Changeset 117826 in webkit


Ignore:
Timestamp:
May 21, 2012 4:00:46 PM (12 years ago)
Author:
commit-queue@webkit.org
Message:

Source/WebCore: Improving console error for CSP-blocked setTimeout and setInterval evaluation.
​https://bugs.webkit.org/show_bug.cgi?id=86943

Patch by Mike West <​mkwst@chromium.org> on 2012-05-21
Reviewed by Adam Barth.

If the inspector is open, a stack trace is generated before calling
ContentSecurityPolicy::allowEval, and passed through to
ContentSecurityPolicy::reportViolation for use in the console message.

Test: http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval.html

http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout.html

  • bindings/js/ScheduledAction.cpp:

(WebCore::ScheduledAction::create):

  • bindings/v8/custom/V8DOMWindowCustom.cpp:

(WebCore::WindowSetTimeoutImpl):

  • page/ContentSecurityPolicy.cpp:

(CSPDirectiveList):
(WebCore::CSPDirectiveList::reportViolation):
(WebCore::CSPDirectiveList::checkEvalAndReportViolation):
(WebCore::CSPDirectiveList::allowEval):
(WebCore):
(WebCore::isAllowedByAllWithCallStack):
(WebCore::isAllowedByAllWithURL):
(WebCore::ContentSecurityPolicy::allowEval):
(WebCore::ContentSecurityPolicy::allowScriptFromSource):
(WebCore::ContentSecurityPolicy::allowObjectFromSource):
(WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
(WebCore::ContentSecurityPolicy::allowImageFromSource):
(WebCore::ContentSecurityPolicy::allowStyleFromSource):
(WebCore::ContentSecurityPolicy::allowFontFromSource):
(WebCore::ContentSecurityPolicy::allowMediaFromSource):
(WebCore::ContentSecurityPolicy::allowConnectToSource):

  • page/ContentSecurityPolicy.h:

(WebCore):

LayoutTests: Blocking setTimeout and setInterval evaluation with CSP should include a stack trace in the console warning.
​https://bugs.webkit.org/show_bug.cgi?id=86943

Patch by Mike West <​mkwst@chromium.org> on 2012-05-21
Reviewed by Adam Barth.

  • http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval-expected.txt: Added.
  • http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval.html: Added.
  • http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout-expected.txt: Added.
  • http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout.html: Added.
Location:
trunk
Files:
4 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r117824 r117826  
     12012-05-21  Mike West  <mkwst@chromium.org>
     2
     3        Blocking `setTimeout` and `setInterval` evaluation with CSP should include a stack trace in the console warning.
     4        https://bugs.webkit.org/show_bug.cgi?id=86943
     5
     6        Reviewed by Adam Barth.
     7
     8        * http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval-expected.txt: Added.
     9        * http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval.html: Added.
     10        * http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout-expected.txt: Added.
     11        * http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout.html: Added.
     12
    1132012-05-21  Levi Weintraub  <leviw@chromium.org>
    214

  • trunk/Source/WebCore/ChangeLog

    r117825 r117826  
     12012-05-21  Mike West  <mkwst@chromium.org>
     2
     3        Improving console error for CSP-blocked  `setTimeout` and `setInterval` evaluation.
     4        https://bugs.webkit.org/show_bug.cgi?id=86943
     5
     6        Reviewed by Adam Barth.
     7
     8        If the inspector is open, a stack trace is generated before calling
     9        ContentSecurityPolicy::allowEval, and passed through to
     10        ContentSecurityPolicy::reportViolation for use in the console message.
     11
     12        Test: http/tests/inspector-enabled/contentSecurityPolicy-blocks-setInterval.html
     13              http/tests/inspector-enabled/contentSecurityPolicy-blocks-setTimeout.html
     14
     15        * bindings/js/ScheduledAction.cpp:
     16        (WebCore::ScheduledAction::create):
     17        * bindings/v8/custom/V8DOMWindowCustom.cpp:
     18        (WebCore::WindowSetTimeoutImpl):
     19        * page/ContentSecurityPolicy.cpp:
     20        (CSPDirectiveList):
     21        (WebCore::CSPDirectiveList::reportViolation):
     22        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
     23        (WebCore::CSPDirectiveList::allowEval):
     24        (WebCore):
     25        (WebCore::isAllowedByAllWithCallStack):
     26        (WebCore::isAllowedByAllWithURL):
     27        (WebCore::ContentSecurityPolicy::allowEval):
     28        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
     29        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
     30        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
     31        (WebCore::ContentSecurityPolicy::allowImageFromSource):
     32        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
     33        (WebCore::ContentSecurityPolicy::allowFontFromSource):
     34        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
     35        (WebCore::ContentSecurityPolicy::allowConnectToSource):
     36        * page/ContentSecurityPolicy.h:
     37        (WebCore):
     38
    1392012-05-21  Antoine Labour  <piman@chromium.org>
    240

