Changeset 244294 in webkit


Ignore:
Timestamp:
Apr 15, 2019 2:53:48 PM (5 years ago)
Author:
Joseph Pecoraro
Message:

Web Inspector: SameSite parsing should be stricter
​https://bugs.webkit.org/show_bug.cgi?id=196927
<rdar://problem/42291601>

Reviewed by Devin Rousso.

Source/WebInspectorUI:

  • UserInterface/Models/Cookie.js:

(WI.Cookie.parseSameSiteAttributeValue):

LayoutTests:

  • inspector/unit-tests/cookie.html:
  • inspector/unit-tests/cookie-expected.txt:
Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r244288 r244294  
     12019-04-15  Joseph Pecoraro  <pecoraro@apple.com>
     2
     3        Web Inspector: SameSite parsing should be stricter
     4        https://bugs.webkit.org/show_bug.cgi?id=196927
     5        <rdar://problem/42291601>
     6
     7        Reviewed by Devin Rousso.
     8
     9        * inspector/unit-tests/cookie.html:
     10        * inspector/unit-tests/cookie-expected.txt:
     11
    1122019-04-15  John Wilander  <wilander@apple.com>
    213

  • trunk/LayoutTests/inspector/unit-tests/cookie-expected.txt

    r239226 r244294  
    5555PASS: cookie.secure should be 'false'.
    5656PASS: cookie.httpOnly should be 'false'.
     57PASS: cookie.sameSite should be 'None'.
    5758
    5859HEADER: Set-Cookie: name=value; path=/foo
    … …  
    6869PASS: cookie.secure should be 'false'.
    6970PASS: cookie.httpOnly should be 'false'.
     71PASS: cookie.sameSite should be 'None'.
    7072
    7173HEADER: Set-Cookie: name=value; domain=example.com
    … …  
    8183PASS: cookie.secure should be 'false'.
    8284PASS: cookie.httpOnly should be 'false'.
     85PASS: cookie.sameSite should be 'None'.
    8386
    8487HEADER: Set-Cookie: name=value; secure
    … …  
    9497PASS: cookie.secure should be 'true'.
    9598PASS: cookie.httpOnly should be 'false'.
     99PASS: cookie.sameSite should be 'None'.
    96100
    97101HEADER: Set-Cookie: name=value; Secure
    … …  
    107111PASS: cookie.secure should be 'true'.
    108112PASS: cookie.httpOnly should be 'false'.
     113PASS: cookie.sameSite should be 'None'.
    109114
    110115HEADER: Set-Cookie: name=value; HttpOnly
    … …  
    120125PASS: cookie.secure should be 'false'.
    121126PASS: cookie.httpOnly should be 'true'.
     127PASS: cookie.sameSite should be 'None'.
     128
     129HEADER: Set-Cookie: name=value; SameSite=lax
     130PASS: Value should be a WI.Cookie.
     131PASS: cookie.header should be the original header text.
     132PASS: cookie.type should be WI.Cookie.Type.Response.
     133PASS: cookie.name should be 'name'.
     134PASS: cookie.value should be 'value'.
     135PASS: cookie.expires should be 'null'.
     136PASS: cookie.maxAge should be 'null'.
     137PASS: cookie.path should be 'null'.
     138PASS: cookie.domain should be 'null'.
     139PASS: cookie.secure should be 'false'.
     140PASS: cookie.httpOnly should be 'false'.
     141PASS: cookie.sameSite should be 'Lax'.
     142
     143HEADER: Set-Cookie: name=value; SameSite=strict
     144PASS: Value should be a WI.Cookie.
     145PASS: cookie.header should be the original header text.
     146PASS: cookie.type should be WI.Cookie.Type.Response.
     147PASS: cookie.name should be 'name'.
     148PASS: cookie.value should be 'value'.
