Changeset 81425 in webkit

Timestamp:

Mar 17, 2011 6:58:18 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-03-17 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Update CSP directive parser to match spec
​https://bugs.webkit.org/show_bug.cgi?id=56582

Test some error-handling cases.

• http/tests/security/contentSecurityPolicy/directive-parsing-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/directive-parsing.html: Added.

2011-03-17 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Update CSP directive parser to match spec
​https://bugs.webkit.org/show_bug.cgi?id=56582

Brandon updated the CSP spec. I've updated our implementation to
match. In the process, I found a couple bugs in the spec, which I've
sent to the working group. This patch assumes that the bugs will be
fixed in the way I suggested. If they get fixed a different way, we
might need to update the parser again.

Test: http/tests/security/contentSecurityPolicy/directive-parsing.html

• page/ContentSecurityPolicy.cpp: (WebCore::isDirectiveNameCharacter): (WebCore::isDirectiveValueCharacter): (WebCore::advanceUntil): (WebCore::ContentSecurityPolicy::parse): (WebCore::ContentSecurityPolicy::parseDirective):
• page/ContentSecurityPolicy.h:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/directive-parsing.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/ContentSecurityPolicy.cpp (modified) (4 diffs)
• Source/WebCore/page/ContentSecurityPolicy.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Update CSP directive parser to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=56582
+
+        Test some error-handling cases.
+
+        * http/tests/security/contentSecurityPolicy/directive-parsing-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/directive-parsing.html: Added.
+
 2011-03-17  James Simonsen  <simonjam@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Update CSP directive parser to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=56582
+
+        Brandon updated the CSP spec.  I've updated our implementation to
+        match.  In the process, I found a couple bugs in the spec, which I've
+        sent to the working group.  This patch assumes that the bugs will be
+        fixed in the way I suggested.  If they get fixed a different way, we
+        might need to update the parser again.
+
+        Test: http/tests/security/contentSecurityPolicy/directive-parsing.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::isDirectiveNameCharacter):
+        (WebCore::isDirectiveValueCharacter):
+        (WebCore::advanceUntil):
+        (WebCore::ContentSecurityPolicy::parse):
+        (WebCore::ContentSecurityPolicy::parseDirective):
+        * page/ContentSecurityPolicy.h:
+
 2011-03-17  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -29 +29 @@
 
 namespace WebCore {
+
+static bool isDirectiveNameCharacter(UChar c)
+{
+    return isASCIIAlpha(c) || isASCIIDigit(c) || c == '-';
+}
+
+static bool isDirectiveValueCharacter(UChar c)
+{
+    return isASCIISpace(c) || (c >= 0x21 && c <= 0x7e); // Whitespace + VCHAR
+}
+
+static void advanceUntil(const UChar*& pos, const UChar* end, UChar delimiter)
+{
+    while (pos < end) {
+        if (*pos++ == delimiter)
+            return;
+    }
+}
 
 class CSPDirective {
@@ -88 +106 @@
         Vector<UChar, 64> value;
 
-        parseDirective(pos, end, name, value);
+        if (!parseDirective(pos, end, name, value))
+            continue;
         if (name.isEmpty())
             continue;
@@ -99 +118 @@
 }
 
-void ContentSecurityPolicy::parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value)
+bool ContentSecurityPolicy::parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value)
 {
     ASSERT(pos < end);
@@ -105 +124 @@
     ASSERT(value.isEmpty());
 
-    enum {
-        BeforeDirectiveName,
-        DirectiveName,
-        AfterDirectiveName,
-        DirectiveValue,
-    } state = BeforeDirectiveName;
+    while (pos < end && isASCIISpace(*pos))
+        pos++;
 
     while (pos < end) {
-        UChar currentCharacter = *pos++;
-        switch (state) {
-        case BeforeDirectiveName:
-            if (isASCIISpace(currentCharacter))
-                continue;
-            state = DirectiveName;
-            // Fall through.
-        case DirectiveName:
-            if (!isASCIISpace(currentCharacter)) {
-                name.append(currentCharacter);
-                continue;
-            }
-            state = AfterDirectiveName;
-            // Fall through.
-        case AfterDirectiveName:
-            if (isASCIISpace(currentCharacter))
-                continue;
-            state = DirectiveValue;
-            // Fall through.
-        case DirectiveValue:
-            if (currentCharacter != ';') {
-                value.append(currentCharacter);
-                continue;
-            }
-            return;
+        UChar currentCharacter = *pos;
+        if (currentCharacter == ';')
+            break;
+        if (isASCIISpace(currentCharacter))
+            break;
+        if (!isDirectiveNameCharacter(currentCharacter)) {
+            advanceUntil(pos, end, ';');
+            return false;
         }
+        name.append(currentCharacter);
+        pos++;
     }
+
+    while (pos < end && isASCIISpace(*pos))
+        pos++;
+
+    if (pos < end && *pos == ';') {
+        pos++;
+        return true;
+    }
+
+    while (pos < end) {
+        UChar currentCharacter = *pos;
+        if (currentCharacter == ';')
+            break;
+        if (!isDirectiveValueCharacter(currentCharacter)) {
+            advanceUntil(pos, end, ';');
+            return false;
+        }
+        value.append(currentCharacter);
+        pos++;
+    }
+
+    if (pos < end && *pos == ';') {
+        pos++;
+        return true;
+    }
+
+    return true;
 }
 

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -49 +49 @@
 
     void parse(const String&);
-    void parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value);
+    bool parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value);
     void emitDirective(const String& name, const String& value);