Changeset 60898 in webkit

Timestamp:

Jun 9, 2010 10:09:03 AM (14 years ago)

Author:

abarth@webkit.org

Message:

2010-06-09 Eric Seidel <​eric@webkit.org>

Reviewed by Adam Barth.

HTML5 Parser needs to integrate with the XSSAuditor
​https://bugs.webkit.org/show_bug.cgi?id=40287

This fixes most of the XSSAuditor tests, except for the ones
which rely on the srcValue "context". The previous HTMLTokenizer
implementation was both Lexer and ScriptRunner and thus could
provide the XSSAuditor with the un-modified attribute source.
This naive implementation will fail the context-sensitive tests
but Adam Barth says he'll just have to find a new way to provide
the required information to the XSSAuditor in a later patch.

Covered by numerous http/tests/security/xssAuditor tests.

• html/HTML5ScriptRunner.cpp: (WebCore::HTML5ScriptRunner::requestScript):
  • Ask the HTML5ScriptRunner host before running any scripts.
• html/HTML5ScriptRunnerHost.h:
  • Add a shouldLoadExternalScriptFromSrc declaration.
• html/HTML5Tokenizer.cpp: (WebCore::HTML5Tokenizer::shouldLoadExternalScriptFromSrc):
  • Ask the XSSAuditor if we're allowed to run the passed script.
• html/HTML5Tokenizer.h:

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTML5ScriptRunner.cpp (modified) (1 diff)
• html/HTML5ScriptRunnerHost.h (modified) (2 diffs)
• html/HTML5Tokenizer.cpp (modified) (2 diffs)
• html/HTML5Tokenizer.h (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-06-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        HTML5 Parser needs to integrate with the XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=40287
+
+        This fixes most of the XSSAuditor tests, except for the ones
+        which rely on the srcValue "context".  The previous HTMLTokenizer
+        implementation was both Lexer and ScriptRunner and thus could
+        provide the XSSAuditor with the un-modified attribute source.
+        This naive implementation will fail the context-sensitive tests
+        but Adam Barth says he'll just have to find a new way to provide
+        the required information to the XSSAuditor in a later patch.
+
+        Covered by numerous http/tests/security/xssAuditor tests.
+
+        * html/HTML5ScriptRunner.cpp:
+        (WebCore::HTML5ScriptRunner::requestScript):
+         - Ask the HTML5ScriptRunner host before running any scripts.
+        * html/HTML5ScriptRunnerHost.h:
+         - Add a shouldLoadExternalScriptFromSrc declaration.
+        * html/HTML5Tokenizer.cpp:
+        (WebCore::HTML5Tokenizer::shouldLoadExternalScriptFromSrc):
+         - Ask the XSSAuditor if we're allowed to run the passed script.
+        * html/HTML5Tokenizer.h:
+
 2010-06-09  Tony Gentilcore  <tonyg@chromium.org>
 

trunk/WebCore/html/HTML5ScriptRunner.cpp

@@ -208 +208 @@
     ASSERT(!m_parsingBlockingScript.element);
     AtomicString srcValue = script->getAttribute(srcAttr);
+    // Allow the host to disllow script loads (using the XSSAuditor, etc.)
+    if (!m_host->shouldLoadExternalScriptFromSrc(srcValue))
+        return;
+
     // FIXME: We need to resolve the url relative to the element.
     m_parsingBlockingScript.element = script;

trunk/WebCore/html/HTML5ScriptRunnerHost.h

@@ -29 +29 @@
 namespace WebCore {
 
+class AtomicString;
 class CachedResource;
 class ScriptSourceCode;
@@ -41 +42 @@
     virtual void stopWatchingForLoad(CachedResource*) = 0;
 
+    // Implementors can block certain script loads (for XSSAuditor, etc.)
+    virtual bool shouldLoadExternalScriptFromSrc(const AtomicString&) = 0;
     // Implementors should handle possible rentry before/after calling ScriptController::executeScript
     virtual void executeScript(const ScriptSourceCode&) = 0;

trunk/WebCore/html/HTML5Tokenizer.cpp

@@ -35 +35 @@
 #include "Node.h"
 #include "NotImplemented.h"
+#include "XSSAuditor.h"
 
 namespace WebCore {
@@ -205 +206 @@
 {
     cachedScript->removeClient(this);
+}
+
+bool HTML5Tokenizer::shouldLoadExternalScriptFromSrc(const AtomicString& srcValue)
+{
+    if (!m_XSSAuditor)
+        return true;
+    // FIXME: We have no easy way to provide the XSSAuditor with the original
+    // un-processed attribute source, so for now we pass nullAtom.
+    return m_XSSAuditor->canLoadExternalScriptFromSrc(nullAtom, srcValue);
 }
 

trunk/WebCore/html/HTML5Tokenizer.h

@@ -64 +64 @@
     virtual void watchForLoad(CachedResource*);
     virtual void stopWatchingForLoad(CachedResource*);
+    virtual bool shouldLoadExternalScriptFromSrc(const AtomicString&);
     virtual void executeScript(const ScriptSourceCode&);