Changeset 143880 in webkit


Ignore:
Timestamp:
Feb 24, 2013 2:40:23 PM (11 years ago)
Author:
mkwst@chromium.org
Message:

CSP 1.1: Experiment with 'reflected-xss' directive.
​https://bugs.webkit.org/show_bug.cgi?id=104479

Reviewed by Adam Barth.

Source/WebCore:

Content Security Policy 1.1 defines a 'reflected-xss' directive that
works in much the same way as WebKit's current 'X-XSS-Protection'
header[1]. This patch implements the new directive by parsing it
inside ContentSecurityPolicy, and exposing that state to XSSAuditor.

XSSAuditor now grabs the CSP directive's state, and mixes it with the
X-XSS-Protection header's state to determine how the page should be
handled. Moreover, both headers' states are now expressed in terms of
ContentSecurityPolicy::ReflectedXSSDisposition.

[1]: ​https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#reflected-xss--experimental

Tests: http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html

http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html
http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html

  • html/parser/XSSAuditor.cpp:

(WebCore::combineXSSProtectionHeaderAndCSP):

Given both headers' states, return the state which the XSSAuditor
should use when parsing a page. Blocking overrides filtering, which
overrides disabling.

(WebCore):
(WebCore::XSSAuditor::init):

Process the 'X-XSS-Protection' header before grabbing the CSP
header's state. Both are passed into the new
combineXSSProtectionHeaderAndCSP method to generate the final
state that ought to be used.

(WebCore::XSSAuditor::XSSAuditor):
(WebCore::XSSAuditor::filterToken):

  • html/parser/XSSAuditor.h:

Switch to ContentSecurityPolicy::ReflectedXSSDisposition internally
in XSSAuditor.

  • page/ContentSecurityPolicy.cpp:

(WebCore::CSPDirectiveList::reflectedXSSDisposition):

Enum defining the possible state of the 'reflected-xss' CSP directive.

(CSPDirectiveList):
(WebCore::CSPDirectiveList::CSPDirectiveList):
(WebCore::CSPDirectiveList::parseReflectedXSS):

Given a 'reflected-xss' directive's value, set the
ReflectedXSSDisposition into a new property on the CSPDirectiveList.

(WebCore):
(WebCore::CSPDirectiveList::addDirective):

Accept 'reflected-xss' as a valid directive if we're in
experimental mode.

(WebCore::ContentSecurityPolicy::reflectedXSSDisposition):

Expose the directive's state via the public API.

(WebCore::ContentSecurityPolicy::reportInvalidReflectedXSS):

Generate console errors when invalid reflected-xss directive values
are encounted during parsing.

  • page/ContentSecurityPolicy.h:
  • platform/network/HTTPParsers.cpp:

(WebCore::parseXSSProtectionHeader):

  • platform/network/HTTPParsers.h:

(WebCore):

Start using ContentSecurityPolicy::ReflectedXSSDisposition rather
than the XSSProtectionDisposition enum.

LayoutTests:

  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html: Added.
  • http/tests/security/contentSecurityPolicy/resources/reflected-xss-and-xss-protection.js: Added.

(testMixedHeader):
(frameLoaded):
(frameErrored):

  • http/tests/security/xssAuditor/resources/echo-intertag.pl:

Added the ability to send an 'X-WebKit-CSP' header to test 'reflected-xss' behavior.