  • trunk/Source/WebCore/bindings/js/ScheduledAction.cpp

    r116821 r117826  
    3333#include "JSDOMWindow.h"
    3434#include "JSMainThreadExecState.h"
     35#include "ScriptCallStack.h"
     36#include "ScriptCallStackFactory.h"
    3537#include "ScriptController.h"
    3638#include "ScriptExecutionContext.h"
    … …  
    5456    CallData callData;
    5557    if (getCallData(v, callData) == CallTypeNone) {
    56         if (policy && !policy->allowEval())
     58        RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
     59        if (policy && !policy->allowEval(callStack.release()))
    5760            return nullptr;
    5861        UString string = v.toString(exec)->value(exec);

  • trunk/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp

    r117733 r117826  
    4949#include "PlatformScreen.h"
    5050#include "ScheduledAction.h"
     51#include "ScriptCallStack.h"
     52#include "ScriptCallStackFactory.h"
    5153#include "ScriptSourceCode.h"
    5254#include "SerializedScriptValue.h"
    … …  
    130132        id = DOMTimer::install(scriptContext, action.release(), timeout, singleShot);
    131133    } else {
    132         if (imp->document() && !imp->document()->contentSecurityPolicy()->allowEval())
     134        RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
     135        if (imp->document() && !imp->document()->contentSecurityPolicy()->allowEval(callStack.release()))
    133136            return v8::Integer::New(0);
    134137        id = DOMTimer::install(scriptContext, adoptPtr(new ScheduledAction(V8Proxy::context(imp->frame()), functionString)), timeout, singleShot);

