Changeset 116254 in webkit

Timestamp:

May 6, 2012 5:53:33 PM (12 years ago)

Author:

abarth@webkit.org

Message:

CSP should let sites both enforce one policy and monitor another
​https://bugs.webkit.org/show_bug.cgi?id=85561

Reviewed by Eric Seidel.

Source/WebCore:

This patch lets us enforce and/or monitor multiple CSP policies.
Rather than having a single directive list, we now have a vector of
directive lists.

Tests: http/tests/security/contentSecurityPolicy/combine-multiple-policies.html

http/tests/security/contentSecurityPolicy/report-and-enforce.html

• page/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::copyStateFrom):
(WebCore::ContentSecurityPolicy::didReceiveHeader):
(WebCore::ContentSecurityPolicy::deprecatedHeader):
(WebCore::ContentSecurityPolicy::deprecatedHeaderType):

• Even after this patch, workers aren't smart enough to enforce multiple policies. They just use the first header, like they did before. We'll need to teach workers how to enforce multiple policies in a future patch.

(WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
(WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
(WebCore::ContentSecurityPolicy::allowInlineScript):
(WebCore::ContentSecurityPolicy::allowInlineStyle):
(WebCore::ContentSecurityPolicy::allowEval):
(WebCore::ContentSecurityPolicy::allowScriptFromSource):
(WebCore::ContentSecurityPolicy::allowObjectFromSource):
(WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
(WebCore::ContentSecurityPolicy::allowImageFromSource):
(WebCore::ContentSecurityPolicy::allowStyleFromSource):
(WebCore::ContentSecurityPolicy::allowFontFromSource):
(WebCore::ContentSecurityPolicy::allowMediaFromSource):
(WebCore::ContentSecurityPolicy::allowConnectFromSource):

• page/ContentSecurityPolicy.h:
• workers/DefaultSharedWorkerRepository.cpp:

(WebCore::SharedWorkerScriptLoader::notifyFinished):

• workers/WorkerMessagingProxy.cpp:

(WebCore::WorkerMessagingProxy::startWorkerContext):

Source/WebKit/chromium:

• src/SharedWorkerRepository.cpp:

(WebCore::SharedWorkerScriptLoader::notifyFinished):

• src/WebWorkerClientImpl.cpp:

(WebKit::WebWorkerClientImpl::startWorkerContext):

LayoutTests:

Test that we can enforce multiple policies and that we can enforce one
policy while monitoring another.

• http/tests/security/contentSecurityPolicy/combine-multiple-policies-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/combine-multiple-policies.html: Added.
• http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-and-enforce.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/combine-multiple-policies-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/combine-multiple-policies.html (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/report-and-enforce.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/ContentSecurityPolicy.cpp (modified) (2 diffs)
• Source/WebCore/page/ContentSecurityPolicy.h (modified) (3 diffs)
• Source/WebCore/workers/DefaultSharedWorkerRepository.cpp (modified) (1 diff)
• Source/WebCore/workers/WorkerMessagingProxy.cpp (modified) (1 diff)
• Source/WebKit/chromium/ChangeLog (modified) (1 diff)
• Source/WebKit/chromium/src/SharedWorkerRepository.cpp (modified) (1 diff)
• Source/WebKit/chromium/src/WebWorkerClientImpl.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-05-06  Adam Barth  <abarth@webkit.org>
+
+        CSP should let sites both enforce one policy and monitor another
+        https://bugs.webkit.org/show_bug.cgi?id=85561
+
+        Reviewed by Eric Seidel.
+
+        Test that we can enforce multiple policies and that we can enforce one
+        policy while monitoring another.
+
+        * http/tests/security/contentSecurityPolicy/combine-multiple-policies-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/combine-multiple-policies.html: Added.
+        * http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/report-and-enforce.html: Added.
+
 2012-05-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-06  Adam Barth  <abarth@webkit.org>
+
+        CSP should let sites both enforce one policy and monitor another
+        https://bugs.webkit.org/show_bug.cgi?id=85561
+
+        Reviewed by Eric Seidel.
+
+        This patch lets us enforce and/or monitor multiple CSP policies.
+        Rather than having a single directive list, we now have a vector of
+        directive lists.
+
+        Tests: http/tests/security/contentSecurityPolicy/combine-multiple-policies.html
+               http/tests/security/contentSecurityPolicy/report-and-enforce.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::copyStateFrom):
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        (WebCore::ContentSecurityPolicy::deprecatedHeader):
+        (WebCore::ContentSecurityPolicy::deprecatedHeaderType):
+            - Even after this patch, workers aren't smart enough to enforce
+              multiple policies.  They just use the first header, like they did
+              before.  We'll need to teach workers how to enforce multiple
+              policies in a future patch.
+        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
+        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
+        (WebCore::ContentSecurityPolicy::allowInlineScript):
+        (WebCore::ContentSecurityPolicy::allowInlineStyle):
+        (WebCore::ContentSecurityPolicy::allowEval):
+        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
+        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
+        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
+        (WebCore::ContentSecurityPolicy::allowImageFromSource):
+        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
+        (WebCore::ContentSecurityPolicy::allowFontFromSource):
+        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
+        (WebCore::ContentSecurityPolicy::allowConnectFromSource):
+        * page/ContentSecurityPolicy.h:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+
 2012-05-06  Rob Buis  <rbuis@rim.com>
 