Location:
trunk
Files:
63 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r143867 r143880  
     12013-02-24  Mike West  <mkwst@chromium.org>
     2
     3        CSP 1.1: Experiment with 'reflected-xss' directive.
     4        https://bugs.webkit.org/show_bug.cgi?id=104479
     5
     6        Reviewed by Adam Barth.
     7
     8        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow-expected.txt: Added.
     9        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html: Added.
     10        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow-expected.txt: Added.
     11        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html: Added.
     12        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block-expected.txt: Added.
     13        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html: Added.
     14        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter-expected.txt: Added.
     15        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html: Added.
     16        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid-expected.txt: Added.
     17        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html: Added.
     18        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset-expected.txt: Added.
     19        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html: Added.
     20        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow-expected.txt: Added.
     21        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html: Added.
     22        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block-expected.txt: Added.
     23        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html: Added.
     24        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter-expected.txt: Added.
     25        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html: Added.
     26        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid-expected.txt: Added.
     27        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html: Added.
     28        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset-expected.txt: Added.
     29        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html: Added.
     30        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow-expected.txt: Added.
     31        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html: Added.
     32        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block-expected.txt: Added.
     33        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html: Added.
     34        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter-expected.txt: Added.
     35        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html: Added.
     36        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid-expected.txt: Added.
     37        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html: Added.
     38        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset-expected.txt: Added.
     39        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html: Added.
     40        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow-expected.txt: Added.
     41        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html: Added.
     42        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block-expected.txt: Added.
     43        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html: Added.
     44        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter-expected.txt: Added.
     45        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html: Added.
     46        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid-expected.txt: Added.
     47        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html: Added.
     48        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset-expected.txt: Added.
     49        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html: Added.
     50        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow-expected.txt: Added.
     51        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html: Added.
     52        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block-expected.txt: Added.
     53        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html: Added.
     54        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter-expected.txt: Added.
     55        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html: Added.
     56        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid-expected.txt: Added.
     57        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html: Added.
     58        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset-expected.txt: Added.
     59        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html: Added.
     60        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block-expected.txt: Added.
     61        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html: Added.
     62        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty-expected.txt: Added.
     63        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html: Added.
     64        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter-expected.txt: Added.
     65        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html: Added.
     66        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid-expected.txt: Added.
     67        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html: Added.
     68        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing-expected.txt: Added.
     69        * http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html: Added.
     70        * http/tests/security/contentSecurityPolicy/resources/reflected-xss-and-xss-protection.js: Added.
     71        (testMixedHeader):
     72        (frameLoaded):
     73        (frameErrored):
     74        * http/tests/security/xssAuditor/resources/echo-intertag.pl:
     75            Added the ability to send an 'X-WebKit-CSP' header to test 'reflected-xss' behavior.
     76
    1772013-02-24  Keishi Hattori  <keishi@webkit.org>
    278

  • trunk/LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag.pl

    r143644 r143880  
    6666}
    6767
     68if ($cgi->param('csp') eq '_empty_') {
     69    print "X-WebKit-CSP: reflected-xss\n";
     70} elsif ($cgi->param('csp')) {
     71    print "X-WebKit-CSP: reflected-xss " . $cgi->param('csp') . "\n";
     72}
     73
    6874print "Content-Type: text/html; charset=";
    6975print $cgi->param('charset') ? $cgi->param('charset') : "UTF-8";

