Changeset 116268 in webkit


Ignore:
Timestamp:
May 6, 2012 9:34:30 PM (12 years ago)
Author:
abarth@webkit.org
Message:

Content Security Policy reports should be reported with content-type application/json, should contain all required fields
​https://bugs.webkit.org/show_bug.cgi?id=61360

Reviewed by Eric Seidel.

Source/WebCore:

This patch changes ContentSecurityPolicy to use JSON format for sending
violation reports rather than wwwform-encoding. This patch aligns our
behavior with the specification and with Mozilla. A follow up patch
will update the list of fields in the report to match the spec.

  • loader/PingLoader.cpp:

(WebCore::PingLoader::reportContentSecurityPolicyViolation):

  • page/ContentSecurityPolicy.cpp:

(WebCore::CSPDirectiveList::reportViolation):

LayoutTests:

Update results to show JSON format.

  • http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt:
  • http/tests/security/contentSecurityPolicy/resources/save-report.php:
Location:
trunk
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r116263 r116268  
     12012-05-06  Adam Barth  <abarth@webkit.org>
     2
     3        Content Security Policy reports should be reported with content-type application/json, should contain all required fields
     4        https://bugs.webkit.org/show_bug.cgi?id=61360
     5
     6        Reviewed by Eric Seidel.
     7
     8        Update results to show JSON format.
     9
     10        * http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
     11        * http/tests/security/contentSecurityPolicy/report-only-expected.txt:
     12        * http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt:
     13        * http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
     14        * http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt:
     15        * http/tests/security/contentSecurityPolicy/resources/save-report.php:
     16
    1172012-05-06  Kenichi Ishibashi  <bashi@chromium.org>
    218

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt

    r116254 r116268  
    55
    66CSP report received:
    7 CONTENT_TYPE: application/x-www-form-urlencoded
     7CONTENT_TYPE: application/json
    88HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/report-and-enforce.html
    99REQUEST_METHOD: POST
    1010=== POST DATA ===
    11 document-url: http://127.0.0.1:8000/security/contentSecurityPolicy/report-and-enforce.html
    12 violated-directive: script-src 'self'
     11{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/report-and-enforce.html","violated-directive":"script-src 'self'"}}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-expected.txt

    r104803 r116268  
    33ALERT: PASS
    44CSP report received:
    5 CONTENT_TYPE: application/x-www-form-urlencoded
     5CONTENT_TYPE: application/json
    66HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/report-only.html
    77REQUEST_METHOD: POST
    88=== POST DATA ===
    9 document-url: http://127.0.0.1:8000/security/contentSecurityPolicy/report-only.html
    10 violated-directive: script-src 'self'
     9{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/report-only.html","violated-directive":"script-src 'self'"}}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt

    r104803 r116268  
    33ALERT: PASS
    44CSP report received:
    5 CONTENT_TYPE: application/x-www-form-urlencoded
     5CONTENT_TYPE: application/json
    66HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/report-only-from-header.php
    77REQUEST_METHOD: POST
    88=== POST DATA ===
    9 document-url: http://127.0.0.1:8000/security/contentSecurityPolicy/report-only-from-header.php
    10 violated-directive: script-src 'self'
     9{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/report-only-from-header.php","violated-directive":"script-src 'self'"}}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-uri-expected.txt

    r104803 r116268  
    22
    33CSP report received:
    4 CONTENT_TYPE: application/x-www-form-urlencoded
     4CONTENT_TYPE: application/json
    55HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/report-uri.html
    66REQUEST_METHOD: POST
    77=== POST DATA ===
    8 document-url: http://127.0.0.1:8000/security/contentSecurityPolicy/report-uri.html
    9 violated-directive: script-src 'self'
     8{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/report-uri.html","violated-directive":"script-src 'self'"}}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt

    r104803 r116268  
    77--------
    88CSP report received:
    9 CONTENT_TYPE: application/x-www-form-urlencoded
     9CONTENT_TYPE: application/json
    1010HTTP_REFERER: http://127.0.0.1:8000/security/contentSecurityPolicy/resources/generate-csp-report.html
    1111REQUEST_METHOD: POST
    1212=== POST DATA ===
    13 document-url: http://127.0.0.1:8000/security/contentSecurityPolicy/resources/generate-csp-report.html
    14 violated-directive: script-src 'self'
     13{"csp-report":{"document-uri":"http://127.0.0.1:8000/security/contentSecurityPolicy/resources/generate-csp-report.html","violated-directive":"script-src 'self'"}}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/save-report.php

    r84502 r116268  
    1616}
    1717fwrite($reportFile, "=== POST DATA ===\n");
    18 foreach ($_POST as $name => $value) {
    19     $name = undoMagicQuotes($name);
    20     $value = undoMagicQuotes($value);
    21     fwrite($reportFile, "$name: $value\n");
    22 }
     18fwrite($reportFile, file_get_contents("php://input"));
    2319fclose($reportFile);
    2420rename("csp-report.txt.tmp", "csp-report.txt");

  • trunk/Source/WebCore/ChangeLog

    r116265 r116268  
     12012-05-06  Adam Barth  <abarth@webkit.org>
     2
     3        Content Security Policy reports should be reported with content-type application/json, should contain all required fields
     4        https://bugs.webkit.org/show_bug.cgi?id=61360
     5
     6        Reviewed by Eric Seidel.
     7
     8        This patch changes ContentSecurityPolicy to use JSON format for sending
     9        violation reports rather than wwwform-encoding.  This patch aligns our
     10        behavior with the specification and with Mozilla.  A follow up patch
     11        will update the list of fields in the report to match the spec.
     12
     13        * loader/PingLoader.cpp:
     14        (WebCore::PingLoader::reportContentSecurityPolicyViolation):
     15        * page/ContentSecurityPolicy.cpp:
     16        (WebCore::CSPDirectiveList::reportViolation):
     17
    1182012-05-06  Mary Wu  <mary.wu@torchmobile.com.cn>
    219

  • trunk/Source/WebCore/loader/PingLoader.cpp

    r106655 r116268  
    111111#endif
    112112    request.setHTTPMethod("POST");
    113     request.setHTTPContentType("application/x-www-form-urlencoded");
     113    request.setHTTPContentType("application/json");
    114114    request.setHTTPBody(report);
    115115    frame->loader()->addExtraFieldsToSubresourceRequest(request);

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r116254 r116268  
    3232#include "FormDataList.h"
    3333#include "Frame.h"
     34#include "InspectorValues.h"
    3435#include "PingLoader.h"
    3536#include "ScriptCallStack.h"
    … …  
    602603    // harmless information.
    603604
    604     FormDataList reportList(UTF8Encoding());
    605     reportList.appendData("document-url", document->url());
     605    RefPtr<InspectorObject> cspReport = InspectorObject::create();
     606    cspReport->setString("document-uri", document->url());
    606607    if (!directiveText.isEmpty())
    607         reportList.appendData("violated-directive", directiveText);
    608 
    609     RefPtr<FormData> report = FormData::create(reportList, UTF8Encoding());
     608        cspReport->setString("violated-directive", directiveText);
     609
     610    RefPtr<InspectorObject> reportObject = InspectorObject::create();
     611    reportObject->setObject("csp-report", cspReport.release());
     612
     613    RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());
    610614
    611615    for (size_t i = 0; i < m_reportURLs.size(); ++i)
Note: See TracChangeset for help on using the changeset viewer.