CEReactions=NotNeeded] attribute DOMString? crossOrigin;
    33     [Reflect] attribute DOMString nonce;
    3433    [CEReactions=NotNeeded, Reflect] attribute boolean noModule;
    3534    [CEReactions=NotNeeded, Reflect, EnabledBySetting=SubresourceIntegrityEnabled] attribute DOMString integrity;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r285320 r285478  
    196196        ASSERT(m_policies.isEmpty());
    197197        m_hasAPIPolicy = true;
    198     }
     198    } else if (policyFrom == PolicyFrom::HTTPHeader)
     199        m_isHeaderDelivered = true;
    199200
    200201    m_cachedResponseHeaders = std::nullopt;

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r285320 r285478  
    186186    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
    187187
     188    bool isHeaderDelivered() const { return m_isHeaderDelivered; }
     189
    188190private:
    189191    void logToConsole(const String& message, const String& contextURL = String(), const OrdinalNumber& contextLine = OrdinalNumber::beforeFirst(), const OrdinalNumber& contextColumn = OrdinalNumber::beforeFirst(), JSC::JSGlobalObject* = nullptr) const;
    … …  
    248250    HashSet<SecurityOriginData> m_insecureNavigationRequestsToUpgrade;
    249251    mutable std::optional<ContentSecurityPolicyResponseHeaders> m_cachedResponseHeaders;
     252    bool m_isHeaderDelivered { false };
    250253};
    251254

  • trunk/Source/WebCore/svg/SVGElement.cpp

    r284693 r285478  
    895895    }
    896896
     897    hideNonce();
     898
    897899    return InsertedIntoAncestorResult::Done;
    898900}
Note: See TracChangeset for help on using the changeset viewer.