  • trunk/Source/WebCore/ChangeLog

    r143877 r143880  
     12013-02-24  Mike West  <mkwst@chromium.org>
     2
     3        CSP 1.1: Experiment with 'reflected-xss' directive.
     4        https://bugs.webkit.org/show_bug.cgi?id=104479
     5
     6        Reviewed by Adam Barth.
     7
     8        Content Security Policy 1.1 defines a 'reflected-xss' directive that
     9        works in much the same way as WebKit's current 'X-XSS-Protection'
     10        header[1]. This patch implements the new directive by parsing it
     11        inside ContentSecurityPolicy, and exposing that state to XSSAuditor.
     12
     13        XSSAuditor now grabs the CSP directive's state, and mixes it with the
     14        X-XSS-Protection header's state to determine how the page should be
     15        handled. Moreover, both headers' states are now expressed in terms of
     16        ContentSecurityPolicy::ReflectedXSSDisposition.
     17
     18        [1]: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#reflected-xss--experimental
     19
     20        Tests: http/tests/security/contentSecurityPolicy/1.1/reflected-xss-allow.html
     21               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-allow.html
     22               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-block.html
     23               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-filter.html
     24               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-invalid.html
     25               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-allow-unset.html
     26               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-allow.html
     27               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-block.html
     28               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-filter.html
     29               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-invalid.html
     30               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-block-unset.html
     31               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-allow.html
     32               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-block.html
     33               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-filter.html
     34               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-invalid.html
     35               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-filter-unset.html
     36               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-allow.html
     37               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-block.html
     38               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-filter.html
     39               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-invalid.html
     40               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-invalid-unset.html
     41               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-allow.html
     42               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-block.html
     43               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-filter.html
     44               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-invalid.html
     45               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-and-xss-protection-unset-unset.html
     46               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-block.html
     47               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-empty.html
     48               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-filter.html
     49               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-invalid.html
     50               http/tests/security/contentSecurityPolicy/1.1/reflected-xss-parsing.html
     51
     52        * html/parser/XSSAuditor.cpp:
     53        (WebCore::combineXSSProtectionHeaderAndCSP):
     54            Given both headers' states, return the state which the XSSAuditor
     55            should use when parsing a page. Blocking overrides filtering, which
     56            overrides disabling.
     57        (WebCore):
     58        (WebCore::XSSAuditor::init):
     59            Process the 'X-XSS-Protection' header before grabbing the CSP
     60            header's state. Both are passed into the new
     61            combineXSSProtectionHeaderAndCSP method to generate the final
     62            state that ought to be used.
     63        (WebCore::XSSAuditor::XSSAuditor):
     64        (WebCore::XSSAuditor::filterToken):
     65        * html/parser/XSSAuditor.h:
     66            Switch to ContentSecurityPolicy::ReflectedXSSDisposition internally
     67            in XSSAuditor.
     68        * page/ContentSecurityPolicy.cpp:
     69        (WebCore::CSPDirectiveList::reflectedXSSDisposition):
     70            Enum defining the possible state of the 'reflected-xss' CSP directive.
     71        (CSPDirectiveList):
     72        (WebCore::CSPDirectiveList::CSPDirectiveList):
     73        (WebCore::CSPDirectiveList::parseReflectedXSS):
     74            Given a 'reflected-xss' directive's value, set the
     75            ReflectedXSSDisposition into a new property on the CSPDirectiveList.
     76        (WebCore):
     77        (WebCore::CSPDirectiveList::addDirective):
     78            Accept 'reflected-xss' as a valid directive if we're in
     79            experimental mode.
     80        (WebCore::ContentSecurityPolicy::reflectedXSSDisposition):
     81            Expose the directive's state via the public API.
     82        (WebCore::ContentSecurityPolicy::reportInvalidReflectedXSS):
     83            Generate console errors when invalid reflected-xss directive values
     84            are encounted during parsing.
     85        * page/ContentSecurityPolicy.h:
     86        * platform/network/HTTPParsers.cpp:
     87        (WebCore::parseXSSProtectionHeader):
     88        * platform/network/HTTPParsers.h:
     89        (WebCore):
     90            Start using ContentSecurityPolicy::ReflectedXSSDisposition rather
     91            than the XSSProtectionDisposition enum.
     92
    1932013-02-24  Zan Dobersek  <zdobersek@igalia.com>
    294

