Changeset 196582 in webkit

Timestamp:

Feb 15, 2016 10:54:30 AM (8 years ago)

Author:

dbates@webkit.org

Message:

CSP: 'sandbox' should be ignored in report-only mode
​https://bugs.webkit.org/show_bug.cgi?id=153167
<rdar://problem/22708669>

Reviewed by Brent Fulgham.

Source/WebCore:

Merged from Blink (patch by Mike West):
<​https://src.chromium.org/viewvc/blink?revision=165322&view=revision>

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode): Added. Logs a
console message to the console to explain that the specified directive is invalid in
report-only mode.

• page/csp/ContentSecurityPolicy.h:
• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::applySandboxPolicy): Do not apply sandbox
policy when in report-only mode and call ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode()
to log a message to the console.

LayoutTests:

Remove the entry from the TestExpectations file for the test
http/tests/security/contentSecurityPolicy/sandbox-report-only.html as it now passes.

• TestExpectations:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/csp/ContentSecurityPolicy.cpp (modified) (1 diff)
• Source/WebCore/page/csp/ContentSecurityPolicy.h (modified) (1 diff)
• Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-02-15  Daniel Bates  <dabates@apple.com>
+
+        CSP: 'sandbox' should be ignored in report-only mode
+        https://bugs.webkit.org/show_bug.cgi?id=153167
+        <rdar://problem/22708669>
+
+        Reviewed by Brent Fulgham.
+
+        Remove the entry from the TestExpectations file for the test
+        http/tests/security/contentSecurityPolicy/sandbox-report-only.html as it now passes.
+
+        * TestExpectations:
+
 2016-02-15  Daniel Bates  <dabates@apple.com>
 

trunk/LayoutTests/TestExpectations

@@ -834 +834 @@
 webkit.org/b/153166 webkit.org/b/153242 http/tests/security/contentSecurityPolicy/report-and-enforce.html [ Failure ]
 webkit.org/b/153166 webkit.org/b/153242 http/tests/security/contentSecurityPolicy/report-blocked-data-uri.html [ Failure ]
-webkit.org/b/153167 http/tests/security/contentSecurityPolicy/sandbox-report-only.html [ Failure ]
 webkit.org/b/153168 http/tests/security/contentSecurityPolicy/source-list-parsing-07.html [ Failure ]
 webkit.org/b/153170 http/tests/security/contentSecurityPolicy/source-list-parsing-paths-03.html [ Failure ]

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-02-15  Daniel Bates  <dabates@apple.com>
+
+        CSP: 'sandbox' should be ignored in report-only mode
+        https://bugs.webkit.org/show_bug.cgi?id=153167
+        <rdar://problem/22708669>
+
+        Reviewed by Brent Fulgham.
+
+        Merged from Blink (patch by Mike West):
+        <https://src.chromium.org/viewvc/blink?revision=165322&view=revision>
+
+        * page/csp/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode): Added. Logs a
+        console message to the console to explain that the specified directive is invalid in
+        report-only mode.
+        * page/csp/ContentSecurityPolicy.h:
+        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
+        (WebCore::ContentSecurityPolicyDirectiveList::applySandboxPolicy): Do not apply sandbox
+        policy when in report-only mode and call ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode()
+        to log a message to the console.
+
 2016-02-15  Daniel Bates  <dabates@apple.com>
 

trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

@@ -453 +453 @@
 }
 
+void ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode(const String& directiveName) const
+{
+    logToConsole("The Content Security Policy directive '" + directiveName + "' is ignored when delivered in a report-only policy.");
+}
+
 void ContentSecurityPolicy::reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value) const
 {

trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

@@ -123 +123 @@
     void reportInvalidSandboxFlags(const String&) const;
     void reportInvalidReflectedXSS(const String&) const;
+    void reportInvalidDirectiveInReportOnlyMode(const String&) const;
     void reportMissingReportURI(const String&) const;
     void reportUnsupportedDirective(const String&) const;

trunk/Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp

@@ -505 +505 @@
 void ContentSecurityPolicyDirectiveList::applySandboxPolicy(const String& name, const String& sandboxPolicy)
 {
+    if (m_reportOnly) {
+        m_policy.reportInvalidDirectiveInReportOnlyMode(name);
+        return;
+    }
     if (m_haveSandboxPolicy) {
         m_policy.reportDuplicateDirective(name);