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -888 +888 @@
 void ContentSecurityPolicy::copyStateFrom(const ContentSecurityPolicy* other) 
 {
-    ASSERT(!m_policy);
-    if (other->m_policy)
-        didReceiveHeader(other->header(), other->headerType());
+    ASSERT(m_policies.isEmpty());
+    for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin(); iter != other->m_policies.end(); ++iter)
+        didReceiveHeader((*iter)->header(), (*iter)->headerType());
 }
 
 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType type)
 {
-    if (m_policy)
-        return; // The first policy wins.
-    m_policy = CSPDirectiveList::create(m_scriptExecutionContext, header, type);
+    m_policies.append(CSPDirectiveList::create(m_scriptExecutionContext, header, type));
 }
 
@@ -905 +903 @@
 }
 
-const String& ContentSecurityPolicy::header() const
-{
-    return m_policy ? m_policy->header() : emptyString();
-}
-
-ContentSecurityPolicy::HeaderType ContentSecurityPolicy::headerType() const
-{
-    return m_policy ? m_policy->headerType() : EnforcePolicy;
+const String& ContentSecurityPolicy::deprecatedHeader() const
+{
+    return m_policies.isEmpty() ? emptyString() : m_policies[0]->header();
+}
+
+ContentSecurityPolicy::HeaderType ContentSecurityPolicy::deprecatedHeaderType() const
+{
+    return m_policies.isEmpty() ? EnforcePolicy : m_policies[0]->headerType();
+}
+
+template<bool (CSPDirectiveList::*allowed)() const>
+bool isAllowedByAll(const CSPDirectiveListVector& policies)
+{
+    for (size_t i = 0; i < policies.size(); ++i) {
+        if (!(policies[i].get()->*allowed)())
+            return false;
+    }
+    return true;
+}
+
+template<bool (CSPDirectiveList::*allowFromURL)(const KURL&) const>
+bool isAllowedByAll(const CSPDirectiveListVector& policies, const KURL& url)
+{
+    for (size_t i = 0; i < policies.size(); ++i) {
+        if (!(policies[i].get()->*allowFromURL)(url))
+            return false;
+    }
+    return true;
 }
 
 bool ContentSecurityPolicy::allowJavaScriptURLs() const
 {
-    return !m_policy || m_policy->allowJavaScriptURLs();
+    return isAllowedByAll<&CSPDirectiveList::allowJavaScriptURLs>(m_policies);
 }
 
 bool ContentSecurityPolicy::allowInlineEventHandlers() const
 {
-    return !m_policy || m_policy->allowInlineEventHandlers();
+    return isAllowedByAll<&CSPDirectiveList::allowInlineEventHandlers>(m_policies);
 }
 
 bool ContentSecurityPolicy::allowInlineScript() const
 {
-    return !m_policy || m_policy->allowInlineScript();
+    return isAllowedByAll<&CSPDirectiveList::allowInlineScript>(m_policies);
 }
 
 bool ContentSecurityPolicy::allowInlineStyle() const
 {
-    return !m_policy || m_overrideInlineStyleAllowed || m_policy->allowInlineStyle();
+    if (m_overrideInlineStyleAllowed)
+        return true;
+    return isAllowedByAll<&CSPDirectiveList::allowInlineStyle>(m_policies);
 }
 