  • trunk/Source/WebCore/html/parser/XSSAuditor.cpp

    r142712 r143880  
    2929
    3030#include "Console.h"
     31#include "ContentSecurityPolicy.h"
    3132#include "DOMWindow.h"
    3233#include "DecodeEscapeSequences.h"
    … …  
    174175}
    175176
     177static ContentSecurityPolicy::ReflectedXSSDisposition combineXSSProtectionHeaderAndCSP(ContentSecurityPolicy::ReflectedXSSDisposition xssProtection, ContentSecurityPolicy::ReflectedXSSDisposition reflectedXSS)
     178{
     179    ContentSecurityPolicy::ReflectedXSSDisposition result = std::max(xssProtection, reflectedXSS);
     180
     181    if (result == ContentSecurityPolicy::ReflectedXSSInvalid || result == ContentSecurityPolicy::FilterReflectedXSS || result == ContentSecurityPolicy::ReflectedXSSUnset)
     182        return ContentSecurityPolicy::FilterReflectedXSS;
     183
     184    return result;
     185}
     186
    176187XSSAuditor::XSSAuditor()
    177188    : m_isEnabled(false)
    178     , m_xssProtection(XSSProtectionEnabled)
     189    , m_xssProtection(ContentSecurityPolicy::FilterReflectedXSS)
    179190    , m_state(Uninitialized)
    180191    , m_scriptTagNestingLevel(0)
    … …  
    237248        unsigned errorPosition = 0;
    238249        String reportURL;
    239         m_xssProtection = parseXSSProtectionHeader(headerValue, errorDetails, errorPosition, reportURL);
    240 
    241         if ((m_xssProtection == XSSProtectionEnabled || m_xssProtection == XSSProtectionBlockEnabled) && !reportURL.isEmpty()) {
    242             m_reportURL = document->completeURL(reportURL);
    243             if (MixedContentChecker::isMixedContent(document->securityOrigin(), m_reportURL)) {
     250        KURL xssProtectionReportURL;
     251
     252        // Process the X-XSS-Protection header, then mix in the CSP header's value.
     253        ContentSecurityPolicy::ReflectedXSSDisposition xssProtectionHeader = parseXSSProtectionHeader(headerValue, errorDetails, errorPosition, reportURL);
     254        if ((xssProtectionHeader == ContentSecurityPolicy::FilterReflectedXSS || xssProtectionHeader == ContentSecurityPolicy::BlockReflectedXSS) && !reportURL.isEmpty()) {
     255            xssProtectionReportURL = document->completeURL(reportURL);
     256            if (MixedContentChecker::isMixedContent(document->securityOrigin(), xssProtectionReportURL)) {
    244257                errorDetails = "insecure reporting URL for secure page";
    245                 m_xssProtection = XSSProtectionInvalid;
    246                 m_reportURL = KURL();
     258                xssProtectionHeader = ContentSecurityPolicy::ReflectedXSSInvalid;
     259                xssProtectionReportURL = KURL();
    247260            }
    248261        }
    249 
    250         if (m_xssProtection == XSSProtectionInvalid) {
     262        if (xssProtectionHeader == ContentSecurityPolicy::ReflectedXSSInvalid)
    251263            document->addConsoleMessage(JSMessageSource, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue + ": "  + errorDetails + " at character position " + String::format("%u", errorPosition) + ". The default protections will be applied.");
    252             m_xssProtection = XSSProtectionEnabled;
    253         }
     264
     265        m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader, document->contentSecurityPolicy()->reflectedXSSDisposition());
     266        m_reportURL = xssProtectionReportURL; // FIXME: Combine the two report URLs in some reasonable way.
    254267
    255268        FormData* httpBody = documentLoader->originalRequest().httpBody();
    … …  
    281294{
    282295    ASSERT(m_state == Initialized);
    283     if (!m_isEnabled || m_xssProtection == XSSProtectionDisabled)
     296    if (!m_isEnabled || m_xssProtection == ContentSecurityPolicy::AllowReflectedXSS)
    284297        return nullptr;
    285298
    … …  
    295308
    296309    if (didBlockScript) {
    297         bool didBlockEntirePage = (m_xssProtection == XSSProtectionBlockEnabled);
     310        bool didBlockEntirePage = (m_xssProtection == ContentSecurityPolicy::BlockReflectedXSS);
    298311        OwnPtr<XSSInfo> xssInfo = XSSInfo::create(m_reportURL, m_originalURL, m_originalHTTPBody, didBlockEntirePage);
    299312        if (!m_reportURL.isEmpty()) {