     149PASS: cookie.expires should be 'null'.
     150PASS: cookie.maxAge should be 'null'.
     151PASS: cookie.path should be 'null'.
     152PASS: cookie.domain should be 'null'.
     153PASS: cookie.secure should be 'false'.
     154PASS: cookie.httpOnly should be 'false'.
     155PASS: cookie.sameSite should be 'Strict'.
     156
     157HEADER: Set-Cookie: name=value; SameSite=invalid
     158PASS: Value should be a WI.Cookie.
     159PASS: cookie.header should be the original header text.
     160PASS: cookie.type should be WI.Cookie.Type.Response.
     161PASS: cookie.name should be 'name'.
     162PASS: cookie.value should be 'value'.
     163PASS: cookie.expires should be 'null'.
     164PASS: cookie.maxAge should be 'null'.
     165PASS: cookie.path should be 'null'.
     166PASS: cookie.domain should be 'null'.
     167PASS: cookie.secure should be 'false'.
     168PASS: cookie.httpOnly should be 'false'.
     169PASS: cookie.sameSite should be 'None'.
     170
     171HEADER: Set-Cookie: name=value; SameSite
     172PASS: Value should be a WI.Cookie.
     173PASS: cookie.header should be the original header text.
     174PASS: cookie.type should be WI.Cookie.Type.Response.
     175PASS: cookie.name should be 'name'.
     176PASS: cookie.value should be 'value'.
     177PASS: cookie.expires should be 'null'.
     178PASS: cookie.maxAge should be 'null'.
     179PASS: cookie.path should be 'null'.
     180PASS: cookie.domain should be 'null'.
     181PASS: cookie.secure should be 'false'.
     182PASS: cookie.httpOnly should be 'false'.
     183PASS: cookie.sameSite should be 'None'.
    122184
    123185HEADER: Set-Cookie: name=value; expires=Fri 06-Oct-2017 03:20:27 GMT; Max-Age=3600
    … …  
    133195PASS: cookie.secure should be 'false'.
    134196PASS: cookie.httpOnly should be 'false'.
     197PASS: cookie.sameSite should be 'None'.
    135198
    136199HEADER: Set-Cookie: name=value; expires=Fri 06-Oct-2017 03:43:47 GMT; Max-Age=5000; path=/foo; domain=example.com; secure; HttpOnly
    … …  
    146209PASS: cookie.secure should be 'true'.
    147210PASS: cookie.httpOnly should be 'true'.
     211PASS: cookie.sameSite should be 'None'.
    148212
    149213HEADER: Set-Cookie: name=value; Unknown; path=/one/two
    … …  
    160224PASS: cookie.secure should be 'false'.
    161225PASS: cookie.httpOnly should be 'false'.
     226PASS: cookie.sameSite should be 'None'.
    162227
    163228HEADER: Set-Cookie: name=value; Unknown=Ignored; path=/one/two
    … …  
    174239PASS: cookie.secure should be 'false'.
    175240PASS: cookie.httpOnly should be 'false'.
     241PASS: cookie.sameSite should be 'None'.
    176242
    177243HEADER: Set-Cookie: name=somewhat longer value than normal with spaces, and commas; domain=other.example.com
    … …  
    187253PASS: cookie.secure should be 'false'.
    188254PASS: cookie.httpOnly should be 'false'.
     255PASS: cookie.sameSite should be 'None'.
    189256
    190257HEADER: Set-Cookie: name==value=;Domain=.example.com;Expires=Wed, 04-Apr-2018 03:34:02 GMT
    … …  
    200267PASS: cookie.secure should be 'false'.
    201268PASS: cookie.httpOnly should be 'false'.
     269PASS: cookie.sameSite should be 'None'.
    202270
    203271

