Changeset 146758 in webkit


Ignore:
Timestamp:
Mar 25, 2013 5:20:23 AM (11 years ago)
Author:
mkwst@chromium.org
Message:

CSP 1.1: Strip URLs in SecurityPolicyViolationEvents, just as we do for POSTed violation reports.
​https://bugs.webkit.org/show_bug.cgi?id=113039

Reviewed by Jochen Eisinger.

Source/WebCore:

I'd originally assumed that we didn't need to be quite so careful when
handing URLs to JavaScript via SecurityPolicyViolationEvents. This was
a mistake. Cross-origin URLs aren't accessible to JavaScript currently
and there's no reason that we should begin exposing them via an event.

This patch extracts the stripping logic from the existing reports into
stripURLForUseInReport(), and uses that new method when populating the
event and report objects.

Relatedly, we were doing the wrong thing with 'file:' URLs, which this
patch made clear. Now they're treated the same as 'data:' et al.

Spec: ​https://dvcs.w3.org/hg/content-security-policy/rev/45f6ccaba0ef

Tests: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html
http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html

  • page/ContentSecurityPolicy.cpp:

(WebCore::stripURLForUseInReport):

Extract the logic from blockedURI out into a reusable method:
cross-origin URLs are stripped down to the ASCII serialization of
their origin, and non-heirarchical (and 'file:') URLs are stripped
down to the ASCII serialization of their protocol.

(WebCore::gatherSecurityPolicyViolationEventData):
(WebCore::ContentSecurityPolicy::reportViolation):

Use ::stripURLForUseInReport for blockedURL and sourceFile
attributes in these two methods.

LayoutTests:

  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Added.
  • http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html:
  • http/tests/security/contentSecurityPolicy/resources/securitypolicyviolation-test.js: Added.

Updating tests to cover cross-origin scenarios: load cross-origin
images, and cross-origin scripts that inject images. The former
should strip the image URL down to the origin, the latter the
script URL.

  • http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html: Added.
  • platform/chromium/http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Added.
  • platform/gtk/http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Added.

This patch changes the behavior of 'file:' URLs to behave similarly
to 'data:'/'blob:', etc. We weren't previously testing this, now we
are. We need platform-specific results for Chromium and GTK, since
those ports have enabled CSP_NEXT, which adds a field to the report.

Location:
trunk
Files:
8 added
5 edited
3 copied

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r146756 r146758  
     12013-03-25  Mike West  <mkwst@chromium.org>
     2
     3        CSP 1.1: Strip URLs in SecurityPolicyViolationEvents, just as we do for POSTed violation reports.
     4        https://bugs.webkit.org/show_bug.cgi?id=113039
     5
     6        Reviewed by Jochen Eisinger.
     7
     8        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt.
     9        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt.
     10        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Added.
     11        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Added.
     12        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt:
     13        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt.
     14        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Added.
     15        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html:
     16        * http/tests/security/contentSecurityPolicy/resources/securitypolicyviolation-test.js: Added.
     17            Updating tests to cover cross-origin scenarios: load cross-origin
     18            images, and cross-origin scripts that inject images. The former
     19            should strip the image URL down to the origin, the latter the
     20            script URL.
     21        * http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Added.
     22        * http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html: Added.
     23        * platform/chromium/http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Added.
     24        * platform/gtk/http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Added.
     25            This patch changes the behavior of 'file:' URLs to behave similarly
     26            to 'data:'/'blob:', etc. We weren't previously testing this, now we
     27            are. We need platform-specific results for Chromium and GTK, since
     28            those ports have enabled CSP_NEXT, which adds a field to the report.
     29
    1302013-03-25  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
    231

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt

    r146757 r146758  
    1 CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".
     1CONSOLE MESSAGE: Refused to load the image 'http://localhost:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".
    22
    3 Check that a SecurityPolicyViolationEvent is fired upon blocking an image.
     3Check that a SecurityPolicyViolationEvent strips detail from cross-origin blocked URLs.
    44
    55On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
    66
    77
    8 PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
     8Kicking off the tests:
     9PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html"
    910PASS window.e.referrer is ""
    10 PASS window.e.blockedURI is "http://127.0.0.1:8000/security/resources/abe.png"
     11PASS window.e.blockedURI is "http://localhost:8000"
    1112PASS window.e.violatedDirective is "img-src 'none'"
    1213PASS window.e.effectiveDirective is "img-src"
    1314PASS window.e.originalPolicy is "img-src 'none'"
    14 PASS window.e.sourceURL is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    15 PASS window.e.lineNumber is 30
     15PASS window.e.sourceURL is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html"
     16PASS window.e.lineNumber is 23
    1617PASS successfullyParsed is true
    1718

