Changeset 194209 in webkit


Ignore:
Timestamp:
Dec 16, 2015 9:53:40 PM (8 years ago)
Author:
aestes@apple.com
Message:

[iOS] Block loading external stylesheets in the Content-Disposition: attachment sandbox
​https://bugs.webkit.org/show_bug.cgi?id=152375
<rdar://problem/22020902>

Reviewed by Darin Adler.

Source/WebCore:

Tests: http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled.html

http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled.html
http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled.html

  • loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::canRequest): Moved handling of CachedResource::MainResource to canRequestInContentDispositionAttachmentSandbox().
(WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox): In addition to handling CachedResource::MainResource,
added handling for CachedResource::CSSStyleSheet. Added a FIXME asking whether we should handle other types of resources, too.

  • loader/cache/CachedResourceLoader.h:

LayoutTests:

  • http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled-expected.txt: Added.
  • http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled.html: Added.
  • http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled-expected.txt:
  • http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled-expected.txt: Added.
  • http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled.html: Added.
  • http/tests/contentdispositionattachmentsandbox/resources/at-import-stylesheets-frame.php: Added.
  • http/tests/contentdispositionattachmentsandbox/resources/external-stylesheets-frame.php: Added.
  • http/tests/contentdispositionattachmentsandbox/resources/xml-stylesheet-processing-instructions-frame.php: Added.
  • http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled-expected.txt: Added.
  • http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled.html: Added.
Location:
trunk
Files:
9 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r194167 r194209  
     12015-12-16  Andy Estes  <aestes@apple.com>
     2
     3        [iOS] Block loading external stylesheets in the Content-Disposition: attachment sandbox
     4        https://bugs.webkit.org/show_bug.cgi?id=152375
     5        <rdar://problem/22020902>
     6
     7        Reviewed by Darin Adler.
     8
     9        * http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled-expected.txt: Added.
     10        * http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled.html: Added.
     11        * http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled-expected.txt:
     12        * http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled-expected.txt: Added.
     13        * http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled.html: Added.
     14        * http/tests/contentdispositionattachmentsandbox/resources/at-import-stylesheets-frame.php: Added.
     15        * http/tests/contentdispositionattachmentsandbox/resources/external-stylesheets-frame.php: Added.
     16        * http/tests/contentdispositionattachmentsandbox/resources/xml-stylesheet-processing-instructions-frame.php: Added.
     17        * http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled-expected.txt: Added.
     18        * http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled.html: Added.
     19
    1202015-12-16  Ryan Haddad  <ryanhaddad@apple.com>
    221

  • trunk/LayoutTests/http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled-expected.txt

    r186982 r194209  
    1 CONSOLE MESSAGE: Unsafe attempt to load URL data:text/html,FAIL.
     1CONSOLE MESSAGE: line 2: Unsafe attempt to load URL data:text/html,FAIL from document with Content-Disposition: attachment at URL http://127.0.0.1:8000/contentdispositionattachmentsandbox/resources/cross-origin-frames-frame.php.
    22This test verifies that cross-origin frames are disabled when 'Content-Disposition: attachment' sandboxing is enabled. A security error will be logged to the console if the test passes.
    33

  • trunk/Source/WebCore/ChangeLog

    r194206 r194209  
     12015-12-16  Andy Estes  <aestes@apple.com>
     2
     3        [iOS] Block loading external stylesheets in the Content-Disposition: attachment sandbox
     4        https://bugs.webkit.org/show_bug.cgi?id=152375
     5        <rdar://problem/22020902>
     6
     7        Reviewed by Darin Adler.
     8
     9        Tests: http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled.html
     10               http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled.html
     11               http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled.html
     12
     13        * loader/cache/CachedResourceLoader.cpp:
     14        (WebCore::CachedResourceLoader::canRequest): Moved handling of CachedResource::MainResource to canRequestInContentDispositionAttachmentSandbox().
     15        (WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox): In addition to handling CachedResource::MainResource,
     16        added handling for CachedResource::CSSStyleSheet. Added a FIXME asking whether we should handle other types of resources, too.
     17        * loader/cache/CachedResourceLoader.h:
     18
    1192015-12-16  Simon Fraser  <simon.fraser@apple.com>
    220

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r192995 r194209  
    375375    switch (type) {
    376376    case CachedResource::MainResource:
    377         if (HTMLFrameOwnerElement* ownerElement = frame() ? frame()->ownerElement() : nullptr) {
    378             if (ownerElement->document().shouldEnforceContentDispositionAttachmentSandbox() && !ownerElement->document().securityOrigin()->canRequest(url)) {
    379                 printAccessDeniedMessage(url);
    380                 return false;
    381             }
    382         }
    383         FALLTHROUGH;
    384377    case CachedResource::ImageResource:
    385378    case CachedResource::CSSStyleSheet:
    … …  
    464457    }
    465458
     459    if (!canRequestInContentDispositionAttachmentSandbox(type, url))
     460        return false;
     461
    466462    // Last of all, check for insecure content. We do this last so that when
    467463    // folks block insecure content with a CSP policy, they don't get a warning.
    … …  
    473469
    474470    return true;
     471}
     472
     473bool CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox(CachedResource::Type type, const URL& url) const
     474{
     475    Document* document;
     476   
     477    // FIXME: Do we want to expand this to all resource types that the mixed content checker would consider active content?
     478    switch (type) {
     479    case CachedResource::MainResource:
     480        if (auto ownerElement = frame() ? frame()->ownerElement() : nullptr) {
     481            document = &ownerElement->document();
     482            break;
     483        }
     484        return true;
     485    case CachedResource::CSSStyleSheet:
     486        document = m_document;
     487        break;
     488    default:
     489        return true;
     490    }
     491
     492    if (!document->shouldEnforceContentDispositionAttachmentSandbox() || document->securityOrigin()->canRequest(url))
     493        return true;
     494
     495    String message = "Unsafe attempt to load URL " + url.stringCenterEllipsizedToLength() + " from document with Content-Disposition: attachment at URL " + document->url().stringCenterEllipsizedToLength() + ".";
     496    document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, message);
     497    return false;
    475498}
    476499

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.h

    r191369 r194209  
    158158    bool clientDefersImage(const URL&) const;
    159159    void reloadImagesIfNotDeferred();
     160
     161    bool canRequestInContentDispositionAttachmentSandbox(CachedResource::Type, const URL&) const;
    160162   
    161163    HashSet<String> m_validatedURLs;
Note: See TracChangeset for help on using the changeset viewer.