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r117006 r117826  
    495495    bool allowInlineScript() const;
    496496    bool allowInlineStyle() const;
    497     bool allowEval() const;
     497    bool allowEval(PassRefPtr<ScriptCallStack>) const;
    498498
    499499    bool allowScriptFromSource(const KURL&) const;
    … …  
    519519
    520520    CSPDirective* operativeDirective(CSPDirective*) const;
    521     void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL = KURL()) const;
     521    void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL = KURL(), PassRefPtr<ScriptCallStack> = 0) const;
    522522    void logUnrecognizedDirective(const String& name) const;
    523523    bool checkEval(CSPDirective*) const;
    524524
    525525    bool checkInlineAndReportViolation(CSPDirective*, const String& consoleMessage) const;
    526     bool checkEvalAndReportViolation(CSPDirective*, const String& consoleMessage) const;
     526    bool checkEvalAndReportViolation(CSPDirective*, const String& consoleMessage, PassRefPtr<ScriptCallStack>) const;
    527527    bool checkSourceAndReportViolation(CSPDirective*, const KURL&, const String& type) const;
    528528
    … …  
    576576}
    577577
    578 void CSPDirectiveList::reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL) const
     578void CSPDirectiveList::reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, PassRefPtr<ScriptCallStack> callStack) const
    579579{
    580580    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
    581     m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
     581    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, String(), 0, callStack);
    582582
    583583    if (m_reportURIs.isEmpty())
    … …  
    647647}
    648648
    649 bool CSPDirectiveList::checkEvalAndReportViolation(CSPDirective* directive, const String& consoleMessage) const
     649bool CSPDirectiveList::checkEvalAndReportViolation(CSPDirective* directive, const String& consoleMessage, PassRefPtr<ScriptCallStack> callStack) const
    650650{
    651651    if (checkEval(directive))
    652652        return true;
    653     reportViolation(directive->text(), consoleMessage + "\"" + directive->text() + "\".\n");
     653    reportViolation(directive->text(), consoleMessage + "\"" + directive->text() + "\".\n", KURL(), callStack);
    654654    return denyIfEnforcingPolicy();
    655655}
    … …  
    688688}
    689689
    690 bool CSPDirectiveList::allowEval() const
     690bool CSPDirectiveList::allowEval(PassRefPtr<ScriptCallStack> callStack) const
    691691{
    692692    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to evaluate script because it violates the following Content Security Policy directive: "));
    693     return checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
     693    return checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, callStack);
    694694}
    695695
    … …  
    934934}
    935935
     936template<bool (CSPDirectiveList::*allowed)(PassRefPtr<ScriptCallStack>) const>
     937bool isAllowedByAllWithCallStack(const CSPDirectiveListVector& policies, PassRefPtr<ScriptCallStack> callStack)
     938{
     939    for (size_t i = 0; i < policies.size(); ++i) {
     940        if (!(policies[i].get()->*allowed)(callStack))
     941            return false;
     942    }
     943    return true;
     944}
     945
    936946template<bool (CSPDirectiveList::*allowFromURL)(const KURL&) const>
    937 bool isAllowedByAll(const CSPDirectiveListVector& policies, const KURL& url)
     947bool isAllowedByAllWithURL(const CSPDirectiveListVector& policies, const KURL& url)
    938948{
    939949    for (size_t i = 0; i < policies.size(); ++i) {
    … …  
    966976}
    967977
    968 bool ContentSecurityPolicy::allowEval() const
    969 {
    970     return isAllowedByAll<&CSPDirectiveList::allowEval>(m_policies);
     978bool ContentSecurityPolicy::allowEval(PassRefPtr<ScriptCallStack> callStack) const
     979{
     980    return isAllowedByAllWithCallStack<&CSPDirectiveList::allowEval>(m_policies, callStack);
    971981}
    972982
    973983bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
    974984{
    975     return isAllowedByAll<&CSPDirectiveList::allowScriptFromSource>(m_policies, url);
     985    return isAllowedByAllWithURL<&CSPDirectiveList::allowScriptFromSource>(m_policies, url);
    976986}
    977987
    978988bool ContentSecurityPolicy::allowObjectFromSource(const KURL& url) const
    979989{
    980     return isAllowedByAll<&CSPDirectiveList::allowObjectFromSource>(m_policies, url);
     990    return isAllowedByAllWithURL<&CSPDirectiveList::allowObjectFromSource>(m_policies, url);
    981991}
    982992
    983993bool ContentSecurityPolicy::allowChildFrameFromSource(const KURL& url) const
    984994{
    985     return isAllowedByAll<&CSPDirectiveList::allowChildFrameFromSource>(m_policies, url);
     995    return isAllowedByAllWithURL<&CSPDirectiveList::allowChildFrameFromSource>(m_policies, url);
    986996}
    987997
    988998bool ContentSecurityPolicy::allowImageFromSource(const KURL& url) const
    989999{
    990     return isAllowedByAll<&CSPDirectiveList::allowImageFromSource>(m_policies, url);
     1000    return isAllowedByAllWithURL<&CSPDirectiveList::allowImageFromSource>(m_policies, url);
    9911001}
    9921002
    9931003bool ContentSecurityPolicy::allowStyleFromSource(const KURL& url) const
    9941004{
    995     return isAllowedByAll<&CSPDirectiveList::allowStyleFromSource>(m_policies, url);
     1005    return isAllowedByAllWithURL<&CSPDirectiveList::allowStyleFromSource>(m_policies, url);
    9961006}
    9971007
    9981008bool ContentSecurityPolicy::allowFontFromSource(const KURL& url) const
    9991009{
    1000     return isAllowedByAll<&CSPDirectiveList::allowFontFromSource>(m_policies, url);
     1010    return isAllowedByAllWithURL<&CSPDirectiveList::allowFontFromSource>(m_policies, url);
    10011011}
    10021012
    10031013bool ContentSecurityPolicy::allowMediaFromSource(const KURL& url) const
    10041014{
    1005     return isAllowedByAll<&CSPDirectiveList::allowMediaFromSource>(m_policies, url);
     1015    return isAllowedByAllWithURL<&CSPDirectiveList::allowMediaFromSource>(m_policies, url);
    10061016}
    10071017
    10081018bool ContentSecurityPolicy::allowConnectToSource(const KURL& url) const
    10091019{
    1010     return isAllowedByAll<&CSPDirectiveList::allowConnectToSource>(m_policies, url);
    1011 }
    1012 
    1013 }
     1020    return isAllowedByAllWithURL<&CSPDirectiveList::allowConnectToSource>(m_policies, url);
     1021}
     1022
     1023}

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r116842 r117826  
    3535
    3636class CSPDirectiveList;
     37class ScriptCallStack;
    3738class ScriptExecutionContext;
    3839class KURL;
    … …  
    6667    bool allowInlineScript() const;
    6768    bool allowInlineStyle() const;
    68     bool allowEval() const;
     69    bool allowEval(PassRefPtr<ScriptCallStack>) const;
    6970
    7071    bool allowScriptFromSource(const KURL&) const;
Note: See TracChangeset for help on using the changeset viewer.