Changeset 50631 in webkit

Timestamp:

Nov 8, 2009 5:18:08 PM (14 years ago)

Author:

dbates@webkit.org

Message:

2009-11-08 Daniel Bates <​dbates@webkit.org>

Reviewed by Adam Barth.

​https://bugs.webkit.org/show_bug.cgi?id=31098

Allows same-origin plugin-based content to load.

Test: http/tests/security/xssAuditor/object-src-inject.html

• page/XSSAuditor.cpp: (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource. (WebCore::XSSAuditor::canLoadObject): Ditto. (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. (WebCore::XSSAuditor::isSameOriginResource): Added.
• page/XSSAuditor.h:

2009-11-08 Daniel Bates <​dbates@webkit.org>

Reviewed by Adam Barth.

​https://bugs.webkit.org/show_bug.cgi?id=31098

Tests that the XSSAuditor prevents loading plugin-based content that is not
from the same-origin as the enclosing page.

• http/tests/security/xssAuditor/object-src-inject-expected.txt: Added.
• http/tests/security/xssAuditor/object-src-inject.html: Added.
• http/tests/security/xssAuditor/resources/echo-object-src.pl: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/xssAuditor/object-src-inject-expected.txt (added)
• LayoutTests/http/tests/security/xssAuditor/object-src-inject.html (added)
• LayoutTests/http/tests/security/xssAuditor/resources/echo-object-src.pl (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/page/XSSAuditor.cpp (modified) (4 diffs)
• WebCore/page/XSSAuditor.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Tests that the XSSAuditor prevents loading plugin-based content that is not 
+        from the same-origin as the enclosing page.
+
+        * http/tests/security/xssAuditor/object-src-inject-expected.txt: Added.
+        * http/tests/security/xssAuditor/object-src-inject.html: Added.
+        * http/tests/security/xssAuditor/resources/echo-object-src.pl: Added.
+
 2009-11-08  Shu Chang  <Chang.Shu@nokia.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Allows same-origin plugin-based content to load.
+
+        Test: http/tests/security/xssAuditor/object-src-inject.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. 
+        (WebCore::XSSAuditor::isSameOriginResource): Added.
+        * page/XSSAuditor.h:
+
 2009-11-08  David Levin  <levin@chromium.org>
 

trunk/WebCore/page/XSSAuditor.cpp

@@ -145 +145 @@
         return true;
 
-    // If the script is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // script. If the script has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL scriptURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+    if (isSameOriginResource(url))
         return true;
 
@@ -168 +161 @@
         return true;
 
+    if (isSameOriginResource(url))
+        return true;
+
     if (findInRequest(url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
@@ -180 +176 @@
     if (!isEnabled())
         return true;
-    
-    KURL baseElementURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() != baseElementURL.host() && findInRequest(url)) {
+
+    if (isSameOriginResource(url))
+        return true;
+
+    if (findInRequest(url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
@@ -256 +254 @@
 }
 
+bool XSSAuditor::isSameOriginResource(const String& url) const
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_frame->document()->url(), url);
+    return (m_frame->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
+}
+
 bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
                                bool decodeURLEscapeSequencesTwice) const

trunk/WebCore/page/XSSAuditor.h

@@ -123 +123 @@
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
+        bool isSameOriginResource(const String& url) const;
         bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
                            bool decodeURLEscapeSequencesTwice = false) const;