Changeset 246238 in webkit


Ignore:
Timestamp:
Jun 9, 2019 4:55:29 AM (5 years ago)
Author:
commit-queue@webkit.org
Message:

Add wildcard to Access-Control-Allow-Methods and Access-Control-Allow-Headers
​https://bugs.webkit.org/show_bug.cgi?id=165508

Patch by Rob Buis <​rbuis@igalia.com> on 2019-06-09
Reviewed by Frédéric Wang.

LayoutTests/imported/w3c:

  • web-platform-tests/fetch/api/cors/cors-preflight-star.any-expected.txt:
  • web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker-expected.txt:

Source/WebCore:

According to the spec [1] step 6.5, a wildcard for method
and request's credentials mode should be taken into account, so
add this to the check. Same for Access-Control-Allow-Headers (step 6.7).

[1] ​https://fetch.spec.whatwg.org/#cors-preflight-fetch

Tests: web-platform-tests/fetch/api/cors/cors-preflight-star.any.html

web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker.html

  • loader/CrossOriginAccessControl.cpp:

(WebCore::validatePreflightResponse):

  • loader/CrossOriginPreflightResultCache.cpp:

(WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod const):
(WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders const):
(WebCore::CrossOriginPreflightResultCacheItem::allowsRequest const):

  • loader/CrossOriginPreflightResultCache.h:
Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r246193 r246238  
     12019-06-09  Rob Buis  <rbuis@igalia.com>
     2
     3        Add wildcard to Access-Control-Allow-Methods and Access-Control-Allow-Headers
     4        https://bugs.webkit.org/show_bug.cgi?id=165508
     5
     6        Reviewed by Frédéric Wang.
     7
     8        * web-platform-tests/fetch/api/cors/cors-preflight-star.any-expected.txt:
     9        * web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker-expected.txt:
     10
    1112019-06-07  Joonghun Park  <jh718.park@samsung.com>
    212

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any-expected.txt

    r231000 r246238  
    1 CONSOLE MESSAGE: Method SUPER is not allowed by Access-Control-Allow-Methods.
    2 CONSOLE MESSAGE: Fetch API cannot load http://127.0.0.1:8800/fetch/api/resources/preflight.py?allow_methods=*&allow_headers=x-test& due to access control checks.
    3 CONSOLE MESSAGE: Method OK is not allowed by Access-Control-Allow-Methods.
    4 CONSOLE MESSAGE: Fetch API cannot load http://127.0.0.1:8800/fetch/api/resources/preflight.py?allow_methods=*&allow_headers=*& due to access control checks.
    51CONSOLE MESSAGE: Method OK is not allowed by Access-Control-Allow-Methods.
    62CONSOLE MESSAGE: Fetch API cannot load http://127.0.0.1:8800/fetch/api/resources/preflight.py?origin=http://localhost:8800&credentials&allow_methods=*&allow_headers=*& due to access control checks.
    … …  
    1511
    1612PASS CORS that succeeds with credentials: false; method: GET (allowed: get); header: X-Test,1 (allowed: x-test)
    17 FAIL CORS that succeeds with credentials: false; method: SUPER (allowed: *); header: X-Test,1 (allowed: x-test) promise_test: Unhandled rejection with value: object "TypeError: Method SUPER is not allowed by Access-Control-Allow-Methods."
    18 FAIL CORS that succeeds with credentials: false; method: OK (allowed: *); header: X-Test,1 (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Method OK is not allowed by Access-Control-Allow-Methods."
     13PASS CORS that succeeds with credentials: false; method: SUPER (allowed: *); header: X-Test,1 (allowed: x-test)
     14PASS CORS that succeeds with credentials: false; method: OK (allowed: *); header: X-Test,1 (allowed: *)
    1915PASS CORS that fails with credentials: true; method: OK (allowed: *); header: X-Test,1 (allowed: *)
    2016PASS CORS that fails with credentials: true; method: PUT (allowed: *); header:  (allowed: )

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker-expected.txt

    r231000 r246238  
    1 CONSOLE MESSAGE: Method SUPER is not allowed by Access-Control-Allow-Methods.
    2 CONSOLE MESSAGE: Method OK is not allowed by Access-Control-Allow-Methods.
    31CONSOLE MESSAGE: Method OK is not allowed by Access-Control-Allow-Methods.
    42CONSOLE MESSAGE: Method PUT is not allowed by Access-Control-Allow-Methods.
    … …  
    86
    97PASS CORS that succeeds with credentials: false; method: GET (allowed: get); header: X-Test,1 (allowed: x-test)
    10 FAIL CORS that succeeds with credentials: false; method: SUPER (allowed: *); header: X-Test,1 (allowed: x-test) promise_test: Unhandled rejection with value: object "TypeError: Method SUPER is not allowed by Access-Control-Allow-Methods."
    11 FAIL CORS that succeeds with credentials: false; method: OK (allowed: *); header: X-Test,1 (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Method OK is not allowed by Access-Control-Allow-Methods."
     8PASS CORS that succeeds with credentials: false; method: SUPER (allowed: *); header: X-Test,1 (allowed: x-test)
     9PASS CORS that succeeds with credentials: false; method: OK (allowed: *); header: X-Test,1 (allowed: *)
    1210PASS CORS that fails with credentials: true; method: OK (allowed: *); header: X-Test,1 (allowed: *)
    1311PASS CORS that fails with credentials: true; method: PUT (allowed: *); header:  (allowed: )

