Changeset 84460 in webkit


Ignore:
Timestamp:
Apr 20, 2011 8:21:20 PM (13 years ago)
Author:
abarth@webkit.org
Message:

2011-04-20 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CSP frame-src is missing
​https://bugs.webkit.org/show_bug.cgi?id=58643

Tests the basic functionality of frame-src.

  • http/tests/security/contentSecurityPolicy/frame-src-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/frame-src-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/frame-src-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/frame-src-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/resources/alert-fail.html: Added.
  • http/tests/security/contentSecurityPolicy/resources/alert-pass.html: Added.

2011-04-20 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CSP frame-src is missing
​https://bugs.webkit.org/show_bug.cgi?id=58643

This is a first cut at an implementation of frame-src. There are a
couple things that will need to be improved:

1) I don't think we're handling in-frame navigation properly. This

patch only covers setting the src attribute of the frame, but I
think the intent of the spec is to cover navigation as well.

2) The console message is printed twice, once when we try to load the

frame and again when we attach the frame to the render tree.

I'll file bugs about these issues (blocking
​https://bugs.webkit.org/show_bug.cgi?id=53572) once this patch lands.

Tests: http/tests/security/contentSecurityPolicy/frame-src-allowed.html

http/tests/security/contentSecurityPolicy/frame-src-blocked.html

  • html/HTMLFrameElementBase.cpp: (WebCore::HTMLFrameElementBase::isURLAllowed):
  • page/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): (WebCore::ContentSecurityPolicy::addDirective):
  • page/ContentSecurityPolicy.h:
Location:
trunk
Files:
6 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r84458 r84460  
     12011-04-20  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        CSP frame-src is missing
     6        https://bugs.webkit.org/show_bug.cgi?id=58643
     7
     8        Tests the basic functionality of frame-src.
     9
     10        * http/tests/security/contentSecurityPolicy/frame-src-allowed-expected.txt: Added.
     11        * http/tests/security/contentSecurityPolicy/frame-src-allowed.html: Added.
     12        * http/tests/security/contentSecurityPolicy/frame-src-blocked-expected.txt: Added.
     13        * http/tests/security/contentSecurityPolicy/frame-src-blocked.html: Added.
     14        * http/tests/security/contentSecurityPolicy/resources/alert-fail.html: Added.
     15        * http/tests/security/contentSecurityPolicy/resources/alert-pass.html: Added.
     16
    1172011-04-20  Dirk Pranke  <dpranke@chromium.org>
    218

  • trunk/Source/WebCore/ChangeLog

    r84459 r84460  
     12011-04-20  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        CSP frame-src is missing
     6        https://bugs.webkit.org/show_bug.cgi?id=58643
     7
     8        This is a first cut at an implementation of frame-src.  There are a
     9        couple things that will need to be improved:
     10
     11          1) I don't think we're handling in-frame navigation properly.  This
     12             patch only covers setting the src attribute of the frame, but I
     13             think the intent of the spec is to cover navigation as well.
     14
     15          2) The console message is printed twice, once when we try to load the
     16             frame and again when we attach the frame to the render tree.
     17
     18        I'll file bugs about these issues (blocking
     19        https://bugs.webkit.org/show_bug.cgi?id=53572) once this patch lands.
     20
     21        Tests: http/tests/security/contentSecurityPolicy/frame-src-allowed.html
     22               http/tests/security/contentSecurityPolicy/frame-src-blocked.html
     23
     24        * html/HTMLFrameElementBase.cpp:
     25        (WebCore::HTMLFrameElementBase::isURLAllowed):
     26        * page/ContentSecurityPolicy.cpp:
     27        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
     28        (WebCore::ContentSecurityPolicy::addDirective):
     29        * page/ContentSecurityPolicy.h:
     30
    1312011-04-20  Jia Pu  <jpu@apple.com>
    232

  • trunk/Source/WebCore/html/HTMLFrameElementBase.cpp

    r81038 r84460  
    2626
    2727#include "Attribute.h"
     28#include "ContentSecurityPolicy.h"
    2829#include "Document.h"
    2930#include "EventNames.h"
    … …  
    7677            return false;
    7778    }
     79
     80    // FIXME: Currently the spec is ambiguous as to whether we should check
     81    // the Content-Security-Policy of the parent frame or the requester.
     82    // We're using the parent frame for now, but we might have to change
     83    // this if the spec changes.
     84    if (!document()->contentSecurityPolicy()->allowChildFrameFromSource(completeURL))
     85        return false;
    7886
    7987    // We allow one level of self-reference because some sites depend on that.

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r84457 r84460  
    551551}
    552552
     553bool ContentSecurityPolicy::allowChildFrameFromSource(const KURL& url) const
     554{
     555    if (!m_frameSrc || m_frameSrc->allows(url))
     556        return true;
     557
     558    reportViolation(makeString("Refused to load frame from '", url.string(), "' because of Content-Security-Policy.\n"));
     559    return false;
     560}
     561
    553562bool ContentSecurityPolicy::allowImageFromSource(const KURL& url) const
    554563{
    … …  
    662671    DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
    663672    DEFINE_STATIC_LOCAL(String, objectSrc, ("object-src"));
     673    DEFINE_STATIC_LOCAL(String, frameSrc, ("frame-src"));
    664674    DEFINE_STATIC_LOCAL(String, imgSrc, ("img-src"));
    665675    DEFINE_STATIC_LOCAL(String, styleSrc, ("style-src"));
    … …  
    674684    else if (!m_objectSrc && equalIgnoringCase(name, objectSrc))
    675685        m_objectSrc = adoptPtr(new CSPDirective(value, m_document->securityOrigin()));
     686    else if (!m_frameSrc && equalIgnoringCase(name, frameSrc))
     687        m_frameSrc = adoptPtr(new CSPDirective(value, m_document->securityOrigin()));
    676688    else if (!m_imgSrc && equalIgnoringCase(name, imgSrc))
    677689        m_imgSrc = adoptPtr(new CSPDirective(value, m_document->securityOrigin()));

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r84457 r84460  
    5454    bool allowScriptFromSource(const KURL&) const;
    5555    bool allowObjectFromSource(const KURL&) const;
     56    bool allowChildFrameFromSource(const KURL&) const;
    5657    bool allowImageFromSource(const KURL&) const;
    5758    bool allowStyleFromSource(const KURL&) const;
    … …  
    7475    OwnPtr<CSPDirective> m_scriptSrc;
    7576    OwnPtr<CSPDirective> m_objectSrc;
     77    OwnPtr<CSPDirective> m_frameSrc;
    7678    OwnPtr<CSPDirective> m_imgSrc;
    7779    OwnPtr<CSPDirective> m_styleSrc;
Note: See TracChangeset for help on using the changeset viewer.