Changeset 83205 in webkit

Timestamp:

Apr 7, 2011 1:51:22 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-04-07 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Implement CSP's options directive
​https://bugs.webkit.org/show_bug.cgi?id=58014

• http/tests/security/contentSecurityPolicy/inline-script-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/inline-script-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html: Added.

2011-04-07 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Implement CSP's options directive
​https://bugs.webkit.org/show_bug.cgi?id=58014

This patch contains the full options parser, but we only have enough of
CSP implemented to see the effects of disable-xss-protection. Will
need to do some more work before we can see eval-script in action.

Tests: http/tests/security/contentSecurityPolicy/inline-script-allowed.html

http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html

• page/ContentSecurityPolicy.cpp: (WebCore::CSPOptions::CSPOptions): (WebCore::CSPOptions::disableXSSProtection): (WebCore::CSPOptions::evalScript): (WebCore::CSPOptions::parse): (WebCore::ContentSecurityPolicy::allowJavaScriptURLs): (WebCore::ContentSecurityPolicy::allowInlineEventHandlers): (WebCore::ContentSecurityPolicy::allowInlineScript): (WebCore::ContentSecurityPolicy::addDirective):
• page/ContentSecurityPolicy.h:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-allowed-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-allowed.html (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy-expected.txt (added)
• LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/ContentSecurityPolicy.cpp (modified) (5 diffs)
• Source/WebCore/page/ContentSecurityPolicy.h (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement CSP's options directive
+        https://bugs.webkit.org/show_bug.cgi?id=58014
+
+        * http/tests/security/contentSecurityPolicy/inline-script-allowed-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/inline-script-allowed.html: Added.
+        * http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy-expected.txt: Added.
+        * http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html: Added.
+
 2011-04-07  Enrica Casucci  <enrica@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement CSP's options directive
+        https://bugs.webkit.org/show_bug.cgi?id=58014
+
+        This patch contains the full options parser, but we only have enough of
+        CSP implemented to see the effects of disable-xss-protection.  Will
+        need to do some more work before we can see eval-script in action.
+
+        Tests: http/tests/security/contentSecurityPolicy/inline-script-allowed.html
+               http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPOptions::CSPOptions):
+        (WebCore::CSPOptions::disableXSSProtection):
+        (WebCore::CSPOptions::evalScript):
+        (WebCore::CSPOptions::parse):
+        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
+        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
+        (WebCore::ContentSecurityPolicy::allowInlineScript):
+        (WebCore::ContentSecurityPolicy::addDirective):
+        * page/ContentSecurityPolicy.h:
+
 2011-04-07  Alexey Proskuryakov  <ap@apple.com>
 

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -58 +58 @@
 }
 
+bool isOptionValueCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
 bool isSchemeContinuationCharacter(UChar c)
 {
@@ -407 +412 @@
 };
 
+class CSPOptions {
+public:
+    explicit CSPOptions(const String& value)
+        : m_disableXSSProtection(false)
+        , m_evalScript(false)
+    {
+        parse(value);
+    }
+
+    bool disableXSSProtection() const { return m_disableXSSProtection; }
+    bool evalScript() const { return m_evalScript; }
+
+private:
+    void parse(const String&);
+
+    bool m_disableXSSProtection;
+    bool m_evalScript;
+};
+
+// options           = "options" *( 1*WSP option-value ) *WSP
+// option-value      = 1*( ALPHA / DIGIT / "-" )
+//
+void CSPOptions::parse(const String& value)
+{
+    DEFINE_STATIC_LOCAL(String, disableXSSProtection, ("disable-xss-protection"));
+    DEFINE_STATIC_LOCAL(String, evalScript, ("eval-script"));
+
+    const UChar* position = value.characters();
+    const UChar* end = position + value.length();
+
+    while (position < end) {
+        skipWhile<isASCIISpace>(position, end);
+
+        const UChar* optionsValueBegin = position;
+
+        if (!skipExactly<isOptionValueCharacter>(position, end))
+            return;
+
+        skipWhile<isOptionValueCharacter>(position, end);
+
+        String optionsValue(optionsValueBegin, position - optionsValueBegin);
+
+        if (equalIgnoringCase(optionsValue, disableXSSProtection))
+            m_disableXSSProtection = true;
+        else if (equalIgnoringCase(optionsValue, evalScript))
+            m_evalScript = true;
+    }
+}
+
 ContentSecurityPolicy::ContentSecurityPolicy(SecurityOrigin* origin)
     : m_havePolicy(false)
@@ -426 +480 @@
 }
 
+bool ContentSecurityPolicy::protectAgainstXSS() const
+{
+    return m_scriptSrc && (!m_options || !m_options->disableXSSProtection());
+}
+
 bool ContentSecurityPolicy::allowJavaScriptURLs() const
 {
-    return !m_scriptSrc;
+    return !protectAgainstXSS();
 }
 
 bool ContentSecurityPolicy::allowInlineEventHandlers() const
 {
-    return !m_scriptSrc;
+    return !protectAgainstXSS();
 }
 
 bool ContentSecurityPolicy::allowInlineScript() const
 {
-    return !m_scriptSrc;
+    return !protectAgainstXSS();
 }
 
@@ -526 +585 @@
     DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
     DEFINE_STATIC_LOCAL(String, objectSrc, ("object-src"));
+    DEFINE_STATIC_LOCAL(String, options, ("options"));
 
     ASSERT(!name.isEmpty());
@@ -533 +593 @@
     else if (!m_objectSrc && equalIgnoringCase(name, objectSrc))
         m_objectSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
-}
-
-}
+    else if (!m_options && equalIgnoringCase(name, options))
+        m_options = adoptPtr(new CSPOptions(value));
+}
+
+}

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -33 +33 @@
 
 class CSPDirective;
+class CSPOptions;
 class KURL;
 class SecurityOrigin;
@@ -55 +56 @@
     explicit ContentSecurityPolicy(SecurityOrigin*);
 
+    bool protectAgainstXSS() const;
+
     void parse(const String&);
     bool parseDirective(const UChar* begin, const UChar* end, String& name, String& value);
@@ -63 +66 @@
     OwnPtr<CSPDirective> m_scriptSrc;
     OwnPtr<CSPDirective> m_objectSrc;
+    OwnPtr<CSPOptions> m_options;
 };