  • trunk/Source/WebCore/html/parser/XSSAuditor.h

    r142522 r143880  
    102102    KURL m_documentURL;
    103103    bool m_isEnabled;
    104     XSSProtectionDisposition m_xssProtection;
     104    ContentSecurityPolicy::ReflectedXSSDisposition m_xssProtection;
    105105
    106106    String m_originalURL;

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r142506 r143880  
    121121static const char pluginTypes[] = "plugin-types";
    122122static const char scriptNonce[] = "script-nonce";
     123static const char reflectedXSS[] = "reflected-xss";
    123124#endif
    124125
    … …  
    140141        || equalIgnoringCase(name, pluginTypes)
    141142        || equalIgnoringCase(name, scriptNonce)
     143        || equalIgnoringCase(name, reflectedXSS)
    142144#endif
    143145    );
    … …  
    840842    void gatherReportURIs(DOMStringList&) const;
    841843    const String& evalDisabledErrorMessage() { return m_evalDisabledErrorMessage; }
     844    ContentSecurityPolicy::ReflectedXSSDisposition reflectedXSSDisposition() const { return m_reflectedXSSDisposition; }
    842845
    843846private:
    … …  
    850853    void parseScriptNonce(const String& name, const String& value);
    851854    void parsePluginTypes(const String& name, const String& value);
     855    void parseReflectedXSS(const String& name, const String& value);
    852856    void addDirective(const String& name, const String& value);
    853857    void applySandboxPolicy(const String& name, const String& sandboxPolicy);
    … …  
    884888    bool m_reportOnly;
    885889    bool m_haveSandboxPolicy;
     890    ContentSecurityPolicy::ReflectedXSSDisposition m_reflectedXSSDisposition;
    886891
    887892    OwnPtr<MediaListDirective> m_pluginTypes;
    … …  
    909914    , m_reportOnly(false)
    910915    , m_haveSandboxPolicy(false)
     916    , m_reflectedXSSDisposition(ContentSecurityPolicy::ReflectedXSSUnset)
    911917{
    912918    m_reportOnly = (type == ContentSecurityPolicy::ReportStableDirectives || type == ContentSecurityPolicy::ReportAllDirectives);
    … …  
    13141320    if (!invalidTokens.isNull())
    13151321        m_policy->reportInvalidSandboxFlags(invalidTokens);
     1322}
     1323
     1324void CSPDirectiveList::parseReflectedXSS(const String& name, const String& value)
     1325{
     1326    if (m_reflectedXSSDisposition != ContentSecurityPolicy::ReflectedXSSUnset) {
     1327        m_policy->reportDuplicateDirective(name);
     1328        m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;
     1329        return;
     1330    }
     1331
     1332    if (value.isEmpty()) {
     1333        m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;
     1334        m_policy->reportInvalidReflectedXSS(value);
     1335        return;
     1336    }
     1337
     1338    const UChar* position = value.characters();
     1339    const UChar* end = position + value.length();
     1340
     1341    skipWhile<isASCIISpace>(position, end);
     1342    const UChar* begin = position;
     1343    skipWhile<isNotASCIISpace>(position, end);
     1344
     1345    // value1
     1346    //       ^
     1347    if (equalIgnoringCase("allow", begin, position - begin))
     1348        m_reflectedXSSDisposition = ContentSecurityPolicy::AllowReflectedXSS;
     1349    else if (equalIgnoringCase("filter", begin, position - begin))
     1350        m_reflectedXSSDisposition = ContentSecurityPolicy::FilterReflectedXSS;
     1351    else if (equalIgnoringCase("block", begin, position - begin))
     1352        m_reflectedXSSDisposition = ContentSecurityPolicy::BlockReflectedXSS;
     1353    else {
     1354        m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;
     1355        m_policy->reportInvalidReflectedXSS(value);
     1356        return;
     1357    }
     1358
     1359    skipWhile<isASCIISpace>(position, end);
     1360    if (position == end && m_reflectedXSSDisposition != ContentSecurityPolicy::ReflectedXSSUnset)
     1361        return;
     1362
     1363    // value1 value2
     1364    //        ^
     1365    m_reflectedXSSDisposition = ContentSecurityPolicy::ReflectedXSSInvalid;
     1366    m_policy->reportInvalidReflectedXSS(value);
    13161367}
    13171368
    … …  
    13501401        else if (equalIgnoringCase(name, scriptNonce))
    13511402            setCSPDirective<NonceDirective>(name, value, m_scriptNonce);
     1403        else if (equalIgnoringCase(name, reflectedXSS))
     1404            parseReflectedXSS(name, value);
    13521405    }
    13531406#endif
    … …  
    15701623{
    15711624    return !m_policies.isEmpty();
     1625}
     1626
     1627ContentSecurityPolicy::ReflectedXSSDisposition ContentSecurityPolicy::reflectedXSSDisposition() const
     1628{
     1629    ReflectedXSSDisposition disposition = ReflectedXSSUnset;
     1630    for (size_t i = 0; i < m_policies.size(); ++i) {
     1631        if (m_policies[i]->reflectedXSSDisposition() > disposition)
     1632            disposition = std::max(disposition, m_policies[i]->reflectedXSSDisposition());
     1633    }
     1634    return disposition;
    15721635}
    15731636
    … …  
    17061769}
    17071770
     1771void ContentSecurityPolicy::reportInvalidReflectedXSS(const String& invalidValue) const
     1772{
     1773    logToConsole("The 'reflected-xss' Content Security Policy directive has the invalid value \"" + invalidValue + "\". Value values are \"allow\", \"filter\", and \"block\".");
     1774}
     1775
    17081776void ContentSecurityPolicy::reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value) const
    17091777{