  • trunk/Source/WebCore/ChangeLog

    r246234 r246238  
     12019-06-09  Rob Buis  <rbuis@igalia.com>
     2
     3        Add wildcard to Access-Control-Allow-Methods and Access-Control-Allow-Headers
     4        https://bugs.webkit.org/show_bug.cgi?id=165508
     5
     6        Reviewed by Frédéric Wang.
     7
     8        According to the spec [1] step 6.5, a wildcard for method
     9        and request's credentials mode should be taken into account, so
     10        add this to the check. Same for Access-Control-Allow-Headers (step 6.7).
     11
     12        [1] https://fetch.spec.whatwg.org/#cors-preflight-fetch
     13
     14        Tests: web-platform-tests/fetch/api/cors/cors-preflight-star.any.html
     15               web-platform-tests/fetch/api/cors/cors-preflight-star.any.worker.html
     16
     17        * loader/CrossOriginAccessControl.cpp:
     18        (WebCore::validatePreflightResponse):
     19        * loader/CrossOriginPreflightResultCache.cpp:
     20        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod const):
     21        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders const):
     22        (WebCore::CrossOriginPreflightResultCacheItem::allowsRequest const):
     23        * loader/CrossOriginPreflightResultCache.h:
     24
    1252019-06-08  Zalan Bujtas  <zalan@apple.com>
    226

  • trunk/Source/WebCore/loader/CrossOriginAccessControl.cpp

    r242899 r246238  
    208208    auto result = std::make_unique<CrossOriginPreflightResultCacheItem>(storedCredentialsPolicy);
    209209    if (!result->parse(response)
    210         || !result->allowsCrossOriginMethod(request.httpMethod(), errorDescription)
    211         || !result->allowsCrossOriginHeaders(request.httpHeaderFields(), errorDescription)) {
     210        || !result->allowsCrossOriginMethod(request.httpMethod(), storedCredentialsPolicy, errorDescription)
     211        || !result->allowsCrossOriginHeaders(request.httpHeaderFields(), storedCredentialsPolicy, errorDescription)) {
    212212        return false;
    213213    }

  • trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.cpp

    r239372 r246238  
    6969}
    7070
    71 bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method, String& errorDescription) const
     71bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method, StoredCredentialsPolicy storedCredentialsPolicy, String& errorDescription) const
    7272{
    73     if (m_methods.contains(method) || isOnAccessControlSimpleRequestMethodWhitelist(method))
     73    if (m_methods.contains(method) || (m_methods.contains("*") && storedCredentialsPolicy != StoredCredentialsPolicy::Use) || isOnAccessControlSimpleRequestMethodWhitelist(method))
    7474        return true;
    7575
    … …  
    7878}
    7979
    80 bool CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders(const HTTPHeaderMap& requestHeaders, String& errorDescription) const
     80bool CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders(const HTTPHeaderMap& requestHeaders, StoredCredentialsPolicy storedCredentialsPolicy, String& errorDescription) const
    8181{
     82    bool validWildcard = m_headers.contains("*") && storedCredentialsPolicy != StoredCredentialsPolicy::Use;
    8283    for (const auto& header : requestHeaders) {
    8384        if (header.keyAsHTTPHeaderName && isCrossOriginSafeRequestHeader(header.keyAsHTTPHeaderName.value(), header.value))
    8485            continue;
    85         if (!m_headers.contains(header.key)) {
     86        if (!m_headers.contains(header.key) && !validWildcard) {
    8687            errorDescription = "Request header field " + header.key + " is not allowed by Access-Control-Allow-Headers.";
    8788            return false;
    … …  
    9899    if (storedCredentialsPolicy == StoredCredentialsPolicy::Use && m_storedCredentialsPolicy == StoredCredentialsPolicy::DoNotUse)
    99100        return false;
    100     if (!allowsCrossOriginMethod(method, ignoredExplanation))
     101    if (!allowsCrossOriginMethod(method, storedCredentialsPolicy, ignoredExplanation))
    101102        return false;
    102     if (!allowsCrossOriginHeaders(requestHeaders, ignoredExplanation))
     103    if (!allowsCrossOriginHeaders(requestHeaders, storedCredentialsPolicy, ignoredExplanation))
    103104        return false;
    104105    return true;

  • trunk/Source/WebCore/loader/CrossOriginPreflightResultCache.h

    r244115 r246238  
    4747
    4848    WEBCORE_EXPORT bool parse(const ResourceResponse&);
    49     WEBCORE_EXPORT bool allowsCrossOriginMethod(const String&, String& errorDescription) const;
    50     WEBCORE_EXPORT bool allowsCrossOriginHeaders(const HTTPHeaderMap&, String& errorDescription) const;
     49    WEBCORE_EXPORT bool allowsCrossOriginMethod(const String&, StoredCredentialsPolicy, String& errorDescription) const;
     50    WEBCORE_EXPORT bool allowsCrossOriginHeaders(const HTTPHeaderMap&, StoredCredentialsPolicy, String& errorDescription) const;
    5151    bool allowsRequest(StoredCredentialsPolicy, const String& method, const HTTPHeaderMap& requestHeaders) const;
    5252
Note: See TracChangeset for help on using the changeset viewer.