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt

    r146757 r146758  
    11CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".
    22
    3 Check that a SecurityPolicyViolationEvent is fired upon blocking an image.
     3Check that a SecurityPolicyViolationEvent strips detail from cross-origin URLs upon blocking an image injected via script.
    44
    55On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
    66
    77
    8 PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
     8Kicking off the tests:
     9PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html"
    910PASS window.e.referrer is ""
    1011PASS window.e.blockedURI is "http://127.0.0.1:8000/security/resources/abe.png"
    … …  
    1213PASS window.e.effectiveDirective is "img-src"
    1314PASS window.e.originalPolicy is "img-src 'none'"
    14 PASS window.e.sourceURL is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    15 PASS window.e.lineNumber is 30
     15PASS window.e.sourceURL is "http://localhost:8000"
     16PASS window.e.lineNumber is 3
    1617PASS successfullyParsed is true
    1718

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt

    r146520 r146758  
    66
    77
     8Kicking off the tests:
    89PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    910PASS window.e.referrer is ""
    … …  
    1314PASS window.e.originalPolicy is "img-src 'none'"
    1415PASS window.e.sourceURL is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    15 PASS window.e.lineNumber is 30
     16PASS window.e.lineNumber is 23
    1617PASS successfullyParsed is true
    1718

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt

    r146757 r146758  
    11CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".
    22
    3 Check that a SecurityPolicyViolationEvent is fired upon blocking an image.
     3Check that a SecurityPolicyViolationEvent is fired upon blocking an image injected via script.
    44
    55On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
    66
    77
    8 PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
     8Kicking off the tests:
     9PASS window.e.documentURI is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html"
    910PASS window.e.referrer is ""
    1011PASS window.e.blockedURI is "http://127.0.0.1:8000/security/resources/abe.png"
    … …  
    1213PASS window.e.effectiveDirective is "img-src"
    1314PASS window.e.originalPolicy is "img-src 'none'"
    14 PASS window.e.sourceURL is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"
    15 PASS window.e.lineNumber is 30
     15PASS window.e.sourceURL is "http://127.0.0.1:8000/security/contentSecurityPolicy/resources/inject-image.js"
     16PASS window.e.lineNumber is 3
    1617PASS successfullyParsed is true
    1718

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html

    r146520 r146758  
    44    <meta http-equiv="Content-Security-Policy" content="img-src 'none'">
    55    <script src="/js-test-resources/js-test-pre.js"></script>
     6    <script src="../resources/securitypolicyviolation-test.js"></script>
    67    <script>
    78        description('Check that a SecurityPolicyViolationEvent is fired upon blocking an image.');
    89
    9         window.jsTestIsAsync = true;
     10        var expectations = {
     11            'documentURI': document.location.toString(),
     12            'referrer': document.referrer,
     13            'blockedURI': 'http://127.0.0.1:8000/security/resources/abe.png',
     14            'violatedDirective': 'img-src \'none\'',
     15            'effectiveDirective': 'img-src',
     16            'originalPolicy': 'img-src \'none\'',
     17            'sourceURL': document.location.toString(),
     18            'lineNumber': 23
     19        };
    1020
    11         document.addEventListener('securitypolicyviolation', function handleEvent(e) {
    12             var expectations = {
    13                 'documentURI': document.location.toString(),
    14                 'referrer': document.referrer,
    15                 'blockedURI': 'http://127.0.0.1:8000/security/resources/abe.png',
    16                 'violatedDirective': 'img-src \'none\'',
    17                 'effectiveDirective': 'img-src',
    18                 'originalPolicy': 'img-src \'none\'',
    19                 'sourceURL': document.location.toString(),
    20                 'lineNumber': 30
    21             };
    22             window.e = e;
    23             for (key in expectations)
    24                 shouldBe('window.e.' + key, JSON.stringify(expectations[key]));
    25             finishJSTest();
    26         });
    27 
    28         window.onload = function () {
     21        function run() {
    2922            var img = document.createElement('img');
    3023            img.src = '/security/resources/abe.png';
    3124            document.body.appendChild(img);
    32         };
     25        }
    3326    </script>
    3427    <script src="/js-test-resources/js-test-post.js"></script>