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r136305 r143880  
    7272    };
    7373
     74    // Be sure to update the behavior of XSSAuditor::combineXSSProtectionHeaderAndCSP whenever you change this enum's content or ordering.
     75    enum ReflectedXSSDisposition {
     76        ReflectedXSSUnset = 0,
     77        AllowReflectedXSS,
     78        ReflectedXSSInvalid,
     79        FilterReflectedXSS,
     80        BlockReflectedXSS
     81    };
     82
    7483    void didReceiveHeader(const String&, HeaderType);
    7584
    … …  
    97106    bool allowFormAction(const KURL&, ReportingStatus = SendReport) const;
    98107
     108    ReflectedXSSDisposition reflectedXSSDisposition() const;
     109
    99110    void setOverrideAllowInlineStyle(bool);
    100111
    … …  
    110121    void reportInvalidSandboxFlags(const String&) const;
    111122    void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
     123    void reportInvalidReflectedXSS(const String&) const;
    112124    void reportUnsupportedDirective(const String&) const;
    113125    void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;

  • trunk/Source/WebCore/platform/network/HTTPParsers.cpp

    r142683 r143880  
    3434#include "HTTPParsers.h"
    3535
     36#include "ContentSecurityPolicy.h"
    3637#include <wtf/DateMath.h>
    3738#include <wtf/text/CString.h>
    … …  
    341342}
    342343
    343 XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL)
     344ContentSecurityPolicy::ReflectedXSSDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL)
    344345{
    345346    DEFINE_STATIC_LOCAL(String, failureReasonInvalidToggle, (ASCIILiteral("expected 0 or 1")));
    … …  
    355356
    356357    if (!skipWhiteSpace(header, pos, false))
    357         return XSSProtectionEnabled;
     358        return ContentSecurityPolicy::ReflectedXSSUnset;
    358359
    359360    if (header[pos] == '0')
    360         return XSSProtectionDisabled;
     361        return ContentSecurityPolicy::AllowReflectedXSS;
    361362
    362363    if (header[pos++] != '1') {
    363364        failureReason = failureReasonInvalidToggle;
    364         return XSSProtectionInvalid;
    365     }
    366 
    367     XSSProtectionDisposition result = XSSProtectionEnabled;
     365        return ContentSecurityPolicy::ReflectedXSSInvalid;
     366    }
     367
     368    ContentSecurityPolicy::ReflectedXSSDisposition result = ContentSecurityPolicy::FilterReflectedXSS;
    368369    bool modeDirectiveSeen = false;
    369370    bool reportDirectiveSeen = false;
    … …  
    377378            failureReason = failureReasonInvalidSeparator;
    378379            failurePosition = pos;
    379             return XSSProtectionInvalid;
     380            return ContentSecurityPolicy::ReflectedXSSInvalid;
    380381        }
    381382
    … …  
    388389                failureReason = failureReasonDuplicateMode;
    389390                failurePosition = pos;
    390                 return XSSProtectionInvalid;
     391                return ContentSecurityPolicy::ReflectedXSSInvalid;
    391392            }
    392393            modeDirectiveSeen = true;