 bool ContentSecurityPolicy::allowEval() const
 {
-    return !m_policy || m_policy->allowEval();
+    return isAllowedByAll<&CSPDirectiveList::allowEval>(m_policies);
 }
 
 bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowScriptFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowScriptFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowObjectFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowObjectFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowObjectFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowChildFrameFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowChildFrameFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowChildFrameFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowImageFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowImageFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowImageFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowStyleFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowStyleFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowStyleFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowFontFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowFontFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowFontFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowMediaFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowMediaFromSource(url);
+    return isAllowedByAll<&CSPDirectiveList::allowMediaFromSource>(m_policies, url);
 }
 
 bool ContentSecurityPolicy::allowConnectFromSource(const KURL& url) const
 {
-    return !m_policy || m_policy->allowConnectFromSource(url);
-}
-
-}
+    return isAllowedByAll<&CSPDirectiveList::allowConnectFromSource>(m_policies, url);
+}
+
+}

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -38 +38 @@
 class KURL;
 
+typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector;
+
 class ContentSecurityPolicy {
 public:
@@ -55 +57 @@
     void didReceiveHeader(const String&, HeaderType);
 
-    const String& header() const;
-    HeaderType headerType() const;
+    // These functions are wrong becuase they assume that there is only one header.
+    // FIXME: Replace them with functions that return vectors.
+    const String& deprecatedHeader() const;
+    HeaderType deprecatedHeaderType() const;
 
     bool allowJavaScriptURLs() const;
@@ -80 +84 @@
     ScriptExecutionContext* m_scriptExecutionContext;
     bool m_overrideInlineStyleAllowed;
-    OwnPtr<CSPDirectiveList> m_policy;
+    CSPDirectiveListVector m_policies;
 };
 

trunk/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp

@@ -323 +323 @@
         DefaultSharedWorkerRepository::instance().workerScriptLoaded(*m_proxy, m_worker->scriptExecutionContext()->userAgent(m_scriptLoader->url()),
                                                                      m_scriptLoader->script(), m_port.release(),
-                                                                     m_worker->scriptExecutionContext()->contentSecurityPolicy()->header(),
-                                                                     m_worker->scriptExecutionContext()->contentSecurityPolicy()->headerType());
+                                                                     m_worker->scriptExecutionContext()->contentSecurityPolicy()->deprecatedHeader(),
+                                                                     m_worker->scriptExecutionContext()->contentSecurityPolicy()->deprecatedHeaderType());
     }
     m_worker->unsetPendingActivity(m_worker.get());

trunk/Source/WebCore/workers/WorkerMessagingProxy.cpp

@@ -273 +273 @@
 {
     RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this, startMode,
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->header(),
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->headerType());
+                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeader(),
+                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeaderType());
     workerThreadCreated(thread);
     thread->start();

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2012-05-06  Adam Barth  <abarth@webkit.org>
+
+        CSP should let sites both enforce one policy and monitor another
+        https://bugs.webkit.org/show_bug.cgi?id=85561
+
+        Reviewed by Eric Seidel.
+
+        * src/SharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit::WebWorkerClientImpl::startWorkerContext):
+
 2012-05-06  Kent Tamura  <tkent@chromium.org>
 

trunk/Source/WebKit/chromium/src/SharedWorkerRepository.cpp

@@ -172 +172 @@
         // Pass the script off to the worker, then send a connect event.
         m_webWorker->startWorkerContext(m_url, m_name, m_worker->scriptExecutionContext()->userAgent(m_url), m_scriptLoader->script(),
-                                        m_worker->scriptExecutionContext()->contentSecurityPolicy()->header(),
-                                        static_cast<WebKit::WebContentSecurityPolicyType>(m_worker->scriptExecutionContext()->contentSecurityPolicy()->headerType()),
+                                        m_worker->scriptExecutionContext()->contentSecurityPolicy()->deprecatedHeader(),
+                                        static_cast<WebKit::WebContentSecurityPolicyType>(m_worker->scriptExecutionContext()->contentSecurityPolicy()->deprecatedHeaderType()),
                                         m_responseAppCacheID);
         sendConnect();

trunk/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp

@@ -88 +88 @@
 {
     RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this, startMode,
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->header(),
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->headerType());
+                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeader(),
+                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeaderType());
     m_proxy->workerThreadCreated(thread);
     thread->start();