  • trunk/LayoutTests/inspector/unit-tests/cookie.html

    r239226 r244294  
    6969                InspectorTest.expectEqual(cookie.secure, expected.secure, `cookie.secure should be '${expected.secure}'.`);
    7070                InspectorTest.expectEqual(cookie.httpOnly, expected.httpOnly, `cookie.httpOnly should be '${expected.httpOnly}'.`);
     71                InspectorTest.expectEqual(cookie.sameSite, expected.sameSite, `cookie.sameSite should be '${expected.sameSite}'.`);
    7172                InspectorTest.log("");
    7273            }
    … …  
    8384                secure: false,
    8485                httpOnly: false,
     86                sameSite: WI.Cookie.SameSiteType.None,
    8587            });
    8688
    … …  
    9496                secure: false,
    9597                httpOnly: false,
     98                sameSite: WI.Cookie.SameSiteType.None,
    9699            });
    97100
    … …  
    105108                secure: false,
    106109                httpOnly: false,
     110                sameSite: WI.Cookie.SameSiteType.None,
    107111            });
    108112
    … …  
    116120                secure: true,
    117121                httpOnly: false,
     122                sameSite: WI.Cookie.SameSiteType.None,
    118123            });
    119124
    … …  
    127132                secure: true,
    128133                httpOnly: false,
     134                sameSite: WI.Cookie.SameSiteType.None,
    129135            });
    130136
    … …  
    138144                secure: false,
    139145                httpOnly: true,
     146                sameSite: WI.Cookie.SameSiteType.None,
     147            });
     148
     149            test(`name=value; SameSite=lax`, {
     150                name: "name",
     151                value: "value",
     152                expires: null,
     153                maxAge: null,
     154                path: null,
     155                domain: null,
     156                secure: false,
     157                httpOnly: false,
     158                sameSite: WI.Cookie.SameSiteType.Lax,
     159            });
     160
     161            test(`name=value; SameSite=strict`, {
     162                name: "name",
     163                value: "value",
     164                expires: null,
     165                maxAge: null,
     166                path: null,
     167                domain: null,
     168                secure: false,
     169                httpOnly: false,
     170                sameSite: WI.Cookie.SameSiteType.Strict,
     171            });
     172
     173            // SameSite with unknown value is ignored.
     174            test(`name=value; SameSite=invalid`, {
     175                name: "name",
     176                value: "value",
     177                expires: null,
     178                maxAge: null,
     179                path: null,
     180                domain: null,
     181                secure: false,
     182                httpOnly: false,
     183                sameSite: WI.Cookie.SameSiteType.None,
     184            });
     185
     186            // SameSite without value is ignored.
     187            test(`name=value; SameSite`, {
     188                name: "name",
     189                value: "value",
     190                expires: null,
     191                maxAge: null,
     192                path: null,
     193                domain: null,
     194                secure: false,
     195                httpOnly: false,
     196                sameSite: WI.Cookie.SameSiteType.None,
    140197            });
    141198
    … …  
    149206                secure: false,
    150207                httpOnly: false,
     208                sameSite: WI.Cookie.SameSiteType.None,
    151209            });
    152210
    … …  
    160218                secure: true,
    161219                httpOnly: true,
     220                sameSite: WI.Cookie.SameSiteType.None,
    162221            });
    163222
    … …  
    171230                secure: false,
    172231                httpOnly: false,
     232                sameSite: WI.Cookie.SameSiteType.None,
    173233            });
    174234
    … …  
    182242                secure: false,
    183243                httpOnly: false,
     244                sameSite: WI.Cookie.SameSiteType.None,
    184245            });
    185246
    … …  
    193254                secure: false,
    194255                httpOnly: false,
     256                sameSite: WI.Cookie.SameSiteType.None,
    195257            });
    196258
    … …  
    205267                secure: false,
    206268                httpOnly: false,
     269                sameSite: WI.Cookie.SameSiteType.None,
    207270            });
    208271

  • trunk/Source/WebInspectorUI/ChangeLog

    r244290 r244294  
     12019-04-15  Joseph Pecoraro  <pecoraro@apple.com>
     2
     3        Web Inspector: SameSite parsing should be stricter
     4        https://bugs.webkit.org/show_bug.cgi?id=196927
     5        <rdar://problem/42291601>
     6
     7        Reviewed by Devin Rousso.
     8
     9        * UserInterface/Models/Cookie.js:
     10        (WI.Cookie.parseSameSiteAttributeValue):
     11
    1122019-04-15  Joseph Pecoraro  <pecoraro@apple.com>
    213

  • trunk/Source/WebInspectorUI/UserInterface/Models/Cookie.js

    r239226 r244294  
    115115    }
    116116
    117     // Derived from <https://tools.ietf.org/html/draft-west-first-party-cookies-06#section-3.2>.
     117    // <https://httpwg.org/http-extensions/rfc6265bis.html#the-samesite-attribute-1>
    118118    static parseSameSiteAttributeValue(attributeValue)
    119119    {
    120120        if (!attributeValue)
    121             return WI.Cookie.SameSiteType.Strict;
     121            return WI.Cookie.SameSiteType.None;
     122
    122123        switch (attributeValue.toLowerCase()) {
    123124        case "lax":
    124125            return WI.Cookie.SameSiteType.Lax;
    125126        case "strict":
    126         default:
    127127            return WI.Cookie.SameSiteType.Strict;
    128128        }
     129
     130        return WI.Cookie.SameSiteType.None;
    129131    }
    130132
Note: See TracChangeset for help on using the changeset viewer.