    … …  
    394395                failureReason = failureReasonInvalidEquals;
    395396                failurePosition = pos;
    396                 return XSSProtectionInvalid;
     397                return ContentSecurityPolicy::ReflectedXSSInvalid;
    397398            }
    398399            if (!skipToken(header, pos, "block")) {
    399400                failureReason = failureReasonInvalidMode;
    400401                failurePosition = pos;
    401                 return XSSProtectionInvalid;
    402             }
    403             result = XSSProtectionBlockEnabled;
     402                return ContentSecurityPolicy::ReflectedXSSInvalid;
     403            }
     404            result = ContentSecurityPolicy::BlockReflectedXSS;
    404405        } else if (skipToken(header, pos, "report")) {
    405406            if (reportDirectiveSeen) {
    406407                failureReason = failureReasonDuplicateReport;
    407408                failurePosition = pos;
    408                 return XSSProtectionInvalid;
     409                return ContentSecurityPolicy::ReflectedXSSInvalid;
    409410            }
    410411            reportDirectiveSeen = true;
    … …  
    412413                failureReason = failureReasonInvalidEquals;
    413414                failurePosition = pos;
    414                 return XSSProtectionInvalid;
     415                return ContentSecurityPolicy::ReflectedXSSInvalid;
    415416            }
    416417            size_t startPos = pos;
    … …  
    418419                failureReason = failureReasonInvalidReport;
    419420                failurePosition = pos;
    420                 return XSSProtectionInvalid;
     421                return ContentSecurityPolicy::ReflectedXSSInvalid;
    421422            }
    422423            reportURL = header.substring(startPos, pos - startPos);
    … …  
    425426            failureReason = failureReasonInvalidDirective;
    426427            failurePosition = pos;
    427             return XSSProtectionInvalid;
     428            return ContentSecurityPolicy::ReflectedXSSInvalid;
    428429        }
    429430    }

  • trunk/Source/WebCore/platform/network/HTTPParsers.h

    r142683 r143880  
    3232#define HTTPParsers_h
    3333
     34#include "ContentSecurityPolicy.h"
    3435#include <wtf/Forward.h>
    3536#include <wtf/Vector.h>
    … …  
    3940class HTTPHeaderMap;
    4041class ResourceResponseBase;
    41 
    42 enum XSSProtectionDisposition {
    43     XSSProtectionInvalid,
    44     XSSProtectionDisabled,
    45     XSSProtectionEnabled,
    46     XSSProtectionBlockEnabled
    47 };
    4842
    4943typedef enum {
    … …  
    6963String extractCharsetFromMediaType(const String&);
    7064void findCharsetInMediaType(const String& mediaType, unsigned int& charsetPos, unsigned int& charsetLen, unsigned int start = 0);
    71 XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL);
     65ContentSecurityPolicy::ReflectedXSSDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL);
    7266String extractReasonPhraseFromHTTPStatusLine(const String&);
    7367
Note: See TracChangeset for help on using the changeset viewer.