  • trunk/Source/WebCore/ChangeLog

    r146757 r146758  
     12013-03-25  Mike West  <mkwst@chromium.org>
     2
     3        CSP 1.1: Strip URLs in SecurityPolicyViolationEvents, just as we do for POSTed violation reports.
     4        https://bugs.webkit.org/show_bug.cgi?id=113039
     5
     6        Reviewed by Jochen Eisinger.
     7
     8        I'd originally assumed that we didn't need to be quite so careful when
     9        handing URLs to JavaScript via SecurityPolicyViolationEvents. This was
     10        a mistake. Cross-origin URLs aren't accessible to JavaScript currently
     11        and there's no reason that we should begin exposing them via an event.
     12
     13        This patch extracts the stripping logic from the existing reports into
     14        stripURLForUseInReport(), and uses that new method when populating the
     15        event and report objects.
     16
     17        Relatedly, we were doing the wrong thing with 'file:' URLs, which this
     18        patch made clear. Now they're treated the same as 'data:' et al.
     19
     20        Spec: https://dvcs.w3.org/hg/content-security-policy/rev/45f6ccaba0ef
     21
     22        Tests: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html
     23               http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html
     24               http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html
     25               http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html
     26
     27        * page/ContentSecurityPolicy.cpp:
     28        (WebCore::stripURLForUseInReport):
     29            Extract the logic from blockedURI out into a reusable method:
     30            cross-origin URLs are stripped down to the ASCII serialization of
     31            their origin, and non-heirarchical (and 'file:') URLs are stripped
     32            down to the ASCII serialization of their protocol.
     33        (WebCore::gatherSecurityPolicyViolationEventData):
     34        (WebCore::ContentSecurityPolicy::reportViolation):
     35            Use ::stripURLForUseInReport for blockedURL and sourceFile
     36            attributes in these two methods.
     37
    1382013-03-25  Eugene Klyuchnikov  <eustas@chromium.org>
    239

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r146755 r146758  
    16731673}
    16741674
     1675static String stripURLForUseInReport(Document* document, const KURL& url)
     1676{
     1677    if (!url.isValid())
     1678        return String();
     1679    if (!url.isHierarchical() || url.protocolIs("file"))
     1680        return url.protocol();
     1681    return document->securityOrigin()->canRequest(url) ? url.strippedForUseAsReferrer() : SecurityOrigin::create(url)->toString();
     1682}
     1683
    16751684#if ENABLE(CSP_NEXT)
    16761685static void gatherSecurityPolicyViolationEventData(SecurityPolicyViolationEventInit& init, Document* document, const String& directiveText, const String& effectiveDirective, const KURL& blockedURL, const String& header)
    … …  
    16781687    init.documentURI = document->url().string();
    16791688    init.referrer = document->referrer();
    1680     init.blockedURI = blockedURL.isValid() ? blockedURL.string() : String();
     1689    init.blockedURI = stripURLForUseInReport(document, blockedURL);
    16811690    init.violatedDirective = directiveText;
    16821691    init.effectiveDirective = effectiveDirective;
    … …  
    16931702    if (callFrame.lineNumber()) {
    16941703        KURL source = KURL(ParsedURLString, callFrame.sourceURL());
    1695         init.sourceURL = source.string();
     1704        init.sourceURL = stripURLForUseInReport(document, source);
    16961705        init.lineNumber = callFrame.lineNumber();
    16971706    }
    … …  
    17451754#endif
    17461755    cspReport->setString("original-policy", header);
    1747     if (blockedURL.isValid())
    1748         if (blockedURL.isHierarchical())
    1749             cspReport->setString("blocked-uri", document->securityOrigin()->canRequest(blockedURL) ? blockedURL.strippedForUseAsReferrer() : SecurityOrigin::create(blockedURL)->toString());
    1750         else
    1751             cspReport->setString("blocked-uri", blockedURL.protocol());
    1752     else
    1753         cspReport->setString("blocked-uri", String());
     1756    cspReport->setString("blocked-uri", stripURLForUseInReport(document, blockedURL));
    17541757
    17551758    RefPtr<ScriptCallStack> stack = createScriptCallStack(2, false);
    … …  
    17591762        if (callFrame.lineNumber()) {
    17601763            KURL source = KURL(ParsedURLString, callFrame.sourceURL());
    1761             cspReport->setString("source-file", document->securityOrigin()->canRequest(source) ? source.strippedForUseAsReferrer() : SecurityOrigin::create(source)->toString());
     1764            cspReport->setString("source-file", stripURLForUseInReport(document, source));
    17621765            cspReport->setNumber("line-number", callFrame.lineNumber());
    17631766        }
Note: See TracChangeset for help on using the changeset viewer.